Changeset 739 for branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample
- Timestamp:
- Nov 12, 2012, 7:37:04 PM (13 years ago)
- Location:
- branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample
- Files:
-
- 27 edited
-
Big500users.html (modified) (49 diffs)
-
DMSMig.html (modified) (2 diffs)
-
DomApps.html (modified) (37 diffs)
-
ExNetworks.html (modified) (2 diffs)
-
HA.html (modified) (27 diffs)
-
RefSection.html (modified) (1 diff)
-
apa.html (modified) (21 diffs)
-
appendix.html (modified) (32 diffs)
-
ch14.html (modified) (7 diffs)
-
go01.html (modified) (1 diff)
-
happy.html (modified) (144 diffs)
-
index.html (modified) (1 diff)
-
ix01.html (modified) (1 diff)
-
kerberos.html (modified) (73 diffs)
-
net2000users.html (modified) (59 diffs)
-
ntmigration.html (modified) (43 diffs)
-
nw4migration.html (modified) (26 diffs)
-
pr01.html (modified) (1 diff)
-
pr02.html (modified) (1 diff)
-
pr03.html (modified) (1 diff)
-
preface.html (modified) (7 diffs)
-
primer.html (modified) (35 diffs)
-
secure.html (modified) (85 diffs)
-
simple.html (modified) (61 diffs)
-
small.html (modified) (46 diffs)
-
unixclients.html (modified) (89 diffs)
-
upgrades.html (modified) (51 diffs)
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/Big500users.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 4. The 500-User Office"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id33 6007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 4. The 500-User Office"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id334536">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334566">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334641">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334670">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id334846">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334866">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335580">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336096">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id339071">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id339124">Questions and Answers</a></span></dt></dl></div><p> 2 2 The Samba-3 networking you explored in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> covers the finer points of 3 3 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced … … 18 18 to make printing more complex for the administrator while making it easier for the user. 19 19 </p><p> 20 <a class="indexterm" name="id33 5954"></a>21 <a class="indexterm" name="id33 5961"></a>22 <a class="indexterm" name="id33 5967"></a>20 <a class="indexterm" name="id334482"></a> 21 <a class="indexterm" name="id334489"></a> 22 <a class="indexterm" name="id334496"></a> 23 23 <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> demonstrates operation of a DHCP server and a DNS server 24 24 as well as a central WINS server. You validated the operation of these services and … … 42 42 You should take the opportunity to innovate and expand on the methods presented 43 43 here and explore them to the fullest. 44 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id33 6007"></a>Introduction</h2></div></div></div><p>44 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id334536"></a>Introduction</h2></div></div></div><p> 45 45 Business continues to go well for Abmas. Mr. Meany is driving your success and the 46 46 network continues to grow thanks to the hard work Christine has done. You recently … … 67 67 it is rolled out. Your strategy is to complete the new network so that it 68 68 is ready for operation when the old office moves into the new premises. 69 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id33 6038"></a>Assignment Tasks</h3></div></div></div><p>69 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id334566"></a>Assignment Tasks</h3></div></div></div><p> 70 70 The acquired business had 280 network users. The old Abmas building housed 71 71 220 network users in unbelievably cramped conditions. The network that … … 108 108 every four months. They automatically roll that out to each desktop system. 109 109 You must keep DirectPointe informed of all changes. 110 </p><p><a class="indexterm" name="id33 6088"></a>110 </p><p><a class="indexterm" name="id334616"></a> 111 111 The new network has a single Samba Primary Domain Controller (PDC) located in the 112 112 Network Operation Center (NOC). Buildings 1 and 2 each have a local server … … 116 116 Printing is based on raw pass-through facilities just as it has been used so far. 117 117 All printer drivers are installed on the desktop and notebook computers. 118 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id33 6113"></a>Dissection and Discussion</h2></div></div></div><p>119 <a class="indexterm" name="id33 6121"></a>118 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id334641"></a>Dissection and Discussion</h2></div></div></div><p> 119 <a class="indexterm" name="id334649"></a> 120 120 The example you are building in this chapter is of a network design that works, but this 121 121 does not make it a design that is recommended. As a general rule, there should be at least … … 128 128 controller. This is not a good omen for user satisfaction. You, of course, address this 129 129 very soon (see <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 130 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id33 6141"></a>Technical Issues</h3></div></div></div><p>130 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id334670"></a>Technical Issues</h3></div></div></div><p> 131 131 Stan has talked you into a horrible compromise, but it is addressed. Just make 132 132 certain that the performance of this network is well validated before going live. … … 134 134 Design decisions made in this design include the following: 135 135 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 136 <a class="indexterm" name="id33 6161"></a>137 <a class="indexterm" name="id33 6168"></a>138 <a class="indexterm" name="id33 6174"></a>136 <a class="indexterm" name="id334689"></a> 137 <a class="indexterm" name="id334696"></a> 138 <a class="indexterm" name="id334702"></a> 139 139 A single PDC is being implemented. This limitation is based on the choice not to 140 140 use LDAP. Many network administrators fear using LDAP because of the perceived … … 142 142 identity management as well as to store network access credentials. 143 143 </p></li><li class="listitem"><p> 144 <a class="indexterm" name="id33 6188"></a>145 <a class="indexterm" name="id33 6195"></a>144 <a class="indexterm" name="id334716"></a> 145 <a class="indexterm" name="id334723"></a> 146 146 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the 147 147 only choice that makes sense with 500 users is to use the tdbsam passwd backend. … … 157 157 integrity of operations considerations. 158 158 </p></li><li class="listitem"><p> 159 <a class="indexterm" name="id33 6229"></a>159 <a class="indexterm" name="id334757"></a> 160 160 A single central WINS server is being used. The PDC is also the WINS server. 161 161 Any attempt to operate a routed network without a WINS server while using NetBIOS … … 168 168 why a single WINS server is being implemented. This should work without a problem. 169 169 </p></li><li class="listitem"><p> 170 <a class="indexterm" name="id33 6261"></a>170 <a class="indexterm" name="id334789"></a> 171 171 BDCs make use of <code class="literal">winbindd</code> to provide 172 172 access to domain security credentials for file system access and object storage. 173 173 </p></li><li class="listitem"><p> 174 <a class="indexterm" name="id33 6279"></a>175 <a class="indexterm" name="id33 6288"></a>174 <a class="indexterm" name="id334807"></a> 175 <a class="indexterm" name="id334816"></a> 176 176 Configuration of Windows XP Professional clients is achieved using DHCP. Each 177 177 subnet has its own DHCP server. Backup DHCP serving is provided by one … … 189 189 each subnet. If in the future more addresses are required, it would make sense 190 190 to add further subnets rather than change addressing. 191 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id33 6318"></a>Political Issues</h3></div></div></div><p>191 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id334846"></a>Political Issues</h3></div></div></div><p> 192 192 This case gets close to the real world. You and I know the right way to implement 193 193 domain control. Politically, we have to navigate a minefield. In this case, the need is to … … 195 195 by having the real solution ready before it is needed. That real solution is presented in 196 196 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 197 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id33 6338"></a>Implementation</h2></div></div></div><p>197 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id334866"></a>Implementation</h2></div></div></div><p> 198 198 The following configuration process begins following installation of Red Hat Fedora Core2 on the 199 199 three servers shown in the network topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. You have … … 206 206 The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to 207 207 the directory location beginning with <code class="filename">/var/lib/named</code>. 208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Server Preparation: All Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id33 7052"></a>Server Preparation: All Servers</h3></div></div></div><p>208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Server Preparation: All Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id335580"></a>Server Preparation: All Servers</h3></div></div></div><p> 209 209 The following steps apply to all servers. Follow each step carefully. 210 </p><div class="procedure" title="Procedure 4.1. Server Preparation Steps"><a name="id33 7062"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>210 </p><div class="procedure" title="Procedure 4.1. Server Preparation Steps"><a name="id335590"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 211 211 Using the UNIX/Linux system tools, set the name of the server as shown in the network 212 212 topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. For SUSE Linux products, the tool … … 222 222 </pre><p> 223 223 </p></li><li class="step" title="Step 2"><p> 224 <a class="indexterm" name="id33 7123"></a>225 <a class="indexterm" name="id33 7130"></a>224 <a class="indexterm" name="id335651"></a> 225 <a class="indexterm" name="id335658"></a> 226 226 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 227 227 of all network interfaces that are on the host server. This is necessary so that during … … 231 231 should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file. 232 232 </p></li><li class="step" title="Step 3"><p> 233 <a class="indexterm" name="id33 7165"></a>233 <a class="indexterm" name="id335693"></a> 234 234 All DNS name resolution should be handled locally. To ensure that the server is configured 235 235 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following … … 242 242 that is running locally to resolve names to addresses. 243 243 </p></li><li class="step" title="Step 4"><p> 244 <a class="indexterm" name="id33 7193"></a>245 <a class="indexterm" name="id33 7200"></a>244 <a class="indexterm" name="id335721"></a> 245 <a class="indexterm" name="id335728"></a> 246 246 Add the <code class="constant">root</code> user to the password backend: 247 247 </p><pre class="screen"> … … 256 256 without considerable trouble. 257 257 </p></li><li class="step" title="Step 5"><p> 258 <a class="indexterm" name="id33 7241"></a>259 <a class="indexterm" name="id33 7248"></a>258 <a class="indexterm" name="id335770"></a> 259 <a class="indexterm" name="id335776"></a> 260 260 Create the username map file to permit the <code class="constant">root</code> account to be called 261 261 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 295 295 to port 9100. Use any other port the manufacturer specifies for direct mode, 296 296 raw printing. This allows the CUPS spooler to print using raw mode protocols. 297 <a class="indexterm" name="id33 7328"></a>298 <a class="indexterm" name="id33 7335"></a>297 <a class="indexterm" name="id335856"></a> 298 <a class="indexterm" name="id335863"></a> 299 299 </p></li><li class="step" title="Step 9"><p> 300 <a class="indexterm" name="id33 7348"></a>300 <a class="indexterm" name="id335876"></a> 301 301 Only on the server to which the printer is attached configure the CUPS Print 302 302 Queues as follows: … … 304 304 <code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 305 305 </pre><p> 306 <a class="indexterm" name="id33 7382"></a>306 <a class="indexterm" name="id335910"></a> 307 307 This step creates the necessary print queue to use no assigned print filter. This 308 308 is ideal for raw printing, that is, printing without use of filters. … … 324 324 </pre><p> 325 325 </p></li><li class="step" title="Step 12"><p> 326 <a class="indexterm" name="id33 7455"></a>327 <a class="indexterm" name="id33 7461"></a>328 <a class="indexterm" name="id33 7468"></a>326 <a class="indexterm" name="id335983"></a> 327 <a class="indexterm" name="id335990"></a> 328 <a class="indexterm" name="id335996"></a> 329 329 This step, as well as the next one, may be omitted where CUPS version 1.1.18 330 330 or later is in use. Although it does no harm to follow it anyway, and may … … 337 337 </pre><p> 338 338 </p></li><li class="step" title="Step 13"><p> 339 <a class="indexterm" name="id33 7500"></a>339 <a class="indexterm" name="id336029"></a> 340 340 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 341 341 </p><pre class="screen"> … … 360 360 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not 361 361 as elegantly as you see in the next chapter. 362 </p></div></div><div class="sect2" title="Server-Specific Preparation"><div class="titlepage"><div><div><h3 class="title"><a name="id33 7568"></a>Server-Specific Preparation</h3></div></div></div><p>362 </p></div></div><div class="sect2" title="Server-Specific Preparation"><div class="titlepage"><div><div><h3 class="title"><a name="id336096"></a>Server-Specific Preparation</h3></div></div></div><p> 363 363 There are some steps that apply to particular server functionality only. Each step is critical 364 364 to correct server operation. The following step-by-step installation guidance will assist you 365 365 in working through the process of configuring the PDC and then both BDC's. 366 </p><div class="sect3" title="Configuration for Server: MASSIVE"><div class="titlepage"><div><div><h4 class="title"><a name="id33 7579"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>366 </p><div class="sect3" title="Configuration for Server: MASSIVE"><div class="titlepage"><div><div><h4 class="title"><a name="id336107"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p> 367 367 The steps presented here attempt to implement Samba installation in a generic manner. While 368 368 some steps are clearly specific to Linux, it should not be too difficult to apply them to 369 369 your platform of choice. 370 </p><div class="procedure" title="Procedure 4.2. Primary Domain Controller Preparation"><a name="id33 7592"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>371 <a class="indexterm" name="id33 7603"></a>372 <a class="indexterm" name="id33 7610"></a>370 </p><div class="procedure" title="Procedure 4.2. Primary Domain Controller Preparation"><a name="id336120"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 371 <a class="indexterm" name="id336132"></a> 372 <a class="indexterm" name="id336138"></a> 373 373 The host server acts as a router between the two internal network segments as well 374 374 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 398 398 <code class="filename">/etc/rc.d/init.d/rc.local</code>. 399 399 </p></li><li class="step" title="Step 3"><p> 400 <a class="indexterm" name="id33 7688"></a>400 <a class="indexterm" name="id336216"></a> 401 401 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 402 402 This file controls the operation of the various resolver libraries that are part of the Linux … … 406 406 </pre><p> 407 407 </p></li><li class="step" title="Step 4"><p> 408 <a class="indexterm" name="id33 7715"></a>408 <a class="indexterm" name="id336244"></a> 409 409 Create and map Windows domain groups to UNIX groups. A sample script is provided in 410 410 <a class="link" href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">“Initialize Groups Script, File: /etc/samba/initGrps.sh”</a>. Create a file containing this script. You called yours … … 413 413 validation are shown in Section 4.3.2, Step 5. 414 414 </p></li><li class="step" title="Step 5"><p> 415 <a class="indexterm" name="id33 7743"></a>416 <a class="indexterm" name="id33 7750"></a>417 <a class="indexterm" name="id33 7759"></a>415 <a class="indexterm" name="id336272"></a> 416 <a class="indexterm" name="id336279"></a> 417 <a class="indexterm" name="id336288"></a> 418 418 For each user who needs to be given a Windows domain account, make an entry in the 419 419 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 421 421 <code class="literal">smbpasswd</code> to create a domain user account. 422 422 </p><p> 423 <a class="indexterm" name="id33 7784"></a>424 <a class="indexterm" name="id33 7790"></a>425 <a class="indexterm" name="id33 7797"></a>423 <a class="indexterm" name="id336312"></a> 424 <a class="indexterm" name="id336319"></a> 425 <a class="indexterm" name="id336326"></a> 426 426 There are a number of tools for user management under UNIX, such as 427 427 <code class="literal">useradd</code>, <code class="literal">adduser</code>, as well as a plethora of custom … … 436 436 file system partition using appropriate system tools. 437 437 </p></li><li class="step" title="Step 8"><p> 438 <a class="indexterm" name="id33 7856"></a>438 <a class="indexterm" name="id336384"></a> 439 439 Create the top-level file storage directories for data and applications as follows: 440 440 </p><pre class="screen"> … … 476 476 </pre><p> 477 477 </p></li><li class="step" title="Step 10"><p> 478 <a class="indexterm" name="id33 8048"></a>479 <a class="indexterm" name="id33 8055"></a>478 <a class="indexterm" name="id336577"></a> 479 <a class="indexterm" name="id336584"></a> 480 480 Create a logon script. It is important that each line is correctly terminated with 481 481 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 519 519 isolated network segments. Remember that if the target installation platform is not Linux, it may 520 520 be necessary to adapt some commands to the equivalent on the target platform. 521 </p><div class="procedure" title="Procedure 4.3. Backup Domain Controller Configuration Steps"><a name="id33 8227"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>522 <a class="indexterm" name="id33 8238"></a>521 </p><div class="procedure" title="Procedure 4.3. Backup Domain Controller Configuration Steps"><a name="id336754"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 522 <a class="indexterm" name="id336766"></a> 523 523 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 524 524 This file controls the operation of the various resolver libraries that are part of the Linux … … 533 533 start Samba at this time. Samba is controlled by the process called <code class="literal">smb</code>. 534 534 </p></li><li class="step" title="Step 3"><p> 535 <a class="indexterm" name="id33 8286"></a>535 <a class="indexterm" name="id336813"></a> 536 536 You must now attempt to join the domain member servers to the domain. The following 537 537 instructions should be executed to effect this: … … 540 540 </pre><p> 541 541 </p></li><li class="step" title="Step 4"><p> 542 <a class="indexterm" name="id33 8316"></a>542 <a class="indexterm" name="id336843"></a> 543 543 You now start the Samba services by executing: 544 544 </p><pre class="screen"> … … 549 549 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 550 550 validated following the same methods as outlined in <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id33 8398"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id338409"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id338421"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id338432"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338444"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id338455"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id338467"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338478"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338490"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338502"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338514"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338526"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338538"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338549"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338560"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id338581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id338593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id338604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id338624"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id338636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id338648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id338668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id338680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id338691"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338738"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id338749"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id338761"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id338773"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338784"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id338796"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338807"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338819"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338830"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id338851"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id338862"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id338874"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338885"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id338906"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id338917"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id338929"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338940"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id338961"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id338972"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id338984"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338995"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339038"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id339050"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id339061"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id339073"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id339084"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id339096"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id339107"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id339119"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339130"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id339142"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id339154"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339165"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339177"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339188"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339200"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id339211"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id339223"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id339235"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id339259"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id339270"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id339282"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339293"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339305"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339316"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339328"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id339348"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id339360"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id339371"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id339383"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339425"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339436"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id339448"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339490"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339501"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id339512"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339555"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339566"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339578"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339590"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id339601"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339613"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339624"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id336925"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id336936"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id336948"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id336959"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id336971"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id336982"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id336994"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id337006"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id337017"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id337029"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id337041"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id337053"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id337065"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337076"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337088"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id337108"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id337120"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id337131"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id337152"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id337163"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id337175"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id337195"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id337207"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id337218"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id337265"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id337277"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id337288"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id337300"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id337312"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id337323"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id337335"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337346"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337358"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id337378"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id337390"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id337401"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id337413"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id337433"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id337445"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id337456"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337468"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id337488"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id337500"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id337511"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id337523"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id337566"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id337577"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id337589"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id337600"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id337612"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id337623"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id337635"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id337646"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337658"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id337669"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id337681"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id337693"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id337704"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337716"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337727"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id337739"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id337750"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id337762"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id337786"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id337798"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id337809"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337821"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337832"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337844"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id337855"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id337876"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id337887"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id337899"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id337910"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id337952"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id337963"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id337975"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338017"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id338029"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id338040"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338082"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id338094"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id338106"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338117"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id338129"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id338140"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id338152"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen"> 552 552 # Abmas Accounting Inc. 553 553 … … 899 899 net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d 900 900 </pre></div></div><br class="example-break"><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p> 901 <a class="indexterm" name="id33 9909"></a>902 <a class="indexterm" name="id33 9916"></a>901 <a class="indexterm" name="id338437"></a> 902 <a class="indexterm" name="id338443"></a> 903 903 There are two essential steps to process startup configuration. A process 904 904 must be configured so that it is automatically restarted each time the server … … 909 909 necessary start or kill script is run. 910 910 </p><p> 911 <a class="indexterm" name="id33 9948"></a>911 <a class="indexterm" name="id338475"></a> 912 912 In the event that a service is provided not as a daemon but via the internetworking 913 913 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 919 919 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 920 920 are installing Samba. 921 </p><div class="procedure" title="Procedure 4.4. Process Startup Configuration Steps"><a name="id33 9987"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>921 </p><div class="procedure" title="Procedure 4.4. Process Startup Configuration Steps"><a name="id338515"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 922 922 Use the standard system tool to configure each service to restart 923 923 automatically at every system reboot. For example, 924 <a class="indexterm" name="id3 40000"></a>924 <a class="indexterm" name="id338527"></a> 925 925 </p><pre class="screen"> 926 926 <code class="prompt">root# </code> chkconfig dhpc on … … 931 931 </pre><p> 932 932 </p></li><li class="step" title="Step 2"><p> 933 <a class="indexterm" name="id3 40049"></a>934 <a class="indexterm" name="id3 40056"></a>935 <a class="indexterm" name="id3 40062"></a>933 <a class="indexterm" name="id338576"></a> 934 <a class="indexterm" name="id338583"></a> 935 <a class="indexterm" name="id338590"></a> 936 936 Now start each service to permit the system to be validated. 937 937 Execute each of the following in the sequence shown: … … 947 947 The procedure for desktop client configuration for the network in this chapter is similar to 948 948 that used for the previous one. There are a few subtle changes that should be noted. 949 </p><div class="procedure" title="Procedure 4.5. Windows Client Configuration Steps"><a name="id3 40124"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>949 </p><div class="procedure" title="Procedure 4.5. Windows Client Configuration Steps"><a name="id338651"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 950 950 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 951 951 TCP/IP protocol configuration. 952 <a class="indexterm" name="id3 40136"></a>953 <a class="indexterm" name="id3 40142"></a>952 <a class="indexterm" name="id338663"></a> 953 <a class="indexterm" name="id338670"></a> 954 954 DHCP configures all Windows clients to use the WINS Server address that has been defined 955 955 for the local subnet. … … 985 985 also configure use of the identical printers that are located in the financial services department. 986 986 Install printers on each machine using the following steps: 987 </p><div class="procedure" title="Procedure 4.6. Steps to Install Printer Drivers on Windows Clients"><a name="id3 40259"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol class="procedure" type="1"><li class="step" title="Step 7.1"><p>987 </p><div class="procedure" title="Procedure 4.6. Steps to Install Printer Drivers on Windows Clients"><a name="id338786"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol class="procedure" type="1"><li class="step" title="Step 7.1"><p> 988 988 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 989 989 Ensure that <span class="guimenuitem">Local printer</span> is selected. … … 1037 1037 </p></li><li class="step" title="Step 12"><p> 1038 1038 Instruct all users to log onto the workstation using their assigned username and password. 1039 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id3 40544"></a>Key Points Learned</h3></div></div></div><p>1039 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id339071"></a>Key Points Learned</h3></div></div></div><p> 1040 1040 The network you have just deployed has been a valuable exercise in forced constraint. 1041 1041 You have deployed a network that works well, although you may soon start to see … … 1053 1053 </p></li><li class="listitem"><p> 1054 1054 The introduction of roaming profiles 1055 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 40597"></a>Questions and Answers</h2></div></div></div><p>1056 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id3 40606"></a><dl><dt> <a href="Big500users.html#id340612">1055 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id339124"></a>Questions and Answers</h2></div></div></div><p> 1056 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id339133"></a><dl><dt> <a href="Big500users.html#id339140"> 1057 1057 The example smb.conf files in this chapter make use of the include facility. 1058 1058 How may I get to see what the actual working smb.conf settings are? 1059 </a></dt><dt> <a href="Big500users.html#id3 40660">1059 </a></dt><dt> <a href="Big500users.html#id339187"> 1060 1060 Why does the include file common.conf have an empty include statement? 1061 </a></dt><dt> <a href="Big500users.html#id3 40716">1061 </a></dt><dt> <a href="Big500users.html#id339244"> 1062 1062 I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam 1063 1063 passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. 1064 1064 I tried using rsync to replicate the passdb.tdb, and it seems to work fine! 1065 1065 So what is the problem? 1066 </a></dt><dt> <a href="Big500users.html#id3 40766">1066 </a></dt><dt> <a href="Big500users.html#id339294"> 1067 1067 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1068 </a></dt><dt> <a href="Big500users.html#id3 40791">1068 </a></dt><dt> <a href="Big500users.html#id339319"> 1069 1069 How does the Windows client find the PDC? 1070 </a></dt><dt> <a href="Big500users.html#id3 40811">1070 </a></dt><dt> <a href="Big500users.html#id339338"> 1071 1071 Why did you enable IP forwarding (routing) only on the server called MASSIVE? 1072 </a></dt><dt> <a href="Big500users.html#id3 40838">1072 </a></dt><dt> <a href="Big500users.html#id339365"> 1073 1073 You did nothing special to implement roaming profiles. Why? 1074 </a></dt><dt> <a href="Big500users.html#id3 40856">1074 </a></dt><dt> <a href="Big500users.html#id339383"> 1075 1075 On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. 1076 1076 You did not configure any PAM settings. Is this an omission? 1077 </a></dt><dt> <a href="Big500users.html#id3 40883">1077 </a></dt><dt> <a href="Big500users.html#id339410"> 1078 1078 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1079 </a></dt><dt> <a href="Big500users.html#id3 40920">1079 </a></dt><dt> <a href="Big500users.html#id339447"> 1080 1080 The domain controller has an auto-shutdown script. Isn't that dangerous? 1081 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id3 40612"></a><a name="id340615"></a></td><td align="left" valign="top"><p>1081 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id339140"></a><a name="id339142"></a></td><td align="left" valign="top"><p> 1082 1082 The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility. 1083 1083 How may I get to see what the actual working <code class="filename">smb.conf</code> settings are? … … 1087 1087 <code class="prompt">root# </code> testparm -s | less 1088 1088 </pre><p> 1089 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40660"></a><a name="id340662"></a></td><td align="left" valign="top"><p>1089 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339187"></a><a name="id339189"></a></td><td align="left" valign="top"><p> 1090 1090 Why does the include file <code class="filename">common.conf</code> have an empty include statement? 1091 1091 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1100 1100 the include in place, even though the file it points to has already been included. This is a bug 1101 1101 that will be fixed at a future date. 1102 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40716"></a><a name="id340718"></a></td><td align="left" valign="top"><p>1102 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339244"></a><a name="id339246"></a></td><td align="left" valign="top"><p> 1103 1103 I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em> 1104 1104 passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend. … … 1110 1110 to log onto the network following a reboot and may have to rejoin the domain to recover network 1111 1111 access capability. 1112 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40766"></a><a name="id340769"></a></td><td align="left" valign="top"><p>1112 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339294"></a><a name="id339296"></a></td><td align="left" valign="top"><p> 1113 1113 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1114 1114 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1119 1119 The only exception to this rule is when the client makes a directed request from a specific DHCP server 1120 1120 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. 1121 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40791"></a><a name="id340794"></a></td><td align="left" valign="top"><p>1121 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339319"></a><a name="id339321"></a></td><td align="left" valign="top"><p> 1122 1122 How does the Windows client find the PDC? 1123 1123 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1126 1126 to register itself with the WINS server and to obtain enumeration of vital network information to 1127 1127 enable it to operate successfully. 1128 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40811"></a><a name="id340813"></a></td><td align="left" valign="top"><p>1128 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339338"></a><a name="id339340"></a></td><td align="left" valign="top"><p> 1129 1129 Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>? 1130 1130 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1133 1133 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network 1134 1134 segments to the router that is its gateway to them. 1135 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40838"></a><a name="id340840"></a></td><td align="left" valign="top"><p>1135 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339365"></a><a name="id339367"></a></td><td align="left" valign="top"><p> 1136 1136 You did nothing special to implement roaming profiles. Why? 1137 1137 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1138 1138 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional 1139 1139 clients is to use roaming profiles. 1140 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40856"></a><a name="id340858"></a></td><td align="left" valign="top"><p>1140 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339383"></a><a name="id339385"></a></td><td align="left" valign="top"><p> 1141 1141 On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file. 1142 1142 You did not configure any PAM settings. Is this an omission? … … 1147 1147 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name 1148 1148 service switch (NSS). 1149 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40883"></a><a name="id340885"></a></td><td align="left" valign="top"><p>1149 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339410"></a><a name="id339412"></a></td><td align="left" valign="top"><p> 1150 1150 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1151 1151 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1156 1156 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 1157 1157 handle this functionality gracefully. 1158 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 40920"></a><a name="id340922"></a></td><td align="left" valign="top"><p>1158 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id339447"></a><a name="id339449"></a></td><td align="left" valign="top"><p> 1159 1159 The domain controller has an auto-shutdown script. Isn't that dangerous? 1160 1160 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/DMSMig.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" title="Part II. Domain Members, Updating Samba and Migration"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" title="Domain Members, Updating Samba and Migration"><div><div><div><h1 class="title"><a name="id35 7819"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" title="Part II. Domain Members, Updating Samba and Migration"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" title="Domain Members, Updating Samba and Migration"><div><div><div><h1 class="title"><a name="id356343"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> covers two main topics: How to add 3 3 Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other … … 8 8 to a Samba or a Windows networking domain may also benefit by referring to the book 9 9 <span class="emphasis"><em>The Official Samba-3 HOWTO and Reference Guide.</em></span> 10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id35 7946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id366117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id373183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html>10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id356470">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356518">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id356547">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id357171">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id357255">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363529">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id363573">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id364642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id364726">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id365940">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366596">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id366712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366809">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366993">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367371">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id367517">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367593">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367644">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367806">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id368109">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id368129">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370790">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id370824">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id371710">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371809">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id371886">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371958">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id372125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id372134">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/DomApps.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id38 2225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id38 2181"></a>3 <a class="indexterm" name="id38 2187"></a>4 <a class="indexterm" name="id38 2194"></a>5 <a class="indexterm" name="id38 2201"></a>6 <a class="indexterm" name="id38 2208"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id380752">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380775">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id380865">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380894">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id381040">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id381058">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382809">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382864">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id380708"></a> 3 <a class="indexterm" name="id380714"></a> 4 <a class="indexterm" name="id380721"></a> 5 <a class="indexterm" name="id380728"></a> 6 <a class="indexterm" name="id380735"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2225"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id380752"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2248"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id38 2256"></a>35 <a class="indexterm" name="id38 2264"></a>33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id380775"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id380783"></a> 35 <a class="indexterm" name="id380791"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id38 2279"></a>43 <a class="indexterm" name="id38 2286"></a>42 <a class="indexterm" name="id380806"></a> 43 <a class="indexterm" name="id380813"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id38 2301"></a>54 <a class="indexterm" name="id38 2308"></a>55 <a class="indexterm" name="id38 2315"></a>53 <a class="indexterm" name="id380828"></a> 54 <a class="indexterm" name="id380835"></a> 55 <a class="indexterm" name="id380842"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2338"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id380865"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, … … 74 74 </p></li><li class="listitem"><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2367"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id38 2375"></a>78 <a class="indexterm" name="id38 2381"></a>79 <a class="indexterm" name="id38 2388"></a>80 <a class="indexterm" name="id38 2395"></a>81 <a class="indexterm" name="id38 2402"></a>82 <a class="indexterm" name="id38 2409"></a>83 <a class="indexterm" name="id38 2415"></a>84 <a class="indexterm" name="id38 2422"></a>85 <a class="indexterm" name="id38 2429"></a>86 <a class="indexterm" name="id38 2436"></a>87 <a class="indexterm" name="id38 2443"></a>88 <a class="indexterm" name="id38 2450"></a>89 <a class="indexterm" name="id38 2459"></a><a class="indexterm" name="id382464"></a>76 </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id380894"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id380902"></a> 78 <a class="indexterm" name="id380909"></a> 79 <a class="indexterm" name="id380916"></a> 80 <a class="indexterm" name="id380922"></a> 81 <a class="indexterm" name="id380929"></a> 82 <a class="indexterm" name="id380936"></a> 83 <a class="indexterm" name="id380943"></a> 84 <a class="indexterm" name="id380950"></a> 85 <a class="indexterm" name="id380956"></a> 86 <a class="indexterm" name="id380963"></a> 87 <a class="indexterm" name="id380970"></a> 88 <a class="indexterm" name="id380977"></a> 89 <a class="indexterm" name="id380986"></a><a class="indexterm" name="id380992"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 108 108 </p></li><li class="listitem"><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2513"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id381040"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2530"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id38 2538"></a>116 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id381058"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id381065"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id38 2552"></a>124 <a class="indexterm" name="id381079"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 126 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 127 <a class="indexterm" name="id38 2566"></a>128 <a class="indexterm" name="id38 2572"></a>127 <a class="indexterm" name="id381093"></a> 128 <a class="indexterm" name="id381100"></a> 129 129 krb5-libs 130 130 </p></li><li class="listitem"><p> … … 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id38 2602"></a>139 <a class="indexterm" name="id381129"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 141 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> … … 144 144 heimdal-devel 145 145 </p></li><li class="listitem"><p> 146 <a class="indexterm" name="id38 2625"></a>146 <a class="indexterm" name="id381153"></a> 147 147 heimdal 148 148 </p></li><li class="listitem"><p> … … 153 153 for your Linux system to ensure that the packages are correctly updated. 154 154 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id38 2648"></a>156 <a class="indexterm" name="id38 2655"></a>157 <a class="indexterm" name="id38 2662"></a>155 <a class="indexterm" name="id381175"></a> 156 <a class="indexterm" name="id381182"></a> 157 <a class="indexterm" name="id381189"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id38 2673"></a>164 <a class="indexterm" name="id38 2680"></a>163 <a class="indexterm" name="id381201"></a> 164 <a class="indexterm" name="id381208"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 167 </p></div><div class="sect2" title="Removal of Pre-Existing Conflicting RPMs"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id38 2701"></a>168 <a class="indexterm" name="id381229"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id38 2712"></a>173 <a class="indexterm" name="id38 2719"></a>174 <a class="indexterm" name="id38 2725"></a>172 <a class="indexterm" name="id381240"></a> 173 <a class="indexterm" name="id381246"></a> 174 <a class="indexterm" name="id381253"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2764"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id38 2771"></a>186 <a class="indexterm" name="id38 2778"></a>187 <a class="indexterm" name="id38 2787"></a>188 <a class="indexterm" name="id38 2794"></a>184 </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id381292"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id381299"></a> 186 <a class="indexterm" name="id381306"></a> 187 <a class="indexterm" name="id381315"></a> 188 <a class="indexterm" name="id381322"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id38 2810"></a>197 <a class="indexterm" name="id38 2817"></a>198 <a class="indexterm" name="id38 2824"></a>199 <a class="indexterm" name="id38 2830"></a>200 <a class="indexterm" name="id38 2837"></a>201 <a class="indexterm" name="id38 2846"></a>202 <a class="indexterm" name="id38 2853"></a>196 <a class="indexterm" name="id381338"></a> 197 <a class="indexterm" name="id381345"></a> 198 <a class="indexterm" name="id381352"></a> 199 <a class="indexterm" name="id381358"></a> 200 <a class="indexterm" name="id381365"></a> 201 <a class="indexterm" name="id381374"></a> 202 <a class="indexterm" name="id381381"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id38 2882"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>211 <a class="indexterm" name="id38 2893"></a>210 </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id381410"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 211 <a class="indexterm" name="id381421"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 215 </p></li><li class="step" title="Step 2"><p> 216 <a class="indexterm" name="id38 2926"></a>217 <a class="indexterm" name="id38 2933"></a>218 <a class="indexterm" name="id38 2940"></a>219 <a class="indexterm" name="id38 2947"></a>220 <a class="indexterm" name="id38 2953"></a>221 <a class="indexterm" name="id38 2960"></a>222 <a class="indexterm" name="id38 2967"></a>223 <a class="indexterm" name="id38 2974"></a>224 <a class="indexterm" name="id38 2981"></a>225 <a class="indexterm" name="id38 2990"></a>226 <a class="indexterm" name="id38 2996"></a>227 <a class="indexterm" name="id38 3003"></a>228 <a class="indexterm" name="id38 3010"></a>216 <a class="indexterm" name="id381455"></a> 217 <a class="indexterm" name="id381462"></a> 218 <a class="indexterm" name="id381468"></a> 219 <a class="indexterm" name="id381475"></a> 220 <a class="indexterm" name="id381482"></a> 221 <a class="indexterm" name="id381489"></a> 222 <a class="indexterm" name="id381495"></a> 223 <a class="indexterm" name="id381502"></a> 224 <a class="indexterm" name="id381509"></a> 225 <a class="indexterm" name="id381518"></a> 226 <a class="indexterm" name="id381525"></a> 227 <a class="indexterm" name="id381532"></a> 228 <a class="indexterm" name="id381538"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 230 be in UPPERCASE, or you will get an error: <span class="quote">“<span class="quote">Cannot find KDC for requested realm while getting … … 242 242 when you try to join the realm. 243 243 </p></li><li class="step" title="Step 3"><p> 244 <a class="indexterm" name="id38 3045"></a>244 <a class="indexterm" name="id381574"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id38 3105"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id381633"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3127"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id38 3135"></a>270 </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id381656"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id381663"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id38 3144"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>275 <a class="indexterm" name="id38 3156"></a>276 <a class="indexterm" name="id38 3162"></a>277 <a class="indexterm" name="id38 3169"></a>278 <a class="indexterm" name="id38 3176"></a>279 <a class="indexterm" name="id38 3183"></a>274 </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id381673"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 275 <a class="indexterm" name="id381684"></a> 276 <a class="indexterm" name="id381691"></a> 277 <a class="indexterm" name="id381698"></a> 278 <a class="indexterm" name="id381704"></a> 279 <a class="indexterm" name="id381711"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team … … 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id38 3207"></a>286 <a class="indexterm" name="id38 3213"></a>285 <a class="indexterm" name="id381735"></a> 286 <a class="indexterm" name="id381742"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that … … 294 294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 295 </p></li><li class="step" title="Step 3"><p> 296 <a class="indexterm" name="id38 3261"></a>297 <a class="indexterm" name="id38 3268"></a>298 <a class="indexterm" name="id38 3274"></a>i299 <a class="indexterm" name="id38 3286"></a>300 <a class="indexterm" name="id38 3293"></a>296 <a class="indexterm" name="id381790"></a> 297 <a class="indexterm" name="id381797"></a> 298 <a class="indexterm" name="id381803"></a>i 299 <a class="indexterm" name="id381815"></a> 300 <a class="indexterm" name="id381822"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to … … 308 308 </pre><p> 309 309 </p></li><li class="step" title="Step 4"><p> 310 <a class="indexterm" name="id38 3324"></a>311 <a class="indexterm" name="id38 3331"></a>312 <a class="indexterm" name="id38 3337"></a>313 <a class="indexterm" name="id38 3344"></a>314 <a class="indexterm" name="id38 3351"></a>310 <a class="indexterm" name="id381853"></a> 311 <a class="indexterm" name="id381860"></a> 312 <a class="indexterm" name="id381866"></a> 313 <a class="indexterm" name="id381873"></a> 314 <a class="indexterm" name="id381880"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 321 321 </pre><p> 322 322 </p></li><li class="step" title="Step 5"><p> 323 <a class="indexterm" name="id38 3390"></a>324 <a class="indexterm" name="id38 3396"></a>325 <a class="indexterm" name="id38 3406"></a>326 <a class="indexterm" name="id38 3412"></a>327 <a class="indexterm" name="id38 3419"></a>323 <a class="indexterm" name="id381919"></a> 324 <a class="indexterm" name="id381925"></a> 325 <a class="indexterm" name="id381935"></a> 326 <a class="indexterm" name="id381941"></a> 327 <a class="indexterm" name="id381948"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 358 358 This enumerates all the groups in your Active Directory tree. 359 359 </p></li><li class="step" title="Step 6"><p> 360 <a class="indexterm" name="id38 3476"></a>361 <a class="indexterm" name="id38 3483"></a>360 <a class="indexterm" name="id382005"></a> 361 <a class="indexterm" name="id382012"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 371 371 </pre><p> 372 372 </p></li><li class="step" title="Step 7"><p> 373 <a class="indexterm" name="id38 3533"></a>374 <a class="indexterm" name="id38 3540"></a>375 <a class="indexterm" name="id38 3547"></a>376 <a class="indexterm" name="id38 3553"></a>377 <a class="indexterm" name="id38 3560"></a>378 <a class="indexterm" name="id38 3567"></a>379 <a class="indexterm" name="id38 3574"></a>380 <a class="indexterm" name="id38 3581"></a>373 <a class="indexterm" name="id382062"></a> 374 <a class="indexterm" name="id382069"></a> 375 <a class="indexterm" name="id382076"></a> 376 <a class="indexterm" name="id382082"></a> 377 <a class="indexterm" name="id382089"></a> 378 <a class="indexterm" name="id382096"></a> 379 <a class="indexterm" name="id382103"></a> 380 <a class="indexterm" name="id382110"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 382 <span class="quote">“<span class="quote">root</span>”</span>, authenticates against your Active Directory domain (with … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3649"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id38 3656"></a>400 <a class="indexterm" name="id38 3663"></a>401 <a class="indexterm" name="id38 3670"></a>398 </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id382178"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id382185"></a> 400 <a class="indexterm" name="id382192"></a> 401 <a class="indexterm" name="id382199"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id38 3726"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id383737"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id383749"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id383760"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id383772"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383783"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id383799"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id383814"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id383829"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id383844"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383856"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383868"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id382255"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id382266"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id382278"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id382289"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id382301"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382312"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id382328"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id382343"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id382358"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id382373"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382385"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382396"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3905"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id38 3913"></a>412 <a class="indexterm" name="id38 3920"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id382434"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id382441"></a> 412 <a class="indexterm" name="id382448"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id38 3934"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id383939"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>416 <a class="indexterm" name="id38 3950"></a>417 <a class="indexterm" name="id38 3957"></a>418 <a class="indexterm" name="id38 3965"></a>415 </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id382462"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id382467"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 416 <a class="indexterm" name="id382479"></a> 417 <a class="indexterm" name="id382485"></a> 418 <a class="indexterm" name="id382493"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You … … 422 422 programs. 423 423 </p></li><li class="step" title="Step 2"><p> 424 <a class="indexterm" name="id38 3980"></a>425 <a class="indexterm" name="id38 3987"></a>426 <a class="indexterm" name="id38 3994"></a>427 <a class="indexterm" name="id38 4001"></a>428 <a class="indexterm" name="id38 4007"></a>424 <a class="indexterm" name="id382508"></a> 425 <a class="indexterm" name="id382515"></a> 426 <a class="indexterm" name="id382522"></a> 427 <a class="indexterm" name="id382529"></a> 428 <a class="indexterm" name="id382536"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 435 </p></li><li class="step" title="Step 3"><p> 436 <a class="indexterm" name="id38 4053"></a>437 <a class="indexterm" name="id38 4060"></a>436 <a class="indexterm" name="id382581"></a> 437 <a class="indexterm" name="id382588"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 442 442 </pre><p> 443 443 </p></li><li class="step" title="Step 4"><p> 444 <a class="indexterm" name="id38 4089"></a>445 <a class="indexterm" name="id38 4096"></a>444 <a class="indexterm" name="id382617"></a> 445 <a class="indexterm" name="id382624"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 457 457 </pre><p> 458 458 </p></li><li class="step" title="Step 6"><p> 459 <a class="indexterm" name="id38 4153"></a>459 <a class="indexterm" name="id382681"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 462 </p></li><li class="step" title="Step 7"><p> 463 <a class="indexterm" name="id38 4186"></a>463 <a class="indexterm" name="id382714"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id38 4281"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id38 4289"></a>492 <a class="indexterm" name="id38 4296"></a>493 <a class="indexterm" name="id38 4303"></a>494 <a class="indexterm" name="id38 4310"></a>495 <a class="indexterm" name="id38 4321"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id382809"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id382816"></a> 492 <a class="indexterm" name="id382823"></a> 493 <a class="indexterm" name="id382830"></a> 494 <a class="indexterm" name="id382837"></a> 495 <a class="indexterm" name="id382848"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 4336"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id38 4344"></a>504 <a class="indexterm" name="id38 4351"></a>505 <a class="indexterm" name="id38 4358"></a>506 <a class="indexterm" name="id38 4365"></a>502 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382864"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id382871"></a> 504 <a class="indexterm" name="id382878"></a> 505 <a class="indexterm" name="id382885"></a> 506 <a class="indexterm" name="id382892"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id38 4423"></a><dl><dt> <a href="DomApps.html#id384430">525 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id382950"></a><dl><dt> <a href="DomApps.html#id382957"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id38 4585">527 </a></dt><dt> <a href="DomApps.html#id383112"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id38 4721">529 </a></dt><dt> <a href="DomApps.html#id383248"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id38 4430"></a><a name="id384432"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id382957"></a><a name="id382959"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id38 4443"></a>535 <a class="indexterm" name="id38 4450"></a>536 <a class="indexterm" name="id38 4457"></a>537 <a class="indexterm" name="id38 4466"></a>538 <a class="indexterm" name="id38 4473"></a>534 <a class="indexterm" name="id382970"></a> 535 <a class="indexterm" name="id382977"></a> 536 <a class="indexterm" name="id382984"></a> 537 <a class="indexterm" name="id382993"></a> 538 <a class="indexterm" name="id383000"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id38 4492"></a>545 <a class="indexterm" name="id38 4499"></a>546 <a class="indexterm" name="id38 4508"></a>547 <a class="indexterm" name="id38 4517"></a>548 <a class="indexterm" name="id38 4526"></a>549 <a class="indexterm" name="id38 4533"></a>550 <a class="indexterm" name="id38 4540"></a>551 <a class="indexterm" name="id38 4546"></a>552 <a class="indexterm" name="id38 4553"></a>544 <a class="indexterm" name="id383019"></a> 545 <a class="indexterm" name="id383026"></a> 546 <a class="indexterm" name="id383035"></a> 547 <a class="indexterm" name="id383044"></a> 548 <a class="indexterm" name="id383053"></a> 549 <a class="indexterm" name="id383060"></a> 550 <a class="indexterm" name="id383067"></a> 551 <a class="indexterm" name="id383074"></a> 552 <a class="indexterm" name="id383080"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id38 4574"></a>560 <a class="indexterm" name="id383101"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 4585"></a><a name="id384588"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383112"></a><a name="id383115"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id38 4599"></a>567 <a class="indexterm" name="id38 4606"></a>568 <a class="indexterm" name="id38 4612"></a>569 <a class="indexterm" name="id38 4619"></a>570 <a class="indexterm" name="id38 4626"></a>566 <a class="indexterm" name="id383126"></a> 567 <a class="indexterm" name="id383133"></a> 568 <a class="indexterm" name="id383139"></a> 569 <a class="indexterm" name="id383146"></a> 570 <a class="indexterm" name="id383153"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id38 4655"></a>575 <a class="indexterm" name="id38 4662"></a>574 <a class="indexterm" name="id383182"></a> 575 <a class="indexterm" name="id383189"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id38 4679"></a>579 <a class="indexterm" name="id38 4685"></a>580 <a class="indexterm" name="id38 4692"></a>581 <a class="indexterm" name="id38 4699"></a>582 <a class="indexterm" name="id38 4706"></a>578 <a class="indexterm" name="id383206"></a> 579 <a class="indexterm" name="id383212"></a> 580 <a class="indexterm" name="id383219"></a> 581 <a class="indexterm" name="id383226"></a> 582 <a class="indexterm" name="id383233"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 4721"></a><a name="id384723"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383248"></a><a name="id383250"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/ExNetworks.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" title="Part I. Example Network Configurations"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" title="Example Network Configurations"><div><div><div><h1 class="title"><a name="id32 3031"></a>Example Network Configurations</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" title="Part I. Example Network Configurations"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" title="Example Network Configurations"><div><div><div><h1 class="title"><a name="id321531"></a>Example Network Configurations</h1></div></div></div><p> 2 2 This section of <span class="emphasis"><em>Samba-3 by Example</em></span> provides example network 3 3 configurations that can be copied, or modified as needed, and deployed as-is. … … 21 21 <a class="ulink" href="http://www.samba.org/samba/support/" target="_top">support</a> pages from 22 22 the Samba web site. 23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id32 3089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id330143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html>23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id321589">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id321619">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id321657">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id322302">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id325424">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id325808">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325825">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id325871">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325916">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id326088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id326106">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327557">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id328132">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id328152">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id328216">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id328642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328676">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id328885">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328897">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id329242">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id329275">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330030">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id334042">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id334095">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id334536">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334566">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334641">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334670">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id334846">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334866">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335580">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336096">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id339071">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id339124">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id339991">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340067">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id340195">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340598">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342251">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342264">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id342434">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id348703">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id348720">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id348809">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id349037">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id349135">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id349248">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id350249">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id350890">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id350916">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350946">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id351033">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id351371">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351396">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id351452">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351698">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id352520">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352534">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id355551">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id355690">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/HA.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 13. Performance, Reliability, and Availability"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id38 4815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></div><p>2 <a class="indexterm" name="id38 4782"></a>3 <a class="indexterm" name="id38 4788"></a>4 <a class="indexterm" name="id38 4795"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 13. Performance, Reliability, and Availability"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id383342">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id383418">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id383870">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id383895">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id384336">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id384636">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id384704">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id384766">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id384858">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id384991">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id385073">Key Points Learned</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id383309"></a> 3 <a class="indexterm" name="id383315"></a> 4 <a class="indexterm" name="id383322"></a> 5 5 Well, you have reached one of the last chapters of this book. It is customary to attempt 6 6 to wrap up the theme and contents of a book in what is generally regarded as the … … 11 11 </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p> 12 12 In a world so full of noise, how can the sparrow be heard? 13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 4815"></a>Introduction</h2></div></div></div><p>14 <a class="indexterm" name="id38 4822"></a>13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383342"></a>Introduction</h2></div></div></div><p> 14 <a class="indexterm" name="id383349"></a> 15 15 The sparrow is a small bird whose sounds are drowned out by the noise of the busy 16 16 world it lives in. Likewise, the simple steps that can be taken to improve the … … 21 21 custom tools and methods. Only passing comments are offered concerning these methods. 22 22 </p><p> 23 <a class="indexterm" name="id38 4837"></a>24 <a class="indexterm" name="id38 4844"></a>25 <a class="indexterm" name="id38 4851"></a>23 <a class="indexterm" name="id383364"></a> 24 <a class="indexterm" name="id383371"></a> 25 <a class="indexterm" name="id383378"></a> 26 26 <a class="ulink" href="http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=samba+cluster&btnG=Google+Search" target="_top">A search</a> 27 27 for <span class="quote">“<span class="quote">samba cluster</span>”</span> produced 71,600 hits. And a search for <span class="quote">“<span class="quote">highly available samba</span>”</span> … … 30 30 availability, reliability, and scalability are of vital interest to corporate network users. 31 31 </p><p> 32 <a class="indexterm" name="id38 4882"></a>32 <a class="indexterm" name="id383409"></a> 33 33 So without further background, you can review a checklist of simple steps that 34 34 can be taken to ensure acceptable network performance while keeping costs of ownership 35 35 well under control. 36 </p></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 4892"></a>Dissection and Discussion</h2></div></div></div><p>37 <a class="indexterm" name="id38 4899"></a>38 <a class="indexterm" name="id38 4906"></a>36 </p></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383418"></a>Dissection and Discussion</h2></div></div></div><p> 37 <a class="indexterm" name="id383426"></a> 38 <a class="indexterm" name="id383433"></a> 39 39 If it is your purpose to get the best mileage out of your Samba servers, there is one rule that 40 40 must be obeyed. If you want the best, keep your implementation as simple as possible. You may … … 45 45 complex ones. 46 46 </p><p> 47 <a class="indexterm" name="id38 4924"></a>48 <a class="indexterm" name="id38 4931"></a>47 <a class="indexterm" name="id383451"></a> 48 <a class="indexterm" name="id383458"></a> 49 49 Problems reported by users fall into three categories: configurations that do not work, those 50 50 that have broken behavior, and poor performance. The term <span class="emphasis"><em>broken behavior</em></span> … … 55 55 and at other times not listing them even though the machines are in use on the network. 56 56 </p><p> 57 <a class="indexterm" name="id38 4953"></a>58 <a class="indexterm" name="id38 4960"></a>59 <a class="indexterm" name="id38 4966"></a>60 <a class="indexterm" name="id38 4973"></a>61 <a class="indexterm" name="id38 4980"></a>62 <a class="indexterm" name="id38 4987"></a>57 <a class="indexterm" name="id383480"></a> 58 <a class="indexterm" name="id383486"></a> 59 <a class="indexterm" name="id383493"></a> 60 <a class="indexterm" name="id383500"></a> 61 <a class="indexterm" name="id383507"></a> 62 <a class="indexterm" name="id383514"></a> 63 63 A significant number of reports concern problems with the <code class="literal">smbfs</code> file system 64 64 driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that … … 71 71 Samba and are really foreign to it. 72 72 </p><p> 73 <a class="indexterm" name="id38 5043"></a>73 <a class="indexterm" name="id383570"></a> 74 74 The new project, <code class="literal">cifsfs</code>, is destined to replace <code class="literal">smbfs</code>. 75 75 It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in … … 78 78 Table 13.1 lists typical causes of: 79 79 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Not Working (NW)</p></li><li class="listitem"><p>Broken Behavior (BB)</p></li><li class="listitem"><p>Poor Performance (PP)</p></li></ul></div><div class="table"><a name="ProbList"></a><p class="title"><b>Table 13.1. Effect of Common Problems</b></p><div class="table-contents"><table summary="Effect of Common Problems" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th align="left"><p>Problem</p></th><th align="center"><p>NW</p></th><th align="center"><p>BB</p></th><th align="center"><p>PP</p></th></tr></thead><tbody><tr><td align="left"><p>File locking</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Hardware problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Incorrect authentication</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Incorrect configuration</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>LDAP problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Name resolution</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Printing problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Slow file transfer</p></td><td align="center"><p>-</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Winbind problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr></tbody></table></div></div><br class="table-break"><p> 80 <a class="indexterm" name="id38 5333"></a>80 <a class="indexterm" name="id383859"></a> 81 81 It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate 82 82 problems that affect basic network operation. This book has provided sufficient working examples 83 83 to help you to avoid all these problems. 84 </p></div><div class="sect1" title="Guidelines for Reliable Samba Operation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 5344"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p>85 <a class="indexterm" name="id38 5352"></a>86 <a class="indexterm" name="id38 5359"></a>84 </p></div><div class="sect1" title="Guidelines for Reliable Samba Operation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383870"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p> 85 <a class="indexterm" name="id383878"></a> 86 <a class="indexterm" name="id383885"></a> 87 87 Your objective is to provide a network that works correctly, can grow at all times, is resilient 88 88 at times of extreme demand, and can scale to meet future needs. The following subject areas provide 89 89 pointers that can help you today. 90 </p><div class="sect2" title="Name Resolution"><div class="titlepage"><div><div><h3 class="title"><a name="id38 5369"></a>Name Resolution</h3></div></div></div><p>90 </p><div class="sect2" title="Name Resolution"><div class="titlepage"><div><div><h3 class="title"><a name="id383895"></a>Name Resolution</h3></div></div></div><p> 91 91 There are three basic current problem areas: bad hostnames, routed networks, and network collisions. 92 92 These are covered in the following discussion. 93 </p><div class="sect3" title="Bad Hostnames"><div class="titlepage"><div><div><h4 class="title"><a name="id38 5379"></a>Bad Hostnames</h4></div></div></div><p>94 <a class="indexterm" name="id38 5387"></a>95 <a class="indexterm" name="id38 5396"></a>96 <a class="indexterm" name="id38 5403"></a>97 <a class="indexterm" name="id38 5409"></a>98 <a class="indexterm" name="id38 5416"></a>93 </p><div class="sect3" title="Bad Hostnames"><div class="titlepage"><div><div><h4 class="title"><a name="id383905"></a>Bad Hostnames</h4></div></div></div><p> 94 <a class="indexterm" name="id383913"></a> 95 <a class="indexterm" name="id383922"></a> 96 <a class="indexterm" name="id383929"></a> 97 <a class="indexterm" name="id383936"></a> 98 <a class="indexterm" name="id383942"></a> 99 99 When configured as a DHCP client, a number of Linux distributions set the system hostname 100 100 to <code class="constant">localhost</code>. If the parameter <em class="parameter"><code>netbios name</code></em> is not … … 108 108 correctly. 109 109 </p><p> 110 <a class="indexterm" name="id38 5465"></a>110 <a class="indexterm" name="id383991"></a> 111 111 A few sites have tried to name Windows clients and Samba servers with a name that begins 112 112 with the digits 1-9. This does not work either because it may result in the client or 113 113 server attempting to use that name as an IP address. 114 114 </p><p> 115 <a class="indexterm" name="id38 5477"></a>116 <a class="indexterm" name="id38 5486"></a>115 <a class="indexterm" name="id384004"></a> 116 <a class="indexterm" name="id384012"></a> 117 117 A Samba server called <code class="constant">FRED</code> in a NetBIOS domain called <code class="constant">COLLISION</code> 118 118 in a network environment that is part of the fully-qualified Internet domain namespace known … … 123 123 fails given that you probably do not have this in your DNS namespace. 124 124 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 125 <a class="indexterm" name="id38 5526"></a>126 <a class="indexterm" name="id38 5536"></a>127 <a class="indexterm" name="id38 5542"></a>125 <a class="indexterm" name="id384053"></a> 126 <a class="indexterm" name="id384062"></a> 127 <a class="indexterm" name="id384068"></a> 128 128 An Active Directory realm called <code class="constant">collision.parrots.com</code> is perfectly okay, 129 129 although it too must be capable of being resolved via DNS, something that functions correctly 130 130 if Windows 200x ADS has been properly installed and configured. 131 </p></div></div><div class="sect3" title="Routed Networks"><div class="titlepage"><div><div><h4 class="title"><a name="id38 5556"></a>Routed Networks</h4></div></div></div><p>132 <a class="indexterm" name="id38 5564"></a>133 <a class="indexterm" name="id38 5571"></a>134 <a class="indexterm" name="id38 5580"></a>131 </p></div></div><div class="sect3" title="Routed Networks"><div class="titlepage"><div><div><h4 class="title"><a name="id384083"></a>Routed Networks</h4></div></div></div><p> 132 <a class="indexterm" name="id384090"></a> 133 <a class="indexterm" name="id384097"></a> 134 <a class="indexterm" name="id384106"></a> 135 135 NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use 136 136 of UDP-based broadcast traffic, as you saw during the exercises in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 137 137 </p><p> 138 <a class="indexterm" name="id38 5598"></a>139 <a class="indexterm" name="id38 5605"></a>140 <a class="indexterm" name="id38 5612"></a>138 <a class="indexterm" name="id384124"></a> 139 <a class="indexterm" name="id384131"></a> 140 <a class="indexterm" name="id384138"></a> 141 141 UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based 142 142 networking cannot function across routed networks (i.e., multi-subnet networks) unless 143 143 special provisions are made: 144 144 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 145 <a class="indexterm" name="id38 5627"></a>146 <a class="indexterm" name="id38 5634"></a>147 <a class="indexterm" name="id38 5641"></a>145 <a class="indexterm" name="id384153"></a> 146 <a class="indexterm" name="id384160"></a> 147 <a class="indexterm" name="id384167"></a> 148 148 Either install on every Windows client an LMHOSTS file (located in the directory 149 149 <code class="filename">C:\windows\system32\drivers\etc</code>). It is also necessary to … … 152 152 manual page for the <code class="filename">smb.conf</code> file. 153 153 </p></li><li class="listitem"><p> 154 <a class="indexterm" name="id38 5684"></a>154 <a class="indexterm" name="id384210"></a> 155 155 Or configure Samba as a WINS server, and configure all network clients to use that 156 156 WINS server in their TCP/IP configuration. 157 157 </p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 158 <a class="indexterm" name="id38 5700"></a>159 <a class="indexterm" name="id38 5709"></a>158 <a class="indexterm" name="id384226"></a> 159 <a class="indexterm" name="id384235"></a> 160 160 The use of DNS is not an acceptable substitute for WINS. DNS does not store specific 161 161 information regarding NetBIOS networking particulars that get stored in the WINS 162 162 name resolution database and that Windows clients require and depend on. 163 </p></div></div><div class="sect3" title="Network Collisions"><div class="titlepage"><div><div><h4 class="title"><a name="id38 5720"></a>Network Collisions</h4></div></div></div><p>164 <a class="indexterm" name="id38 5727"></a>165 <a class="indexterm" name="id38 5737"></a>166 <a class="indexterm" name="id38 5746"></a>167 <a class="indexterm" name="id38 5753"></a>163 </p></div></div><div class="sect3" title="Network Collisions"><div class="titlepage"><div><div><h4 class="title"><a name="id384246"></a>Network Collisions</h4></div></div></div><p> 164 <a class="indexterm" name="id384253"></a> 165 <a class="indexterm" name="id384263"></a> 166 <a class="indexterm" name="id384272"></a> 167 <a class="indexterm" name="id384279"></a> 168 168 Excessive network activity causes NetBIOS network timeouts. Timeouts may result in 169 169 blue screen of death (BSOD) experiences. High collision rates may be caused by excessive … … 174 174 in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 175 175 </p><p> 176 <a class="indexterm" name="id38 5778"></a>177 <a class="indexterm" name="id38 5784"></a>178 <a class="indexterm" name="id38 5791"></a>176 <a class="indexterm" name="id384304"></a> 177 <a class="indexterm" name="id384310"></a> 178 <a class="indexterm" name="id384317"></a> 179 179 Under no circumstances should the facility be supported by many routers, known as <code class="constant">NetBIOS 180 180 forwarding</code>, unless you know exactly what you are doing. Inappropriate use of this … … 184 184 less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance 185 185 immediately returned to 11 MB/sec. 186 </p></div></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id38 5810"></a>Samba Configuration</h3></div></div></div><p>186 </p></div></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id384336"></a>Samba Configuration</h3></div></div></div><p> 187 187 As a general rule, the contents of the <code class="filename">smb.conf</code> file should be kept as simple as possible. 188 188 No parameter should be specified unless you know it is essential to operation. 189 189 </p><p> 190 <a class="indexterm" name="id38 5828"></a>191 <a class="indexterm" name="id38 5835"></a>192 <a class="indexterm" name="id38 5842"></a>190 <a class="indexterm" name="id384354"></a> 191 <a class="indexterm" name="id384361"></a> 192 <a class="indexterm" name="id384368"></a> 193 193 Many UNIX administrators like to fully document the settings in the <code class="filename">smb.conf</code> file. This is a 194 194 bad idea because it adds content to the file. The <code class="filename">smb.conf</code> file is re-read by every <code class="literal">smbd</code> … … 198 198 It is recommended to keep a fully documented <code class="filename">smb.conf</code> file on hand, and then to operate Samba only 199 199 with an optimized file. 200 </p><p><a class="indexterm" name="id38 5888"></a>200 </p><p><a class="indexterm" name="id384414"></a> 201 201 The preferred way to maintain a documented file is to call it something like <code class="filename">smb.conf.master</code>. 202 202 You can generate the optimized file by executing: … … 224 224 Press enter to see a dump of your service definitions 225 225 </pre><p> 226 <a class="indexterm" name="id38 5939"></a>226 <a class="indexterm" name="id384465"></a> 227 227 You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. 228 228 The important thing to note is the noted Server role, as well as warning messages. Noted configuration … … 234 234 </pre><p> 235 235 </p><p> 236 <a class="indexterm" name="id38 5960"></a>237 <a class="indexterm" name="id38 5967"></a>238 <a class="indexterm" name="id38 5974"></a>236 <a class="indexterm" name="id384486"></a> 237 <a class="indexterm" name="id384493"></a> 238 <a class="indexterm" name="id384500"></a> 239 239 There are two parameters that can cause severe network performance degradation: <em class="parameter"><code>socket options</code></em> 240 240 and <em class="parameter"><code>socket address</code></em>. The <em class="parameter"><code>socket options</code></em> parameter was often necessary … … 242 242 this parameter being set. Do not use either parameter unless it has been proven necessary to use them. 243 243 </p><p> 244 <a class="indexterm" name="id38 6005"></a>245 <a class="indexterm" name="id38 6012"></a>246 <a class="indexterm" name="id38 6018"></a>247 <a class="indexterm" name="id38 6025"></a>244 <a class="indexterm" name="id384531"></a> 245 <a class="indexterm" name="id384538"></a> 246 <a class="indexterm" name="id384544"></a> 247 <a class="indexterm" name="id384551"></a> 248 248 Another <code class="filename">smb.conf</code> parameter that may cause severe network performance degradation is the 249 249 <em class="parameter"><code>strict sync</code></em> parameter. Do not use this at all. There is no good reason … … 252 252 degrade network performance, so do not set it; if you must, do so with caution. 253 253 </p><p> 254 <a class="indexterm" name="id38 6064"></a>255 <a class="indexterm" name="id38 6071"></a>256 <a class="indexterm" name="id38 6078"></a>257 <a class="indexterm" name="id38 6085"></a>254 <a class="indexterm" name="id384590"></a> 255 <a class="indexterm" name="id384597"></a> 256 <a class="indexterm" name="id384604"></a> 257 <a class="indexterm" name="id384611"></a> 258 258 Finally, many network administrators deliberately disable opportunistic locking support. While this 259 259 does not degrade Samba performance, it significantly degrades Windows client performance because … … 263 263 oplock support for operations that are tolerant of it. See <a class="link" href="appendix.html#ch12dblck" title="Shared Data Integrity">“Shared Data Integrity”</a> for more 264 264 information. 265 </p></div><div class="sect2" title="Use and Location of BDCs"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6110"></a>Use and Location of BDCs</h3></div></div></div><p>266 <a class="indexterm" name="id38 6118"></a>267 <a class="indexterm" name="id38 6125"></a>268 <a class="indexterm" name="id38 6131"></a>269 <a class="indexterm" name="id38 6138"></a>270 <a class="indexterm" name="id38 6145"></a>265 </p></div><div class="sect2" title="Use and Location of BDCs"><div class="titlepage"><div><div><h3 class="title"><a name="id384636"></a>Use and Location of BDCs</h3></div></div></div><p> 266 <a class="indexterm" name="id384644"></a> 267 <a class="indexterm" name="id384651"></a> 268 <a class="indexterm" name="id384657"></a> 269 <a class="indexterm" name="id384664"></a> 270 <a class="indexterm" name="id384671"></a> 271 271 On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon 272 272 processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of … … 276 276 and is undesirable. 277 277 </p><p> 278 <a class="indexterm" name="id38 6159"></a>279 <a class="indexterm" name="id38 6166"></a>278 <a class="indexterm" name="id384685"></a> 279 <a class="indexterm" name="id384692"></a> 280 280 As a general guide, instead of adding domain member servers to a network, you would be better advised 281 281 to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add 282 282 domain member servers. This practice ensures that there are always sufficient domain controllers 283 283 to handle logon requests and authentication traffic. 284 </p></div><div class="sect2" title="Use One Consistent Version of MS Windows Client"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6178"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p>284 </p></div><div class="sect2" title="Use One Consistent Version of MS Windows Client"><div class="titlepage"><div><div><h3 class="title"><a name="id384704"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p> 285 285 Every network client has its own peculiarities. From a management perspective, it is easier to deal 286 286 with one version of MS Windows that is maintained to a consistent update level than it is to deal … … 290 290 have necessitated special handling from the Samba server end. If you want to remain sane, keep you 291 291 client workstation configurations consistent. 292 </p></div><div class="sect2" title="For Scalability, Use SAN-Based Storage on Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6195"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p>293 <a class="indexterm" name="id38 6203"></a>294 <a class="indexterm" name="id38 6210"></a>292 </p></div><div class="sect2" title="For Scalability, Use SAN-Based Storage on Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id384721"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p> 293 <a class="indexterm" name="id384729"></a> 294 <a class="indexterm" name="id384736"></a> 295 295 Many SAN-based storage systems permit more than one server to share a common data store. 296 296 Use of a shared SAN data store means that you do not need to use time- and resource-hungry data 297 297 synchronization techniques. 298 298 </p><p> 299 <a class="indexterm" name="id38 6222"></a>300 <a class="indexterm" name="id38 6229"></a>299 <a class="indexterm" name="id384748"></a> 300 <a class="indexterm" name="id384755"></a> 301 301 The use of a collection of relatively low-cost front-end Samba servers that are coupled to 302 302 a shared backend SAN data store permits load distribution while containing costs below that 303 303 of installing and managing a complex clustering facility. 304 </p></div><div class="sect2" title="Distribute Network Load with MSDFS"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6240"></a>Distribute Network Load with MSDFS</h3></div></div></div><p>305 <a class="indexterm" name="id38 6248"></a>306 <a class="indexterm" name="id38 6255"></a>304 </p></div><div class="sect2" title="Distribute Network Load with MSDFS"><div class="titlepage"><div><div><h3 class="title"><a name="id384766"></a>Distribute Network Load with MSDFS</h3></div></div></div><p> 305 <a class="indexterm" name="id384774"></a> 306 <a class="indexterm" name="id384781"></a> 307 307 Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits 308 308 data to be accessed from a single share and yet to actually be distributed across multiple actual … … 310 310 implementation of an MSDFS installation. 311 311 </p><p> 312 <a class="indexterm" name="id38 6271"></a>313 <a class="indexterm" name="id38 6280"></a>312 <a class="indexterm" name="id384797"></a> 313 <a class="indexterm" name="id384806"></a> 314 314 The combination of multiple backend servers together with a front-end server and use of MSDFS 315 315 can achieve almost the same as you would obtain with a clustered Samba server. 316 </p></div><div class="sect2" title="Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6291"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p>317 <a class="indexterm" name="id38 6299"></a>318 <a class="indexterm" name="id38 6306"></a>319 <a class="indexterm" name="id38 6313"></a>316 </p></div><div class="sect2" title="Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth"><div class="titlepage"><div><div><h3 class="title"><a name="id384817"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p> 317 <a class="indexterm" name="id384825"></a> 318 <a class="indexterm" name="id384832"></a> 319 <a class="indexterm" name="id384839"></a> 320 320 Consider using <code class="literal">rsync</code> to replicate data across the WAN during times 321 321 of low utilization. Users can then access the replicated data store rather than needing to do so … … 324 324 implementation if you choose to permit modification and return replication of the modified file; 325 325 otherwise, you may inadvertently overwrite important data. 326 </p></div><div class="sect2" title="Hardware Problems"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6332"></a>Hardware Problems</h3></div></div></div><p>327 <a class="indexterm" name="id38 6340"></a>328 <a class="indexterm" name="id38 6346"></a>329 <a class="indexterm" name="id38 6353"></a>330 <a class="indexterm" name="id38 6360"></a>331 <a class="indexterm" name="id38 6369"></a>332 <a class="indexterm" name="id38 6378"></a>326 </p></div><div class="sect2" title="Hardware Problems"><div class="titlepage"><div><div><h3 class="title"><a name="id384858"></a>Hardware Problems</h3></div></div></div><p> 327 <a class="indexterm" name="id384866"></a> 328 <a class="indexterm" name="id384872"></a> 329 <a class="indexterm" name="id384879"></a> 330 <a class="indexterm" name="id384886"></a> 331 <a class="indexterm" name="id384895"></a> 332 <a class="indexterm" name="id384904"></a> 333 333 Networking hardware prices have fallen sharply over the past 5 years. A surprising number 334 334 of Samba networking problems over this time have been traced to defective network interface 335 335 cards (NICs) or defective HUBs, switches, and cables. 336 336 </p><p> 337 <a class="indexterm" name="id38 6393"></a>337 <a class="indexterm" name="id384919"></a> 338 338 Not surprising is the fact that network administrators do not like to be shown to have made 339 339 a bad decision. Money saved in buying low-cost hardware may result in high costs incurred 340 340 in corrective action. 341 341 </p><p> 342 <a class="indexterm" name="id38 6405"></a>343 <a class="indexterm" name="id38 6412"></a>344 <a class="indexterm" name="id38 6418"></a>345 <a class="indexterm" name="id38 6425"></a>346 <a class="indexterm" name="id38 6432"></a>342 <a class="indexterm" name="id384931"></a> 343 <a class="indexterm" name="id384938"></a> 344 <a class="indexterm" name="id384944"></a> 345 <a class="indexterm" name="id384951"></a> 346 <a class="indexterm" name="id384958"></a> 347 347 Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent 348 348 or persistent data corruption, slow network throughput, low performance, or even as BSOD … … 353 353 Defective hardware problems may take patience and persistence before the real cause can be discovered. 354 354 </p><p> 355 <a class="indexterm" name="id38 6450"></a>355 <a class="indexterm" name="id384976"></a> 356 356 Networking hardware defects can significantly impact perceived Samba performance, but defective 357 357 RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server … … 360 360 administrator until the entire server was replaced. While you may well think that this would never 361 361 happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. 362 </p></div><div class="sect2" title="Large Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id38 6465"></a>Large Directories</h3></div></div></div><p>362 </p></div><div class="sect2" title="Large Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id384991"></a>Large Directories</h3></div></div></div><p> 363 363 There exist applications that create or manage directories containing many thousands of files. Such 364 364 applications typically generate many small files (less than 100 KB). At the best of times, under UNIX, … … 400 400 as specified in the <code class="filename">smb.conf</code> stanza. This means that smbd will not be able to find lower case 401 401 filenames with these settings. Note, this is done on a per-share basis. 402 </p></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 6548"></a>Key Points Learned</h2></div></div></div><p>402 </p></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385073"></a>Key Points Learned</h2></div></div></div><p> 403 403 This chapter has touched in broad sweeps on a number of simple steps that can be taken 404 404 to ensure that your Samba network is resilient, scalable, and reliable, and that it … … 409 409 her an even break. 410 410 </p><p> 411 <a class="indexterm" name="id38 6565"></a>411 <a class="indexterm" name="id385090"></a> 412 412 Last, but not least, you should not only keep the network design simple, but also be sure it is 413 413 well documented. This book may serve as your pattern for documenting every -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/RefSection.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" title="Part III. Reference Section"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" title="Reference Section"><div><div><div><h1 class="title"><a name="id37 7046"></a>Reference Section</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" title="Part III. Reference Section"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" title="Reference Section"><div><div><div><h1 class="title"><a name="id375575"></a>Reference Section</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> provides important reference material 3 3 that may help you to solve network performance issues, to answer some of the critiques 4 4 published regarding Samba, or just to gain a more broad understanding of how Samba can 5 5 play in a Windows networking world. 6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id37 7126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id382225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id384815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id390627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id375655">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376238">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id376252">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376618">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378100">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378435">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378992">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379357">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380041">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id380163">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id380752">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380775">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id380865">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380894">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id381040">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id381058">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382809">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382864">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id383342">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id383418">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id383870">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id383895">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id384336">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id384636">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id384704">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id384766">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id384858">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id384991">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id385073">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id385222">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id385420">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386084">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386477">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386779">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386790">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386834">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386933">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386988">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id387443">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388364">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388795">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388933">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id389009">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id389151">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id389288">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389338">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id389445">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389558">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id390654">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id391645">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391746">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 7 7 <acronym class="acronym">GNU</acronym> General Public License version 3 8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id39 3828">A.8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id392352">A. 9 9 Preamble 10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3937">A.10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392460">A. 11 11 TERMS AND CONDITIONS 12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3940">A.12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392464">A. 13 13 0. Definitions. 14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4004">A.14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392528">A. 15 15 1. Source Code. 16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4066">A.16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392590">A. 17 17 2. Basic Permissions. 18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4094">A.18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392617">A. 19 19 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4116">A.20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392639">A. 21 21 4. Conveying Verbatim Copies. 22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4135">A.22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392659">A. 23 23 5. Conveying Modified Source Versions. 24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4207">A.24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392731">A. 25 25 6. Conveying Non-Source Forms. 26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4339">A.26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392863">A. 27 27 7. Additional Terms. 28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4444">A.28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392969">A. 29 29 8. Termination. 30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4476">A.30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393000">A. 31 31 9. Acceptance Not Required for Having Copies. 32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4495">A.32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393019">A. 33 33 10. Automatic Licensing of Downstream Recipients. 34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4529">A.34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393053">A. 35 35 11. Patents. 36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4618">A.36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393142">A. 37 37 12. No Surrender of Others’ Freedom. 38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4633">A.38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393158">A. 39 39 13. Use with the ???TITLE??? Affero General Public License. 40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4657">A.40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393181">A. 41 41 14. Revised Versions of this License. 42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4704">A.42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393229">A. 43 43 15. Disclaimer of Warranty. 44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4722">A.44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393246">A. 45 45 16. Limitation of Liability. 46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4736">A.46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393261">A. 47 47 17. Interpretation of Sections 15 and 16. 48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4749">A.48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393273">A. 49 49 END OF TERMS AND CONDITIONS 50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4752">A.50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393277">A. 51 51 How to Apply These Terms to Your New Programs 52 52 </a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. Migrating NetWare Server to Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Active Directory, Kerberos, and Security</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/apa.html
r599 r739 1 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Appendix A. GNU General Public License version 3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="primer.html" title="Chapter 16. Networking Primer"><link rel="next" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Appendix A. 2 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" title="Appendix A. GNU General Public License version 3"><div class="titlepage"><div><div><h2 class="title"><a name="id39 3802"></a>Appendix A.3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" title="Appendix A. GNU General Public License version 3"><div class="titlepage"><div><div><h2 class="title"><a name="id392326"></a>Appendix A. 4 4 <acronym class="acronym">GNU</acronym> General Public License version 3 5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id39 3828">A.5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id392352">A. 6 6 Preamble 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3937">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392460">A. 8 8 TERMS AND CONDITIONS 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3940">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392464">A. 10 10 0. Definitions. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4004">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392528">A. 12 12 1. Source Code. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4066">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392590">A. 14 14 2. Basic Permissions. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4094">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392617">A. 16 16 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4116">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392639">A. 18 18 4. Conveying Verbatim Copies. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4135">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392659">A. 20 20 5. Conveying Modified Source Versions. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4207">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392731">A. 22 22 6. Conveying Non-Source Forms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4339">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392863">A. 24 24 7. Additional Terms. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4444">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392969">A. 26 26 8. Termination. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4476">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393000">A. 28 28 9. Acceptance Not Required for Having Copies. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4495">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393019">A. 30 30 10. Automatic Licensing of Downstream Recipients. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4529">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393053">A. 32 32 11. Patents. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4618">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393142">A. 34 34 12. No Surrender of Others’ Freedom. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4633">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393158">A. 36 36 13. Use with the ???TITLE??? Affero General Public License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4657">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393181">A. 38 38 14. Revised Versions of this License. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4704">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393229">A. 40 40 15. Disclaimer of Warranty. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4722">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393246">A. 42 42 16. Limitation of Liability. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4736">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393261">A. 44 44 17. Interpretation of Sections 15 and 16. 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4749">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393273">A. 46 46 END OF TERMS AND CONDITIONS 47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4752">A.47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393277">A. 48 48 How to Apply These Terms to Your New Programs 49 49 </a></span></dt></dl></div><p> … … 55 55 Everyone is permitted to copy and distribute verbatim copies of this license 56 56 document, but changing it is not allowed. 57 </p><h2><a name="id39 3828"></a>57 </p><h2><a name="id392352"></a> 58 58 Preamble 59 59 </h2><p> … … 119 119 The precise terms and conditions for copying, distribution and modification 120 120 follow. 121 </p><h2><a name="id39 3937"></a>121 </p><h2><a name="id392460"></a> 122 122 TERMS AND CONDITIONS 123 </h2><h2><a name="id39 3940"></a>123 </h2><h2><a name="id392464"></a> 124 124 0. Definitions. 125 125 </h2><p> … … 163 163 a list of user commands or options, such as a menu, a prominent item in the 164 164 list meets this criterion. 165 </p><h2><a name="id39 4004"></a>165 </p><h2><a name="id392528"></a> 166 166 1. Source Code. 167 167 </h2><p> … … 203 203 </p><p> 204 204 The Corresponding Source for a work in source code form is that same work. 205 </p><h2><a name="id39 4066"></a>205 </p><h2><a name="id392590"></a> 206 206 2. Basic Permissions. 207 207 </h2><p> … … 228 228 conditions stated below. Sublicensing is not allowed; section 10 makes it 229 229 unnecessary. 230 </p><h2><a name="id39 4094"></a>230 </p><h2><a name="id392617"></a> 231 231 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 232 232 </h2><p> … … 243 243 third parties’ legal rights to forbid circumvention of technological 244 244 measures. 245 </p><h2><a name="id39 4116"></a>245 </p><h2><a name="id392639"></a> 246 246 4. Conveying Verbatim Copies. 247 247 </h2><p> … … 256 256 You may charge any price or no price for each copy that you convey, and you 257 257 may offer support or warranty protection for a fee. 258 </p><h2><a name="id39 4135"></a>258 </p><h2><a name="id392659"></a> 259 259 5. Conveying Modified Source Versions. 260 260 </h2><p> … … 292 292 permit. Inclusion of a covered work in an aggregate does not cause 293 293 this License to apply to the other parts of the aggregate. 294 </p><h2><a name="id39 4207"></a>294 </p><h2><a name="id392731"></a> 295 295 6. Conveying Non-Source Forms. 296 296 </h2><p> … … 387 387 and must require no special password or key for unpacking, reading or 388 388 copying. 389 </p><h2><a name="id39 4339"></a>389 </p><h2><a name="id392863"></a> 390 390 7. Additional Terms. 391 391 </h2><p> … … 451 451 of a separately written license, or stated as exceptions; the above 452 452 requirements apply either way. 453 </p><h2><a name="id39 4444"></a>453 </p><h2><a name="id392969"></a> 454 454 8. Termination. 455 455 </h2><p> … … 477 477 reinstated, you do not qualify to receive new licenses for the same 478 478 material under section 10. 479 </p><h2><a name="id39 4476"></a>479 </p><h2><a name="id393000"></a> 480 480 9. Acceptance Not Required for Having Copies. 481 481 </h2><p> … … 488 488 Therefore, by modifying or propagating a covered work, you indicate your 489 489 acceptance of this License to do so. 490 </p><h2><a name="id39 4495"></a>490 </p><h2><a name="id393019"></a> 491 491 10. Automatic Licensing of Downstream Recipients. 492 492 </h2><p> … … 513 513 by making, using, selling, offering for sale, or importing the Program or 514 514 any portion of it. 515 </p><h2><a name="id39 4529"></a>515 </p><h2><a name="id393053"></a> 516 516 11. Patents. 517 517 </h2><p> … … 580 580 implied license or other defenses to infringement that may otherwise be 581 581 available to you under applicable patent law. 582 </p><h2><a name="id39 4618"></a>582 </p><h2><a name="id393142"></a> 583 583 12. No Surrender of Others’ Freedom. 584 584 </h2><p> … … 592 592 Program, the only way you could satisfy both those terms and this License 593 593 would be to refrain entirely from conveying the Program. 594 </p><h2><a name="id39 4633"></a>594 </p><h2><a name="id393158"></a> 595 595 13. Use with the <acronym class="acronym">GNU</acronym> Affero General Public License. 596 596 </h2><p> … … 603 603 section 13, concerning interaction through a network will apply to the 604 604 combination as such. 605 </p><h2><a name="id39 4657"></a>605 </p><h2><a name="id393181"></a> 606 606 14. Revised Versions of this License. 607 607 </h2><p> … … 628 628 However, no additional obligations are imposed on any author or copyright 629 629 holder as a result of your choosing to follow a later version. 630 </p><h2><a name="id39 4704"></a>630 </p><h2><a name="id393229"></a> 631 631 15. Disclaimer of Warranty. 632 632 </h2><p> … … 639 639 YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL 640 640 NECESSARY SERVICING, REPAIR OR CORRECTION. 641 </p><h2><a name="id39 4722"></a>641 </p><h2><a name="id393246"></a> 642 642 16. Limitation of Liability. 643 643 </h2><p> … … 651 651 EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 652 652 SUCH DAMAGES. 653 </p><h2><a name="id39 4736"></a>653 </p><h2><a name="id393261"></a> 654 654 17. Interpretation of Sections 15 and 16. 655 655 </h2><p> … … 660 660 warranty or assumption of liability accompanies a copy of the Program in 661 661 return for a fee. 662 </p><h2><a name="id39 4749"></a>662 </p><h2><a name="id393273"></a> 663 663 END OF TERMS AND CONDITIONS 664 </h2><h2><a name="id39 4752"></a>664 </h2><h2><a name="id393277"></a> 665 665 How to Apply These Terms to Your New Programs 666 666 </h2><p> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/appendix.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 15. A Collection of Useful Tidbits"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id38 7559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id38 7011"></a>3 <a class="indexterm" name="id38 7018"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 15. A Collection of Useful Tidbits"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386084">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386477">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386779">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386790">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386834">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386933">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386988">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id387443">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388364">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388795">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388933">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id389009">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id385538"></a> 3 <a class="indexterm" name="id385544"></a> 4 4 Information presented here is considered to be either basic or well-known material that is informative 5 5 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that … … 8 8 as shown in the example given below. 9 9 </p><div class="sect1" title="Joining a Domain: Windows 200x/XP Professional"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="domjoin"></a>Joining a Domain: Windows 200x/XP Professional</h2></div></div></div><p> 10 <a class="indexterm" name="id38 7044"></a>10 <a class="indexterm" name="id385570"></a> 11 11 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. 12 12 This section steps through the process for making a Windows 200x/XP Professional machine a 13 13 member of a Domain Security environment. It should be noted that this process is identical 14 14 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. 15 </p><div class="procedure" title="Procedure 15.1. Steps to Join a Domain"><a name="id38 7055"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>15 </p><div class="procedure" title="Procedure 15.1. Steps to Join a Domain"><a name="id385581"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 16 16 Click <span class="guimenu">Start</span>. 17 17 </p></li><li class="step" title="Step 2"><p> … … 51 51 Joining the domain is now complete. 52 52 </p></li></ol></div><p> 53 <a class="indexterm" name="id38 7460"></a>54 <a class="indexterm" name="id38 7466"></a>53 <a class="indexterm" name="id385985"></a> 54 <a class="indexterm" name="id385992"></a> 55 55 The screen capture shown in <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a> has a button labeled <span class="guimenu">More...</span>. This button opens a 56 56 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members 57 57 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace. 58 58 </p><p> 59 <a class="indexterm" name="id38 7490"></a>60 <a class="indexterm" name="id38 7497"></a>59 <a class="indexterm" name="id386015"></a> 60 <a class="indexterm" name="id386022"></a> 61 61 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers 62 62 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server 63 63 to find the services (like which machines are domain controllers or which machines have the Netlogon service running). 64 64 </p><p> 65 <a class="indexterm" name="id38 7512"></a>65 <a class="indexterm" name="id386037"></a> 66 66 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, 67 67 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to … … 71 71 Where the client is a member of a Samba domain, it is preferable to leave this field blank. 72 72 </p><p> 73 <a class="indexterm" name="id38 7534"></a>73 <a class="indexterm" name="id386059"></a> 74 74 According to Microsoft documentation, <span class="quote">“<span class="quote">If this computer belongs to a group with <code class="constant">Group Policy</code> 75 75 enabled on <code class="literal">Primary DNS suffice of this computer</code>, the string specified in the Group Policy is used 76 76 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is 77 77 used only if Group Policy is disabled or unspecified.</span>”</span> 78 </p></div><div class="sect1" title="Samba System File Location"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 7559"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id387566"></a><a class="indexterm" name="id387574"></a><a class="indexterm" name="id387581"></a>78 </p></div><div class="sect1" title="Samba System File Location"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386084"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id386091"></a><a class="indexterm" name="id386099"></a><a class="indexterm" name="id386107"></a> 79 79 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team 80 80 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is … … 84 84 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team 85 85 default. 86 </p><p><a class="indexterm" name="id38 7612"></a><a class="indexterm" name="id387624"></a><a class="indexterm" name="id387631"></a><a class="indexterm" name="id387643"></a><a class="indexterm" name="id387650"></a><a class="indexterm" name="id387662"></a><a class="indexterm" name="id387670"></a><a class="indexterm" name="id387677"></a><a class="indexterm" name="id387685"></a><a class="indexterm" name="id387693"></a><a class="indexterm" name="id387701"></a><a class="indexterm" name="id387709"></a><a class="indexterm" name="id387717"></a><a class="indexterm" name="id387725"></a><a class="indexterm" name="id387732"></a><a class="indexterm" name="id387740"></a>86 </p><p><a class="indexterm" name="id386138"></a><a class="indexterm" name="id386149"></a><a class="indexterm" name="id386156"></a><a class="indexterm" name="id386168"></a><a class="indexterm" name="id386175"></a><a class="indexterm" name="id386187"></a><a class="indexterm" name="id386194"></a><a class="indexterm" name="id386202"></a><a class="indexterm" name="id386210"></a><a class="indexterm" name="id386218"></a><a class="indexterm" name="id386226"></a><a class="indexterm" name="id386234"></a><a class="indexterm" name="id386242"></a><a class="indexterm" name="id386250"></a><a class="indexterm" name="id386257"></a><a class="indexterm" name="id386265"></a> 87 87 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy 88 88 System (FHS), have elected to locate the configuration files under the <code class="filename">/etc/samba</code> directory, common binary … … 93 93 <code class="filename">/usr/lib/samba</code> directory tree. The files located there include the dynamically loadable modules for the 94 94 passdb backend as well as for the VFS modules. 95 </p><p><a class="indexterm" name="id38 7804"></a><a class="indexterm" name="id387812"></a><a class="indexterm" name="id387820"></a>95 </p><p><a class="indexterm" name="id386329"></a><a class="indexterm" name="id386337"></a><a class="indexterm" name="id386344"></a> 96 96 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in 97 97 the <code class="filename">/var/lib/samba</code> directory. Log files are created in <code class="filename">/var/log/samba.</code> … … 99 99 When Samba is built and installed using the default Samba Team process, all files are located under the 100 100 <code class="filename">/usr/local/samba</code> directory tree. This makes it simple to find the files that Samba owns. 101 </p><p><a class="indexterm" name="id38 7854"></a>101 </p><p><a class="indexterm" name="id386379"></a> 102 102 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location 103 103 of all files called <code class="literal">smbd</code>. Here is an example: … … 132 132 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed 133 133 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by 134 executing:<a class="indexterm" name="id38 7919"></a>134 executing:<a class="indexterm" name="id386444"></a> 135 135 </p><pre class="screen"> 136 136 <code class="prompt">root# </code> rpm -qa | grep samba … … 144 144 samba3-client-3.0.20-1 145 145 samba3-cifsmount-3.0.20-1 146 </pre><p><a class="indexterm" name="id38 7940"></a>146 </pre><p><a class="indexterm" name="id386464"></a> 147 147 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. 148 </p></div><div class="sect1" title="Starting Samba"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 7952"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id387958"></a>148 </p></div><div class="sect1" title="Starting Samba"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386477"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id386483"></a> 149 149 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. 150 150 An example of a service is the Apache Web server for which the daemon is called <code class="literal">httpd</code>. In the case of Samba, there … … 187 187 exit 0 188 188 </pre></div></div><br class="example-break"><div class="variablelist"><dl><dt><span class="term">nmbd</span></dt><dd><p> 189 <a class="indexterm" name="id38 8017"></a>190 <a class="indexterm" name="id38 8024"></a>189 <a class="indexterm" name="id386542"></a> 190 <a class="indexterm" name="id386549"></a> 191 191 This daemon handles all name registration and resolution requests. It is the primary vehicle involved 192 192 in network browsing. It handles all UDP-based protocols. The <code class="literal">nmbd</code> daemon should 193 193 be the first command started as part of the Samba startup process. 194 194 </p></dd><dt><span class="term">smbd</span></dt><dd><p> 195 <a class="indexterm" name="id38 8051"></a>196 <a class="indexterm" name="id38 8058"></a>195 <a class="indexterm" name="id386576"></a> 196 <a class="indexterm" name="id386583"></a> 197 197 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also 198 198 manages local authentication. It should be started immediately following the startup of <code class="literal">nmbd</code>. 199 199 </p></dd><dt><span class="term">winbindd</span></dt><dd><p> 200 <a class="indexterm" name="id38 8085"></a>201 <a class="indexterm" name="id38 8092"></a>200 <a class="indexterm" name="id386610"></a> 201 <a class="indexterm" name="id386616"></a> 202 202 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when 203 203 Samba has trust relationships with another domain. The <code class="literal">winbindd</code> daemon will check the … … 253 253 exit 1 254 254 esac 255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id38 8184"></a>255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id386709"></a> 256 256 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently 257 257 executed from the command line is shown in <a class="link" href="appendix.html#ch12SL" title="Example 15.1. A Useful Samba Control Script for SUSE Linux">“A Useful Samba Control Script for SUSE Linux”</a>. This can be located in the directory 258 258 <code class="filename">/sbin</code> in a file called <code class="filename">samba</code>. This type of control script should be 259 259 owned by user root and group root, and set so that only root can execute it. 260 </p><p><a class="indexterm" name="id38 8216"></a>260 </p><p><a class="indexterm" name="id386741"></a> 261 261 A sample startup script for a Red Hat Linux system is shown in <a class="link" href="appendix.html#ch12RHscript" title="Example 15.2. A Sample Samba Control Script for Red Hat Linux">“A Sample Samba Control Script for Red Hat Linux”</a>. 262 262 This file could be located in the directory <code class="filename">/etc/rc.d</code> and can be called … … 265 265 the Samba source code distribution tarball. The packaging files for each platform include a 266 266 startup control file. 267 </p></div><div class="sect1" title="DNS Configuration Files"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 8254"></a>DNS Configuration Files</h2></div></div></div><p>267 </p></div><div class="sect1" title="DNS Configuration Files"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386779"></a>DNS Configuration Files</h2></div></div></div><p> 268 268 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they 269 269 are presented here for general reference. 270 </p><div class="sect2" title="The Forward Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id38 8264"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p>270 </p><div class="sect2" title="The Forward Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id386790"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p> 271 271 The forward zone file for the loopback address never changes. An example file is shown 272 272 in <a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a>. All traffic destined for an IP address that is hosted on a … … 285 285 IN NS @ 286 286 IN A 127.0.0.1 287 </pre></div></div><br class="example-break"></div><div class="sect2" title="The Reverse Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id38 8308"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p>287 </pre></div></div><br class="example-break"></div><div class="sect2" title="The Reverse Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id386834"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p> 288 288 The reverse zone file for the loopback address as shown in <a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a> 289 289 is necessary so that references to the address <code class="constant">127.0.0.1</code> can be … … 345 345 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 346 346 ; End of File 347 </pre></div></div><br class="example-break"></div><div class="sect2" title="DNS Root Server Hint File"><div class="titlepage"><div><div><h3 class="title"><a name="id38 8408"></a>DNS Root Server Hint File</h3></div></div></div><p>347 </pre></div></div><br class="example-break"></div><div class="sect2" title="DNS Root Server Hint File"><div class="titlepage"><div><div><h3 class="title"><a name="id386933"></a>DNS Root Server Hint File</h3></div></div></div><p> 348 348 The content of the root hints file as shown in <a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a> changes slowly over time. 349 349 Periodically this file should be updated from the source shown. Because 350 350 of its size, this file is located at the end of this chapter. 351 </p></div></div><div class="sect1" title="Alternative LDAP Database Initialization"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id38 8437"></a><a class="indexterm" name="id388448"></a>351 </p></div></div><div class="sect1" title="Alternative LDAP Database Initialization"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id386962"></a><a class="indexterm" name="id386973"></a> 352 352 The following procedure may be used as an alternative means of configuring 353 353 the initial LDAP database. Many administrators prefer to have greater control 354 354 over how system files get configured. 355 </p><div class="sect2" title="Initialization of the LDAP Database"><div class="titlepage"><div><div><h3 class="title"><a name="id38 8463"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id388470"></a><a class="indexterm" name="id388478"></a><a class="indexterm" name="id388489"></a>355 </p><div class="sect2" title="Initialization of the LDAP Database"><div class="titlepage"><div><div><h3 class="title"><a name="id386988"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id386995"></a><a class="indexterm" name="id387003"></a><a class="indexterm" name="id387014"></a> 356 356 The first step to get the LDAP server ready for action is to create the LDIF file from 357 357 which the LDAP database will be preloaded. This is necessary to create the containers … … 706 706 displayName: Domain Users 707 707 description: Domain Users 708 </pre></div></div><br class="example-break"></div><div class="sect1" title="The LDAP Account Manager"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 8919"></a>The LDAP Account Manager</h2></div></div></div><p>709 <a class="indexterm" name="id38 8927"></a>710 <a class="indexterm" name="id38 8934"></a>711 <a class="indexterm" name="id38 8943"></a>712 <a class="indexterm" name="id38 8949"></a>713 <a class="indexterm" name="id38 8956"></a>714 <a class="indexterm" name="id38 8963"></a>715 <a class="indexterm" name="id38 8970"></a>708 </pre></div></div><br class="example-break"></div><div class="sect1" title="The LDAP Account Manager"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387443"></a>The LDAP Account Manager</h2></div></div></div><p> 709 <a class="indexterm" name="id387451"></a> 710 <a class="indexterm" name="id387458"></a> 711 <a class="indexterm" name="id387467"></a> 712 <a class="indexterm" name="id387474"></a> 713 <a class="indexterm" name="id387480"></a> 714 <a class="indexterm" name="id387487"></a> 715 <a class="indexterm" name="id387494"></a> 716 716 The LDAP Account Manager (LAM) is an application suite that has been written in PHP. 717 717 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP … … 725 725 of 2005. 726 726 </p><p> 727 <a class="indexterm" name="id38 8996"></a>728 <a class="indexterm" name="id38 9003"></a>729 <a class="indexterm" name="id38 9010"></a>727 <a class="indexterm" name="id387521"></a> 728 <a class="indexterm" name="id387527"></a> 729 <a class="indexterm" name="id387534"></a> 730 730 Requirements: 731 731 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A web server that will work with PHP4.</p></li><li class="listitem"><p>PHP4 (available from the <a class="ulink" href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li class="listitem"><p>OpenLDAP 2.0 or later.</p></li><li class="listitem"><p>A Web browser that supports CSS.</p></li><li class="listitem"><p>Perl.</p></li><li class="listitem"><p>The gettext package.</p></li><li class="listitem"><p>mcrypt + mhash (optional).</p></li><li class="listitem"><p>It is also a good idea to install SSL support.</p></li></ul></div><p> 732 732 LAM is a useful tool that provides a simple Web-based device that can be used to 733 733 manage the contents of the LDAP directory to: 734 <a class="indexterm" name="id38 9067"></a>735 <a class="indexterm" name="id38 9074"></a>736 <a class="indexterm" name="id38 9081"></a>734 <a class="indexterm" name="id387592"></a> 735 <a class="indexterm" name="id387598"></a> 736 <a class="indexterm" name="id387605"></a> 737 737 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Display user/group/host and Domain entries.</p></li><li class="listitem"><p>Manage entries (Add/Delete/Edit).</p></li><li class="listitem"><p>Filter and sort entries.</p></li><li class="listitem"><p>Store and use multiple operating profiles.</p></li><li class="listitem"><p>Edit organizational units (OUs).</p></li><li class="listitem"><p>Upload accounts from a file.</p></li><li class="listitem"><p>Is compatible with Samba-2.2.x and Samba-3.</p></li></ul></div><p> 738 738 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba 739 739 user, group, and windows domain member machine accounts. 740 740 </p><p> 741 <a class="indexterm" name="id38 9132"></a>742 <a class="indexterm" name="id38 9139"></a>743 <a class="indexterm" name="id38 9145"></a>744 <a class="indexterm" name="id38 9152"></a>741 <a class="indexterm" name="id387656"></a> 742 <a class="indexterm" name="id387663"></a> 743 <a class="indexterm" name="id387670"></a> 744 <a class="indexterm" name="id387676"></a> 745 745 The default password is <span class="quote">“<span class="quote">lam.</span>”</span> It is highly recommended that you use only 746 746 an SSL connection to your Web server for all remote operations involving LAM. If you … … 761 761 <code class="filename">/srv/www/htdocs</code> directory. 762 762 </p></li><li class="step" title="Step 3"><p> 763 <a class="indexterm" name="id38 9226"></a>763 <a class="indexterm" name="id387750"></a> 764 764 Set file permissions using the following commands: 765 765 </p><pre class="screen"> … … 771 771 </pre><p> 772 772 </p></li><li class="step" title="Step 4"><p> 773 <a class="indexterm" name="id38 9276"></a>773 <a class="indexterm" name="id387800"></a> 774 774 Using your favorite editor create the following <code class="filename">config.cfg</code> 775 775 LAM configuration file: … … 779 779 <code class="prompt">root# </code> vi config.cfg 780 780 </pre><p> 781 <a class="indexterm" name="id38 9315"></a>782 <a class="indexterm" name="id38 9324"></a>781 <a class="indexterm" name="id387840"></a> 782 <a class="indexterm" name="id387849"></a> 783 783 An example file is shown in <a class="link" href="appendix.html#lamcfg" title="Example 15.11. Example LAM Configuration File config.cfg">“Example LAM Configuration File config.cfg”</a>. 784 784 This is the minimum configuration that must be completed. The LAM profile … … 795 795 change the settings to match local site needs. 796 796 </p></li></ol></div><p> 797 <a class="indexterm" name="id38 9379"></a>797 <a class="indexterm" name="id387903"></a> 798 798 An example of a working file is shown here in <a class="link" href="appendix.html#lamconf" title="Example 15.12. LAM Profile Control File lam.conf">“LAM Profile Control File lam.conf”</a>. 799 799 This file has been stripped of comments to keep the size small. The comments … … 803 803 are preferred at your site. 804 804 </p><p> 805 <a class="indexterm" name="id38 9399"></a>805 <a class="indexterm" name="id387923"></a> 806 806 It is important that your LDAP server is running at the time that LAM is 807 807 being configured. This permits you to validate correct operation. 808 808 An example of the LAM login screen is provided in <a class="link" href="appendix.html#lam-login" title="Figure 15.6. The LDAP Account Manager Login Screen">“The LDAP Account Manager Login Screen”</a>. 809 809 </p><div class="figure"><a name="lam-login"></a><p class="title"><b>Figure 15.6. The LDAP Account Manager Login Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-login.png" width="270" alt="The LDAP Account Manager Login Screen"></div></div></div><br class="figure-break"><p> 810 <a class="indexterm" name="id38 9458"></a>810 <a class="indexterm" name="id387983"></a> 811 811 The LAM configuration editor has a number of options that must be managed correctly. 812 812 An example of use of the LAM configuration editor is shown in <a class="link" href="appendix.html#lam-config" title="Figure 15.7. The LDAP Account Manager Configuration Screen">“The LDAP Account Manager Configuration Screen”</a>. … … 818 818 using LAM to add additional users and groups. 819 819 </p><div class="figure"><a name="lam-config"></a><p class="title"><b>Figure 15.7. The LDAP Account Manager Configuration Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-config.png" width="270" alt="The LDAP Account Manager Configuration Screen"></div></div></div><br class="figure-break"><p> 820 <a class="indexterm" name="id38 9523"></a>820 <a class="indexterm" name="id388047"></a> 821 821 LAM has some nice, but unusual features. For example, one unexpected feature in most application 822 822 screens permits the generation of a PDF file that lists configuration information. This is a well … … 824 824 space. 825 825 </p><p> 826 <a class="indexterm" name="id38 9536"></a>826 <a class="indexterm" name="id388060"></a> 827 827 When you log onto LAM the opening screen drops you right into the user manager as shown in 828 828 <a class="link" href="appendix.html#lam-user" title="Figure 15.8. The LDAP Account Manager User Edit Screen">“The LDAP Account Manager User Edit Screen”</a>. This is a logical action as it permits the most-needed facility … … 838 838 memberships. 839 839 </p><div class="figure"><a name="lam-group"></a><p class="title"><b>Figure 15.9. The LDAP Account Manager Group Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-groups.png" width="270" alt="The LDAP Account Manager Group Edit Screen"></div></div></div><br class="figure-break"><div class="figure"><a name="lam-group-mem"></a><p class="title"><b>Figure 15.10. The LDAP Account Manager Group Membership Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-group-members.png" width="270" alt="The LDAP Account Manager Group Membership Edit Screen"></div></div></div><br class="figure-break"><p> 840 <a class="indexterm" name="id38 9704"></a><a class="indexterm" name="id389710"></a>840 <a class="indexterm" name="id388230"></a><a class="indexterm" name="id388236"></a> 841 841 The final screen presented here is one that you should not normally need to use. Host accounts will 842 842 be automatically managed using the smbldap-tools scripts. This means that the screen <a class="link" href="appendix.html#lam-host" title="Figure 15.11. The LDAP Account Manager Host Edit Screen">“The LDAP Account Manager Host Edit Screen”</a> … … 884 884 cachetimeout: 5 885 885 pwdhash: SSHA 886 </pre></div></div><br class="example-break"></div><div class="sect1" title="IDEALX Management Console"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 9839"></a>IDEALX Management Console</h2></div></div></div><p>886 </pre></div></div><br class="example-break"></div><div class="sect1" title="IDEALX Management Console"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388364"></a>IDEALX Management Console</h2></div></div></div><p> 887 887 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive 888 888 web-based management interface for UNIX and Linux systems. … … 898 898 For further information regarding IMC refer to the web <a class="ulink" href="http://imc.sourceforge.net/" target="_top">site.</a> 899 899 Prebuilt RPM packages are also <a class="ulink" href="http://imc.sourceforge.net/download.html" target="_top">available.</a> 900 </p></div><div class="sect1" title="Effect of Setting File and Directory SUID/SGID Permissions Explained"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id38 9935"></a><a class="indexterm" name="id389942"></a><p>900 </p></div><div class="sect1" title="Effect of Setting File and Directory SUID/SGID Permissions Explained"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id388460"></a><a class="indexterm" name="id388467"></a><p> 901 901 The setting of the SUID/SGID bits on the file or directory permissions flag has particular 902 902 consequences. If the file is executable and the SUID bit is set, it executes with the privilege … … 968 968 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt 969 969 </pre><p> 970 </p></div><div class="sect1" title="Shared Data Integrity"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id3 90147"></a><a class="indexterm" name="id390155"></a>970 </p></div><div class="sect1" title="Shared Data Integrity"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id388672"></a><a class="indexterm" name="id388680"></a> 971 971 The integrity of shared data is often viewed as a particularly emotional issue, especially where 972 972 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have … … 974 974 </p><p> 975 975 The solution to concurrent multiuser data access problems must consider three separate areas 976 from which the problem may stem:<a class="indexterm" name="id3 90175"></a><a class="indexterm" name="id390186"></a><a class="indexterm" name="id390197"></a>977 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>application-level locking controls</p></li><li class="listitem"><p>client-side locking controls</p></li><li class="listitem"><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id3 90229"></a><a class="indexterm" name="id390237"></a>976 from which the problem may stem:<a class="indexterm" name="id388700"></a><a class="indexterm" name="id388711"></a><a class="indexterm" name="id388722"></a> 977 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>application-level locking controls</p></li><li class="listitem"><p>client-side locking controls</p></li><li class="listitem"><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id388754"></a><a class="indexterm" name="id388762"></a> 978 978 Many database applications use some form of application-level access control. An example of one 979 979 well-known application that uses application-level locking is Microsoft Access. Detailed guidance 980 980 is provided here because this is the most common application for which problems have been reported. 981 </p><p><a class="indexterm" name="id3 90251"></a><a class="indexterm" name="id390259"></a>981 </p><p><a class="indexterm" name="id388776"></a><a class="indexterm" name="id388784"></a> 982 982 Common applications that are affected by client- and server-side locking controls include MS 983 983 Excel and Act!. Important locking guidance is provided here. 984 </p><div class="sect2" title="Microsoft Access"><div class="titlepage"><div><div><h3 class="title"><a name="id3 90270"></a>Microsoft Access</h3></div></div></div><p>984 </p><div class="sect2" title="Microsoft Access"><div class="titlepage"><div><div><h3 class="title"><a name="id388795"></a>Microsoft Access</h3></div></div></div><p> 985 985 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that 986 986 cover this area. Examples of relevant documents include: 987 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id3 90294"></a><a class="indexterm" name="id390306"></a>987 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id388819"></a><a class="indexterm" name="id388831"></a> 988 988 Make sure that your MS Access database file is configured for multiuser access (not set for 989 989 exclusive open). Open MS Access on each client workstation, then set the following: <span class="guimenu">(Menu bar) Tools</span>+<span class="guimenu">Options</span>+<span class="guimenu">[tab] General</span>. Set network path to Default database folder: <code class="filename">\\server\share\folder</code>. 990 990 </p><p> 991 991 You can configure MS Access file sharing behavior as follows: click <span class="guimenu">[tab] Advanced</span>. 992 Set:<a class="indexterm" name="id3 90353"></a>993 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Default open mode: Shared</p></li><li class="listitem"><p>Default Record Locking: Edited Record</p></li><li class="listitem"><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id3 90382"></a>992 Set:<a class="indexterm" name="id388878"></a> 993 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Default open mode: Shared</p></li><li class="listitem"><p>Default Record Locking: Edited Record</p></li><li class="listitem"><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id388906"></a> 994 994 You must now commit the changes so that they will take effect. To do so, click 995 995 <span class="guimenu">Apply</span><span class="guimenu">Ok</span>. At this point, you should exit MS Access, restart 996 996 it, and then validate that these settings have not changed. 997 </p></div><div class="sect2" title="Act! Database Sharing"><div class="titlepage"><div><div><h3 class="title"><a name="id3 90409"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id390415"></a><a class="indexterm" name="id390423"></a>997 </p></div><div class="sect2" title="Act! Database Sharing"><div class="titlepage"><div><div><h3 class="title"><a name="id388933"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id388940"></a><a class="indexterm" name="id388948"></a> 998 998 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 999 999 must disable opportunistic locking on the server and all workstations. Failure to do so … … 1003 1003 as well as from article 1004 1004 <a class="ulink" href="http://itdomino.saleslogix.com/act.nsf/docid/200110485036" target="_top">200110485036</a>. 1005 </p><p><a class="indexterm" name="id3 90449"></a><a class="indexterm" name="id390457"></a>1005 </p><p><a class="indexterm" name="id388974"></a><a class="indexterm" name="id388982"></a> 1006 1006 These documents clearly state that opportunistic locking must be disabled on both 1007 1007 the server (Samba in the case we are interested in here), as well as on every workstation … … 1011 1011 Registered Act! users may download this utility from the Act! Web 1012 1012 <a class="ulink" href="http://www.act.com/support/updates/index.cfm" target="_top">site.</a> 1013 </p></div><div class="sect2" title="Opportunistic Locking Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id3 90484"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id390491"></a>1013 </p></div><div class="sect2" title="Opportunistic Locking Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id389009"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id389016"></a> 1014 1014 Third-party Windows applications may not be compatible with the use of opportunistic file 1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id3 90501" href="#ftn.id390501" class="footnote">14</a>]</sup> oplock1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id389026" href="#ftn.id389026" class="footnote">14</a>]</sup> oplock 1016 1016 support may need to be disabled both on the Samba server and on the Windows workstations. 1017 </p><p><a class="indexterm" name="id3 90512"></a><a class="indexterm" name="id390520"></a><a class="indexterm" name="id390528"></a>1017 </p><p><a class="indexterm" name="id389037"></a><a class="indexterm" name="id389045"></a><a class="indexterm" name="id389053"></a> 1018 1018 Oplocks enable a Windows client to cache parts of a file that are being 1019 1019 edited. Another windows client may then request to open the file with the … … 1022 1022 doing so, that workstation must flush the file from cache memory to the 1023 1023 disk or network drive. 1024 </p><p><a class="indexterm" name="id3 90546"></a>1024 </p><p><a class="indexterm" name="id389071"></a> 1025 1025 Disabling of Oplocks usage may require server and client changes. 1026 1026 Oplocks may be disabled by file, by file pattern, on the share, or on the … … 1058 1058 Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13. 1059 1059 The information in that chapter was obtained from a wide variety of sources. 1060 </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 90501" href="#id390501" class="para">14</a>] </sup>Refer to1060 </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id389026" href="#id389026" class="para">14</a>] </sup>Refer to 1061 1061 the application manufacturer's installation guidelines and knowledge base for specific 1062 1062 information regarding compatibility. It is often safe to assume that if the software -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/ch14.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="chapter" title="Chapter 14. Samba Support"><div class="titlepage"><div><div><h2 class="title"><a name="id38 6581"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></div><p>2 <a class="indexterm" name="id38 6590"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="chapter" title="Chapter 14. Samba Support"><div class="titlepage"><div><div><h2 class="title"><a name="id385106"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id385222">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id385420">Commercial Support</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id385115"></a> 3 3 One of the most difficult to answer questions in the information technology industry is, <span class="quote">“<span class="quote">What is 4 4 support?</span>”</span>. That question irritates some folks, as much as common answers may annoy others. 5 5 </p><p> 6 <a class="indexterm" name="id38 6604"></a>6 <a class="indexterm" name="id385130"></a> 7 7 The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to 8 8 an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: … … 16 16 inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk. 17 17 </p><p> 18 <a class="indexterm" name="id38 6628"></a>19 <a class="indexterm" name="id38 6635"></a>20 <a class="indexterm" name="id38 6642"></a>18 <a class="indexterm" name="id385154"></a> 19 <a class="indexterm" name="id385161"></a> 20 <a class="indexterm" name="id385168"></a> 21 21 One of the forces that has become a driving force for the adoption of open source software is the fact that 22 22 many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or 23 23 that have been found wanting for other reasons. 24 24 </p><p> 25 <a class="indexterm" name="id38 6654"></a>26 <a class="indexterm" name="id38 6661"></a>25 <a class="indexterm" name="id385180"></a> 26 <a class="indexterm" name="id385187"></a> 27 27 In recognition of the need for needs satisfaction as the primary experience an information technology user or 28 28 consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience 29 29 in respect of problem resolution. 30 30 </p><p> 31 <a class="indexterm" name="id38 6673"></a>32 <a class="indexterm" name="id38 6680"></a>33 <a class="indexterm" name="id38 6687"></a>31 <a class="indexterm" name="id385199"></a> 32 <a class="indexterm" name="id385206"></a> 33 <a class="indexterm" name="id385213"></a> 34 34 In the open source software arena there are two support options: free support and paid-for (commercial) 35 35 support. 36 </p><div class="sect1" title="Free Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 6696"></a>Free Support</h2></div></div></div><p>37 <a class="indexterm" name="id38 6704"></a>38 <a class="indexterm" name="id38 6710"></a>39 <a class="indexterm" name="id38 6717"></a>40 <a class="indexterm" name="id38 6724"></a>41 <a class="indexterm" name="id38 6731"></a>42 <a class="indexterm" name="id38 6738"></a>36 </p><div class="sect1" title="Free Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385222"></a>Free Support</h2></div></div></div><p> 37 <a class="indexterm" name="id385230"></a> 38 <a class="indexterm" name="id385236"></a> 39 <a class="indexterm" name="id385243"></a> 40 <a class="indexterm" name="id385250"></a> 41 <a class="indexterm" name="id385257"></a> 42 <a class="indexterm" name="id385264"></a> 43 43 Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help 44 44 facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user 45 45 supported mutual assistance. 46 46 </p><p> 47 <a class="indexterm" name="id38 6750"></a>48 <a class="indexterm" name="id38 6756"></a>49 <a class="indexterm" name="id38 6763"></a>50 <a class="indexterm" name="id38 6770"></a>51 <a class="indexterm" name="id38 6777"></a>47 <a class="indexterm" name="id385276"></a> 48 <a class="indexterm" name="id385282"></a> 49 <a class="indexterm" name="id385289"></a> 50 <a class="indexterm" name="id385296"></a> 51 <a class="indexterm" name="id385303"></a> 52 52 The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments. 53 53 Information regarding subscription to the Samba mailing list can be found on the Samba <a class="ulink" href="https://lists.samba.org/mailman/" target="_top">web</a> site. The public mailing list that can be used to obtain … … 56 56 the Samba <a class="ulink" href="http://www.samba.org/samba.irc.html" target="_top">IRC</a> web page. 57 57 </p><p> 58 <a class="indexterm" name="id38 6814"></a>59 <a class="indexterm" name="id38 6821"></a>60 <a class="indexterm" name="id38 6828"></a>61 <a class="indexterm" name="id38 6834"></a>58 <a class="indexterm" name="id385340"></a> 59 <a class="indexterm" name="id385347"></a> 60 <a class="indexterm" name="id385354"></a> 61 <a class="indexterm" name="id385360"></a> 62 62 As a general rule, it is considered poor net behavior to contact a Samba Team member directly 63 63 for free support. Most active members of the Samba Team work exceptionally long hours to assist … … 67 67 to show appropriate discretion and reservation in all direct contact. 68 68 </p><p> 69 <a class="indexterm" name="id38 6849"></a>70 <a class="indexterm" name="id38 6856"></a>71 <a class="indexterm" name="id38 6863"></a>69 <a class="indexterm" name="id385375"></a> 70 <a class="indexterm" name="id385382"></a> 71 <a class="indexterm" name="id385389"></a> 72 72 When you stumble across a Samba bug, often the quickest way to get it resolved is by posting 73 73 a bug <a class="ulink" href="https://bugzilla.samba.org/" target="_top">report</a>. All such reports are mailed to … … 77 77 that will permit the problem to be reproduced. 78 78 </p><p> 79 <a class="indexterm" name="id38 6883"></a>79 <a class="indexterm" name="id385409"></a> 80 80 We all recognize that sometimes free support does not provide the answer that is sought within 81 81 the time-frame required. At other times the problem is elusive and you may lack the experience 82 82 necessary to isolate the problem and thus to resolve it. This is a situation where is may be 83 83 prudent to purchase paid-for support. 84 </p></div><div class="sect1" title="Commercial Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 6894"></a>Commercial Support</h2></div></div></div><p>84 </p></div><div class="sect1" title="Commercial Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385420"></a>Commercial Support</h2></div></div></div><p> 85 85 There are six basic support oriented services that are most commonly sought by Samba sites: 86 86 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Assistance with network design</p></li><li class="listitem"><p>Staff Training</p></li><li class="listitem"><p>Assistance with Samba network deployment and installation</p></li><li class="listitem"><p>Priority telephone or email Samba configuration assistance</p></li><li class="listitem"><p>Trouble-shooting and diagnostic assistance</p></li><li class="listitem"><p>Provision of quality assured ready-to-install Samba binary packages</p></li></ul></div><p> 87 <a class="indexterm" name="id38 6938"></a>88 <a class="indexterm" name="id38 6945"></a>87 <a class="indexterm" name="id385464"></a> 88 <a class="indexterm" name="id385471"></a> 89 89 Information regarding companies that provide professional Samba support can be obtained by performing a Google 90 90 search, as well as by reference to the Samba <a class="ulink" href="http://www.samba.org/samba/support.html" target="_top">Support</a> web page. Companies who notify the Samba Team … … 94 94 them. 95 95 </p><p> 96 <a class="indexterm" name="id38 6966"></a>96 <a class="indexterm" name="id385492"></a> 97 97 The policy within the Samba Team is to treat all commercial support providers equally and to show no 98 98 preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. … … 100 100 is pro-community; so do what you can to help a local business to prosper. 101 101 </p><p> 102 <a class="indexterm" name="id38 6982"></a>102 <a class="indexterm" name="id385508"></a> 103 103 Open source software support can be found in any quality, at any price and in any place you can 104 104 to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/go01.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary" title="Glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id39 4912"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary" title="Glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id393436"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p> 2 2 A detailed list of permissions granted to users or groups with respect to file and network 3 3 resource access. -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/happy.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="net2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 5. Making Happy Users"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id3 41339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="net2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 5. Making Happy Users"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id339991">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340067">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id340195">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340598">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342251">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342264">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id342434">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id348703">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id348720">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id348809">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id349037">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id349135">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id349248">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id350249">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id350890">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id350916">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350946">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id351033">Questions and Answers</a></span></dt></dl></div><p> 2 2 It is said that <span class="quote">“<span class="quote">a day that is without troubles is not fulfilling. Rather, give 3 3 me a day of troubles well handled so that I can be content with my achievements.</span>”</span> … … 7 7 may create problems for some network users. The following lists some of the problems that 8 8 may occur: 9 </p><a class="indexterm" name="id3 40972"></a><a class="indexterm" name="id340978"></a><a class="indexterm" name="id340987"></a><a class="indexterm" name="id340994"></a><a class="indexterm" name="id341000"></a><div class="caution" title="Caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>9 </p><a class="indexterm" name="id339499"></a><a class="indexterm" name="id339505"></a><a class="indexterm" name="id339514"></a><a class="indexterm" name="id339521"></a><a class="indexterm" name="id339528"></a><div class="caution" title="Caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> 10 10 A significant number of network administrators have responded to the guidance given 11 11 here. It should be noted that there are sites that have a single PDC for many hundreds of … … 20 20 clients is conservative and if followed will minimize problems but it is not absolute. 21 21 </p></div><div class="variablelist"><dl><dt><span class="term">Users experiencing difficulty logging onto the network</span></dt><dd><p> 22 <a class="indexterm" name="id3 41038"></a>23 <a class="indexterm" name="id3 41046"></a>22 <a class="indexterm" name="id339565"></a> 23 <a class="indexterm" name="id339574"></a> 24 24 When a Windows client logs onto the network, many data packets are exchanged 25 25 between the client and the server that is providing the network logon services. … … 31 31 characteristics. 32 32 </p><p> 33 <a class="indexterm" name="id3 41061"></a>34 <a class="indexterm" name="id3 41068"></a>35 <a class="indexterm" name="id3 41074"></a>33 <a class="indexterm" name="id339589"></a> 34 <a class="indexterm" name="id339595"></a> 35 <a class="indexterm" name="id339602"></a> 36 36 If the domain controller provides only network logon services 37 37 and all file and print activity is handled by domain member servers, one domain … … 47 47 the Samba server as well as network bandwidth utilization. 48 48 </p></dd><dt><span class="term">Slow logons and log-offs</span></dt><dd><p> 49 <a class="indexterm" name="id3 41100"></a>49 <a class="indexterm" name="id339627"></a> 50 50 Slow logons and log-offs may be caused by many factors that include: 51 51 52 52 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 53 <a class="indexterm" name="id3 41113"></a>54 <a class="indexterm" name="id3 41125"></a>53 <a class="indexterm" name="id339640"></a> 54 <a class="indexterm" name="id339652"></a> 55 55 Excessive delays in the resolution of a NetBIOS name to its IP 56 56 address. This may be observed when an overloaded domain controller … … 58 58 a WINS server (this assumes that there is a single network segment). 59 59 </p></li><li class="listitem"><p> 60 <a class="indexterm" name="id3 41141"></a>61 <a class="indexterm" name="id3 41147"></a>62 <a class="indexterm" name="id3 41154"></a>60 <a class="indexterm" name="id339668"></a> 61 <a class="indexterm" name="id339675"></a> 62 <a class="indexterm" name="id339682"></a> 63 63 Network traffic collisions due to overloading of the network 64 64 segment. One short-term workaround to this may be to replace 65 65 network HUBs with Ethernet switches. 66 66 </p></li><li class="listitem"><p> 67 <a class="indexterm" name="id3 41167"></a>67 <a class="indexterm" name="id339694"></a> 68 68 Defective networking hardware. Over the past few years, we have seen 69 69 on the Samba mailing list a significant increase in the number of … … 73 73 the cause of the problem. 74 74 </p></li><li class="listitem"><p> 75 <a class="indexterm" name="id3 41184"></a>76 <a class="indexterm" name="id3 41193"></a>75 <a class="indexterm" name="id339711"></a> 76 <a class="indexterm" name="id339720"></a> 77 77 Excessively large roaming profiles. This type of problem is typically 78 78 the result of poor user education as well as poor network management. … … 82 82 on the part of network management. 83 83 </p></li><li class="listitem"><p> 84 <a class="indexterm" name="id3 41210"></a>84 <a class="indexterm" name="id339738"></a> 85 85 You should verify that the Windows XP WebClient service is not running. 86 86 The use of the WebClient service has been implicated in many Windows … … 91 91 of factors, including: 92 92 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 93 <a class="indexterm" name="id3 41240"></a>93 <a class="indexterm" name="id339767"></a> 94 94 Network overload (typically indicated by a high network collision rate) 95 95 </p></li><li class="listitem"><p> 96 96 Server overload 97 97 </p></li><li class="listitem"><p> 98 <a class="indexterm" name="id3 41258"></a>98 <a class="indexterm" name="id339786"></a> 99 99 Timeout causing the client to close a connection that is in use but has 100 100 been latent (no traffic) for some time (5 minutes or more) 101 101 </p></li><li class="listitem"><p> 102 <a class="indexterm" name="id3 41273"></a>102 <a class="indexterm" name="id339801"></a> 103 103 Defective networking hardware 104 104 </p></li></ul></div><p> 105 <a class="indexterm" name="id3 41287"></a>105 <a class="indexterm" name="id339814"></a> 106 106 No matter what the cause, a sudden loss of access to network resources can 107 107 result in BSOD (blue screen of death) situations that necessitate rebooting of the client … … 110 110 problem, data corruption. 111 111 </p></dd><dt><span class="term">Potential data corruption</span></dt><dd><p> 112 <a class="indexterm" name="id3 41314"></a>112 <a class="indexterm" name="id339841"></a> 113 113 Data corruption is one of the most serious problems. It leads to uncertainty, anger, and 114 114 frustration, and generally precipitates immediate corrective demands. Management response … … 124 124 methods to improve the reliability of your network environment, but be warned that all such steps 125 125 demand the price of complexity. 126 </p><div class="sect1" title="Regarding LDAP Directories and Windows Computer Accounts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 41339"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p>127 <a class="indexterm" name="id3 41347"></a>126 </p><div class="sect1" title="Regarding LDAP Directories and Windows Computer Accounts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id339866"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> 127 <a class="indexterm" name="id339874"></a> 128 128 Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some 129 129 constraints that are described in this section. 130 130 </p><p> 131 <a class="indexterm" name="id3 41361"></a>132 <a class="indexterm" name="id3 41367"></a>133 <a class="indexterm" name="id3 41374"></a>134 <a class="indexterm" name="id3 41381"></a>131 <a class="indexterm" name="id339888"></a> 132 <a class="indexterm" name="id339895"></a> 133 <a class="indexterm" name="id339902"></a> 134 <a class="indexterm" name="id339908"></a> 135 135 The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. 136 136 That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats … … 138 138 the machine account ends in a $ character, as do trust accounts. 139 139 </p><p> 140 <a class="indexterm" name="id3 41394"></a>141 <a class="indexterm" name="id3 41401"></a>140 <a class="indexterm" name="id339922"></a> 141 <a class="indexterm" name="id339928"></a> 142 142 The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID 143 143 is a design decision that was made a long way back in the history of Samba development. It is … … 145 145 Samba-3.x series. 146 146 </p><p> 147 <a class="indexterm" name="id3 41414"></a>148 <a class="indexterm" name="id3 41420"></a>147 <a class="indexterm" name="id339941"></a> 148 <a class="indexterm" name="id339947"></a> 149 149 The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that 150 150 must refer back to the host operating system on which Samba is running. The name service … … 159 159 all account entities can be located in an LDAP directory. 160 160 </p><p> 161 <a class="indexterm" name="id3 41451"></a>161 <a class="indexterm" name="id339978"></a> 162 162 For many the weapon of choice is to use the PADL nss_ldap utility. This utility must 163 163 be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That … … 165 165 in the documentation is directed at providing working examples only. The design 166 166 of an LDAP directory is a complex subject that is beyond the scope of this documentation. 167 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 41463"></a>Introduction</h2></div></div></div><p>167 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id339991"></a>Introduction</h2></div></div></div><p> 168 168 You just opened an email from Christine that reads: 169 169 </p><p> … … 194 194 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Christine</span></td></tr></table></div><p> 195 195 </p><p> 196 <a class="indexterm" name="id34 1510"></a>197 <a class="indexterm" name="id34 1517"></a>196 <a class="indexterm" name="id340037"></a> 197 <a class="indexterm" name="id340044"></a> 198 198 Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a 199 199 single domain controller is a poor design that has obvious operational effects that may … … 205 205 Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait 206 206 for approval; I appreciate the urgency. 207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id34 1540"></a>Assignment Tasks</h3></div></div></div><p>207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id340067"></a>Assignment Tasks</h3></div></div></div><p> 208 208 The priority of assigned tasks in this chapter is: 209 209 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> 210 <a class="indexterm" name="id34 1559"></a>211 <a class="indexterm" name="id34 1568"></a>212 <a class="indexterm" name="id34 1575"></a>213 <a class="indexterm" name="id34 1582"></a><a class="indexterm" name="id341587"></a>210 <a class="indexterm" name="id340086"></a> 211 <a class="indexterm" name="id340095"></a> 212 <a class="indexterm" name="id340102"></a> 213 <a class="indexterm" name="id340108"></a><a class="indexterm" name="id340114"></a> 214 214 Implement Backup Domain Controllers (BDCs) in each building. This involves 215 215 a change from a <span class="emphasis"><em>tdbsam</em></span> backend that was used in the previous … … 218 218 You can implement a single central LDAP server for this purpose. 219 219 </p></li><li class="listitem"><p> 220 <a class="indexterm" name="id34 1608"></a>221 <a class="indexterm" name="id34 1614"></a>222 <a class="indexterm" name="id34 1621"></a>223 <a class="indexterm" name="id34 1628"></a>220 <a class="indexterm" name="id340134"></a> 221 <a class="indexterm" name="id340141"></a> 222 <a class="indexterm" name="id340148"></a> 223 <a class="indexterm" name="id340155"></a> 224 224 Rectify the problem of excessive logon times. This involves redirection of 225 225 folders to network shares as well as modification of all user desktops to … … 227 227 create a new default profile that can be used for all new users. 228 228 </p></li></ol></div><p> 229 <a class="indexterm" name="id34 1644"></a>229 <a class="indexterm" name="id340171"></a> 230 230 You configure a new MS Windows XP Professional workstation disk image that you roll out 231 231 to all desktop users. The instructions you have created are followed on a staging machine 232 232 from which all changes can be carefully tested before inflicting them on your network users. 233 233 </p><p> 234 <a class="indexterm" name="id34 1657"></a>234 <a class="indexterm" name="id340184"></a> 235 235 This is the last network example in which specific mention of printing is made. The example 236 236 again makes use of the CUPS printing system. 237 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id34 1668"></a>Dissection and Discussion</h2></div></div></div><p>238 <a class="indexterm" name="id34 1676"></a>239 <a class="indexterm" name="id34 1682"></a>240 <a class="indexterm" name="id34 1689"></a>237 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340195"></a>Dissection and Discussion</h2></div></div></div><p> 238 <a class="indexterm" name="id340203"></a> 239 <a class="indexterm" name="id340209"></a> 240 <a class="indexterm" name="id340216"></a> 241 241 The implementation of Samba BDCs necessitates the installation and configuration of LDAP. 242 242 For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial 243 243 LDAP servers in current use with Samba-3 include: 244 244 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 245 <a class="indexterm" name="id34 1704"></a>245 <a class="indexterm" name="id340231"></a> 246 246 Novell <a class="ulink" href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a> 247 247 is being successfully used by some sites. Information on how to use eDirectory can be 248 248 obtained from the Samba mailing lists or from Novell. 249 249 </p></li><li class="listitem"><p> 250 <a class="indexterm" name="id34 1723"></a>250 <a class="indexterm" name="id340250"></a> 251 251 IBM <a class="ulink" href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli 252 252 Directory Server</a> can be used to provide the Samba LDAP backend. Example schema … … 254 254 <code class="filename">~samba/example/LDAP.</code> 255 255 </p></li><li class="listitem"><p> 256 <a class="indexterm" name="id34 1748"></a>256 <a class="indexterm" name="id340275"></a> 257 257 Sun <a class="ulink" href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity 258 258 Server product suite</a> provides an LDAP server that can be used for Samba. … … 265 265 help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. 266 266 </p><p> 267 <a class="indexterm" name="id34 1780"></a>267 <a class="indexterm" name="id340306"></a> 268 268 For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite 269 269 adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include … … 271 271 requires an understanding of what you are doing, why you are doing it, and the tools that you must use. 272 272 </p><p> 273 <a class="indexterm" name="id34 1793"></a>274 <a class="indexterm" name="id34 1800"></a>275 <a class="indexterm" name="id34 1807"></a>276 <a class="indexterm" name="id34 1816"></a>277 <a class="indexterm" name="id34 1825"></a>278 <a class="indexterm" name="id34 1832"></a>279 <a class="indexterm" name="id34 1841"></a>273 <a class="indexterm" name="id340320"></a> 274 <a class="indexterm" name="id340327"></a> 275 <a class="indexterm" name="id340334"></a> 276 <a class="indexterm" name="id340343"></a> 277 <a class="indexterm" name="id340352"></a> 278 <a class="indexterm" name="id340359"></a> 279 <a class="indexterm" name="id340368"></a> 280 280 When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. 281 281 High availability operation may be obtained through directory replication/synchronization and … … 287 287 with Microsoft Active Directory. 288 288 </p><p> 289 <a class="indexterm" name="id34 1860"></a>290 <a class="indexterm" name="id34 1869"></a>291 <a class="indexterm" name="id34 1876"></a>292 <a class="indexterm" name="id34 1883"></a>289 <a class="indexterm" name="id340387"></a> 290 <a class="indexterm" name="id340396"></a> 291 <a class="indexterm" name="id340403"></a> 292 <a class="indexterm" name="id340410"></a> 293 293 A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory 294 294 tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured … … 301 301 of OpenLDAP. 302 302 </p><p> 303 <a class="indexterm" name="id34 1906"></a>304 <a class="indexterm" name="id34 1915"></a>303 <a class="indexterm" name="id340433"></a> 304 <a class="indexterm" name="id340442"></a> 305 305 You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly 306 306 if you find the challenge of learning about LDAP directories, schemas, configuration, and management … … 310 310 that is required for use as a passdb backend. 311 311 </p><p> 312 <a class="indexterm" name="id34 1929"></a>312 <a class="indexterm" name="id340456"></a> 313 313 For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, 314 314 there are a few nice Web-based tools that may help you to manage your users and groups more effectively. … … 335 335 by Jerry Carter quite useful. 336 336 </p><p> 337 <a class="indexterm" name="id34 2015"></a>338 <a class="indexterm" name="id34 2022"></a>339 <a class="indexterm" name="id34 2031"></a>340 <a class="indexterm" name="id34 2038"></a>337 <a class="indexterm" name="id340542"></a> 338 <a class="indexterm" name="id340549"></a> 339 <a class="indexterm" name="id340558"></a> 340 <a class="indexterm" name="id340565"></a> 341 341 Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the 342 342 main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must … … 346 346 staff morale. The following procedures solve this problem. 347 347 </p><p> 348 <a class="indexterm" name="id34 2055"></a>348 <a class="indexterm" name="id340582"></a> 349 349 There is also an opportunity to implement smart printing features. You add this to the Samba configuration 350 350 so that future printer changes can be managed without need to change desktop configurations. … … 353 353 in the default desktop profile. Only one example of printing configuration is given. It is assumed that 354 354 you can extrapolate the principles and use them to install all printers that may be needed. 355 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id34 2070"></a>Technical Issues</h3></div></div></div><p>356 <a class="indexterm" name="id34 2078"></a>357 <a class="indexterm" name="id34 2087"></a>358 <a class="indexterm" name="id34 2097"></a>355 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id340598"></a>Technical Issues</h3></div></div></div><p> 356 <a class="indexterm" name="id340606"></a> 357 <a class="indexterm" name="id340615"></a> 358 <a class="indexterm" name="id340624"></a> 359 359 The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory 360 360 server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system … … 362 362 attributes Samba needs. Samba-3 can use the LDAP backend to store: 363 363 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Windows Networking User Accounts</p></li><li class="listitem"><p>Windows NT Group Accounts</p></li><li class="listitem"><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li class="listitem"><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> 364 <a class="indexterm" name="id34 2133"></a>365 <a class="indexterm" name="id34 2140"></a>366 <a class="indexterm" name="id34 2146"></a>367 <a class="indexterm" name="id34 2153"></a>368 <a class="indexterm" name="id34 2160"></a>369 <a class="indexterm" name="id34 2167"></a>370 <a class="indexterm" name="id34 2176"></a>371 <a class="indexterm" name="id34 2182"></a>372 <a class="indexterm" name="id34 2189"></a>364 <a class="indexterm" name="id340660"></a> 365 <a class="indexterm" name="id340666"></a> 366 <a class="indexterm" name="id340673"></a> 367 <a class="indexterm" name="id340680"></a> 368 <a class="indexterm" name="id340687"></a> 369 <a class="indexterm" name="id340694"></a> 370 <a class="indexterm" name="id340703"></a> 371 <a class="indexterm" name="id340709"></a> 372 <a class="indexterm" name="id340716"></a> 373 373 The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking 374 374 accounts in the LDAP backend. This implies the need to use the … … 379 379 of the UNIX username to the UID. The relationships are demonstrated in <a class="link" href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">“The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts”</a>. 380 380 </p><div class="figure"><a name="sbehap-LDAPdiag"></a><p class="title"><b>Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UNIX-Samba-and-LDAP.png" width="270" alt="The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts"></div></div></div><br class="figure-break"><p> 381 <a class="indexterm" name="id34 2269"></a>382 <a class="indexterm" name="id34 2275"></a>381 <a class="indexterm" name="id340794"></a> 382 <a class="indexterm" name="id340801"></a> 383 383 You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really 384 384 ought to learn how to configure secure communications over LDAP so that site security is not 385 385 at risk. This is not covered in the following guidance. 386 386 </p><p> 387 <a class="indexterm" name="id34 2290"></a>388 <a class="indexterm" name="id34 2296"></a>389 <a class="indexterm" name="id34 2306"></a>390 <a class="indexterm" name="id34 2312"></a>387 <a class="indexterm" name="id340816"></a> 388 <a class="indexterm" name="id340822"></a> 389 <a class="indexterm" name="id340832"></a> 390 <a class="indexterm" name="id340838"></a> 391 391 When OpenLDAP has been made operative, you configure the PDC called <code class="constant">MASSIVE</code>. 392 392 You initialize the Samba <code class="filename">secrets.tdb<sub></sub></code> file. Then you … … 396 396 that help to manage user and group configuration. 397 397 </p><p> 398 <a class="indexterm" name="id34 2343"></a>399 <a class="indexterm" name="id34 2350"></a>400 <a class="indexterm" name="id34 2356"></a>398 <a class="indexterm" name="id340869"></a> 399 <a class="indexterm" name="id340875"></a> 400 <a class="indexterm" name="id340882"></a> 401 401 In order to effect folder redirection and to add robustness to the implementation, 402 402 create a network default profile. All network users workstations are configured to use … … 404 404 when the user logs off. 405 405 </p><p> 406 <a class="indexterm" name="id34 2369"></a>406 <a class="indexterm" name="id340895"></a> 407 407 The profile is configured so that users cannot change the appearance 408 408 of their desktop. This is known as a mandatory profile. You make certain that users 409 409 are able to use their computers efficiently. 410 410 </p><p> 411 <a class="indexterm" name="id34 2381"></a>411 <a class="indexterm" name="id340907"></a> 412 412 A network logon script is used to deliver flexible but consistent network drive 413 413 connections. 414 414 </p><div class="sect3" title="Addition of Machines to the Domain"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> 415 <a class="indexterm" name="id34 2401"></a>416 <a class="indexterm" name="id34 2406"></a>417 <a class="indexterm" name="id34 2412"></a>418 <a class="indexterm" name="id34 2417"></a>415 <a class="indexterm" name="id340927"></a> 416 <a class="indexterm" name="id340932"></a> 417 <a class="indexterm" name="id340938"></a> 418 <a class="indexterm" name="id340943"></a> 419 419 Samba versions prior to 3.0.11 necessitated the use of a domain administrator account 420 420 that maps to the UNIX UID=0. The UNIX operating system permits only the <code class="constant">root</code> … … 426 426 how any user can now be given the ability to add machines to the domain using a normal user account 427 427 that has been given the appropriate privileges. 428 </p></div><div class="sect3" title="Roaming Profile Background"><div class="titlepage"><div><div><h4 class="title"><a name="id34 2548"></a>Roaming Profile Background</h4></div></div></div><p>428 </p></div><div class="sect3" title="Roaming Profile Background"><div class="titlepage"><div><div><h4 class="title"><a name="id341073"></a>Roaming Profile Background</h4></div></div></div><p> 429 429 As XP roaming profiles grow, so does the amount of time it takes to log in and out. 430 430 </p><p> 431 <a class="indexterm" name="id34 2560"></a>432 <a class="indexterm" name="id34 2566"></a>433 <a class="indexterm" name="id34 2573"></a>434 <a class="indexterm" name="id34 2580"></a>431 <a class="indexterm" name="id341085"></a> 432 <a class="indexterm" name="id341092"></a> 433 <a class="indexterm" name="id341099"></a> 434 <a class="indexterm" name="id341106"></a> 435 435 An XP roaming profile consists of the <code class="constant">HKEY_CURRENT_USER</code> hive file 436 436 <code class="filename">NTUSER.DAT</code> and a number of folders (My Documents, Application Data, … … 454 454 instead of the <code class="filename">My Documents</code> folder for saving documents. 455 455 </p><p> 456 <a class="indexterm" name="id34 2644"></a>456 <a class="indexterm" name="id341170"></a> 457 457 Using a folder other than <code class="filename">My Documents</code> is a nuisance for 458 458 some users, since many applications use it by default. 459 459 </p><p> 460 <a class="indexterm" name="id34 2661"></a>461 <a class="indexterm" name="id34 2668"></a>462 <a class="indexterm" name="id34 2675"></a>460 <a class="indexterm" name="id341187"></a> 461 <a class="indexterm" name="id341194"></a> 462 <a class="indexterm" name="id341200"></a> 463 463 The secret to rapid loading of roaming profiles is to prevent unnecessary data from 464 464 being copied back and forth, without losing any functionality. This is not difficult; … … 466 466 as changing some paths in each user's <code class="filename">NTUSER.DAT</code> hive. 467 467 </p><p> 468 <a class="indexterm" name="id34 2693"></a>469 <a class="indexterm" name="id34 2700"></a>468 <a class="indexterm" name="id341219"></a> 469 <a class="indexterm" name="id341226"></a> 470 470 Every user profile has its own <code class="filename">NTUSER.DAT</code> file. This means 471 471 you need to edit every user's profile, unless a better method can be … … 476 476 they are redirected. 477 477 </p></div><div class="sect3" title="The Local Group Policy"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> 478 <a class="indexterm" name="id34 2736"></a>479 <a class="indexterm" name="id34 2742"></a>480 <a class="indexterm" name="id34 2749"></a>481 <a class="indexterm" name="id34 2756"></a>478 <a class="indexterm" name="id341262"></a> 479 <a class="indexterm" name="id341268"></a> 480 <a class="indexterm" name="id341275"></a> 481 <a class="indexterm" name="id341282"></a> 482 482 Without an Active Directory PDC, you cannot take full advantage of Group Policy 483 483 Objects. However, you can still make changes to the Local Group Policy by using … … 493 493 semicolon-separated list. Note that this change must be made on all clients 494 494 that are using roaming profiles. 495 </p></div><div class="sect3" title="Profile Changes"><div class="titlepage"><div><div><h4 class="title"><a name="id34 2818"></a>Profile Changes</h4></div></div></div><p>496 <a class="indexterm" name="id34 2826"></a>497 <a class="indexterm" name="id34 2832"></a>495 </p></div><div class="sect3" title="Profile Changes"><div class="titlepage"><div><div><h4 class="title"><a name="id341344"></a>Profile Changes</h4></div></div></div><p> 496 <a class="indexterm" name="id341352"></a> 497 <a class="indexterm" name="id341358"></a> 498 498 There are two changes that should be done to each user's profile. Move each of 499 499 the directories that you have excluded from being copied back and forth out of … … 502 502 path (<code class="filename">C:\Documents and Settings\%USERNAME%</code>). 503 503 </p><p> 504 <a class="indexterm" name="id34 2857"></a>505 <a class="indexterm" name="id34 2864"></a>504 <a class="indexterm" name="id341383"></a> 505 <a class="indexterm" name="id341390"></a> 506 506 The above modifies existing user profiles. So that newly created profiles have 507 507 these settings, you need to modify the <code class="filename">NTUSER.DAT</code> in … … 510 510 <code class="filename">NTUSER.DAT</code> to a Linux box and using <code class="literal">regedt32</code>. 511 511 The basic method is described under <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 512 </p></div><div class="sect3" title="Using a Network Default User Profile"><div class="titlepage"><div><div><h4 class="title"><a name="id34 2906"></a>Using a Network Default User Profile</h4></div></div></div><p>513 <a class="indexterm" name="id34 2914"></a>514 <a class="indexterm" name="id34 2921"></a>512 </p></div><div class="sect3" title="Using a Network Default User Profile"><div class="titlepage"><div><div><h4 class="title"><a name="id341432"></a>Using a Network Default User Profile</h4></div></div></div><p> 513 <a class="indexterm" name="id341440"></a> 514 <a class="indexterm" name="id341446"></a> 515 515 If you are using Samba as your PDC, you should create a file share called 516 516 <code class="constant">NETLOGON</code> and within that create a directory called … … 521 521 See also <a class="ulink" href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top"> 522 522 the Real Men Don't Click</a> Web site. 523 </p></div><div class="sect3" title="Installation of Printer Driver Auto-Download"><div class="titlepage"><div><div><h4 class="title"><a name="id34 2960"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p>524 <a class="indexterm" name="id34 2968"></a>525 <a class="indexterm" name="id34 2977"></a>526 <a class="indexterm" name="id34 2984"></a>523 </p></div><div class="sect3" title="Installation of Printer Driver Auto-Download"><div class="titlepage"><div><div><h4 class="title"><a name="id341486"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> 524 <a class="indexterm" name="id341494"></a> 525 <a class="indexterm" name="id341503"></a> 526 <a class="indexterm" name="id341510"></a> 527 527 The subject of printing is quite topical. Printing problems run second place to name 528 528 resolution issues today. So far in this book, you have experienced only what is generally … … 533 533 <code class="literal">Raw-Print-Through</code> printing. 534 534 </p><p> 535 <a class="indexterm" name="id34 3008"></a>536 <a class="indexterm" name="id34 3017"></a>535 <a class="indexterm" name="id341534"></a> 536 <a class="indexterm" name="id341543"></a> 537 537 Samba permits the configuration of <code class="literal">smart</code> printing using the Microsoft 538 538 Windows point-and-click (also called drag-and-drop) printing. What this provides is … … 548 548 suited to the printer to which the job is dispatched. 549 549 </p><p> 550 <a class="indexterm" name="id34 3057"></a>551 <a class="indexterm" name="id34 3064"></a>552 <a class="indexterm" name="id34 3071"></a>550 <a class="indexterm" name="id341583"></a> 551 <a class="indexterm" name="id341590"></a> 552 <a class="indexterm" name="id341597"></a> 553 553 The CUPS printing subsystem is capable of intelligent printing. It has the capacity to 554 554 detect the data format and apply a print filter. This means that it is feasible to install … … 575 575 </p><p> 576 576 Here are some diagnostic guidelines that can be referred to when things go wrong: 577 </p><div class="sect4" title="Preliminary Advice: Dangers Can Be Avoided"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3123"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p>577 </p><div class="sect4" title="Preliminary Advice: Dangers Can Be Avoided"><div class="titlepage"><div><div><h5 class="title"><a name="id341649"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> 578 578 The best advice regarding how to mend a broken leg is <span class="quote">“<span class="quote">Never break a leg!</span>”</span> 579 579 </p><p> 580 <a class="indexterm" name="id34 3138"></a>580 <a class="indexterm" name="id341664"></a> 581 581 Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice 582 582 regarding the best way to remedy LDAP and Samba problems: <span class="quote">“<span class="quote">Avoid them like the plague!</span>”</span> … … 594 594 book and adapt them without first working through the examples provided. A little 595 595 thing overlooked can cause untold pain and may permanently tarnish your experience. 596 </p></div></div><div class="sect4" title="The Name Service Caching Daemon"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3173"></a>The Name Service Caching Daemon</h5></div></div></div><p>596 </p></div></div><div class="sect4" title="The Name Service Caching Daemon"><div class="titlepage"><div><div><h5 class="title"><a name="id341699"></a>The Name Service Caching Daemon</h5></div></div></div><p> 597 597 The name service caching daemon (nscd) is a primary cause of difficulties with name 598 598 resolution, particularly where <code class="literal">winbind</code> is used. Winbind does its … … 661 661 <code class="prompt">root# </code> rcnscd off 662 662 </pre><p> 663 </p></div><div class="sect4" title="Debugging LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3291"></a>Debugging LDAP</h5></div></div></div><p>664 <a class="indexterm" name="id34 3298"></a>665 <a class="indexterm" name="id34 3305"></a>666 <a class="indexterm" name="id34 3312"></a>663 </p></div><div class="sect4" title="Debugging LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id341816"></a>Debugging LDAP</h5></div></div></div><p> 664 <a class="indexterm" name="id341824"></a> 665 <a class="indexterm" name="id341831"></a> 666 <a class="indexterm" name="id341838"></a> 667 667 In the example <code class="filename">/etc/openldap/slapd.conf</code> control file 668 668 (see <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a>) there is an entry for <code class="constant">loglevel 256</code>. … … 670 670 and restart <code class="literal">slapd</code>. 671 671 </p><p> 672 <a class="indexterm" name="id34 3346"></a>673 <a class="indexterm" name="id34 3352"></a>672 <a class="indexterm" name="id341872"></a> 673 <a class="indexterm" name="id341879"></a> 674 674 LDAP log information can be directed into a file that is separate from the normal system 675 675 log files by changing the <code class="filename">/etc/syslog.conf</code> file so it has the following … … 690 690 customization with the intent that LDAP log files will be stored at a location 691 691 that meets local site needs and wishes more fully. 692 </p></div><div class="sect4" title="Debugging NSS_LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3386"></a>Debugging NSS_LDAP</h5></div></div></div><p>692 </p></div><div class="sect4" title="Debugging NSS_LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id341913"></a>Debugging NSS_LDAP</h5></div></div></div><p> 693 693 The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the 694 694 <code class="filename">/etc/ldap.conf</code> file the following parameters: … … 703 703 </p><p> 704 704 The diagnostic process should follow these steps: 705 </p><div class="procedure" title="Procedure 5.1. NSS_LDAP Diagnostic Steps"><a name="id34 3427"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>705 </p><div class="procedure" title="Procedure 5.1. NSS_LDAP Diagnostic Steps"><a name="id341954"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 706 706 Verify the <code class="constant">nss_base_passwd, nss_base_shadow, nss_base_group</code> entries 707 707 in the <code class="filename">/etc/ldap.conf</code> file and compare them closely with the directory … … 793 793 <code class="filename">/etc/ldap.secrets</code> file is correct, as specified in the 794 794 <code class="filename">/etc/openldap/slapd.conf</code> file. 795 </p></li></ol></div></div><div class="sect4" title="Debugging Samba"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3646"></a>Debugging Samba</h5></div></div></div><p>795 </p></li></ol></div></div><div class="sect4" title="Debugging Samba"><div class="titlepage"><div><div><h5 class="title"><a name="id342172"></a>Debugging Samba</h5></div></div></div><p> 796 796 The following parameters in the <code class="filename">smb.conf</code> file can be useful in tracking down Samba-related problems: 797 797 </p><pre class="screen"> … … 823 823 Search for hints of what may have failed by looking for the words <span class="emphasis"><em>fail</em></span> 824 824 and <span class="emphasis"><em>error</em></span>. 825 </p></div><div class="sect4" title="Debugging on the Windows Client"><div class="titlepage"><div><div><h5 class="title"><a name="id34 3710"></a>Debugging on the Windows Client</h5></div></div></div><p>825 </p></div><div class="sect4" title="Debugging on the Windows Client"><div class="titlepage"><div><div><h5 class="title"><a name="id342236"></a>Debugging on the Windows Client</h5></div></div></div><p> 826 826 MS Windows 2000 Professional and Windows XP Professional clients can be configured 827 827 to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search 828 828 the Microsoft knowledge base for detailed instructions. The techniques vary a little with each 829 829 version of MS Windows. 830 </p></div></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id34 3725"></a>Political Issues</h3></div></div></div><p>830 </p></div></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id342251"></a>Political Issues</h3></div></div></div><p> 831 831 MS Windows network users are generally very sensitive to limits that may be imposed when 832 832 confronted with locked-down workstation configurations. The challenge you face must 833 833 be promoted as a choice between reliable, fast network operation and a constant flux 834 834 of problems that result in user irritation. 835 </p></div><div class="sect2" title="Installation Checklist"><div class="titlepage"><div><div><h3 class="title"><a name="id34 3737"></a>Installation Checklist</h3></div></div></div><p>835 </p></div><div class="sect2" title="Installation Checklist"><div class="titlepage"><div><div><h3 class="title"><a name="id342264"></a>Installation Checklist</h3></div></div></div><p> 836 836 You are starting a complex project. Even though you went through the installation of a complex 837 837 network in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>, this network is a bigger challenge because of the … … 841 841 been completed. The following task list may help you to keep track of the task items 842 842 that are covered: 843 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>OpenLDAP server</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Samba-3 PDC</p></li><li class="listitem"><p>Idealx smbldap scripts</p></li><li class="listitem"><p>LDAP initialization</p></li><li class="listitem"><p>Create user and group accounts</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profile directories</p></li><li class="listitem"><p>Logon scripts</p></li><li class="listitem"><p>Configuration of user rights and privileges</p></li></ol></div></li><li class="listitem"><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profiles directories</p></li></ol></div></li><li class="listitem"><p>Windows XP Client Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Default profile folder redirection</p></li><li class="listitem"><p>MS Outlook PST file relocation</p></li><li class="listitem"><p>Delete roaming profile on logout</p></li><li class="listitem"><p>Upload printer drivers to Samba servers</p></li><li class="listitem"><p>Install software</p></li><li class="listitem"><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" title="Samba Server Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id34 3908"></a>Samba Server Implementation</h2></div></div></div><p>844 <a class="indexterm" name="id34 3916"></a>845 <a class="indexterm" name="id34 3923"></a>843 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>OpenLDAP server</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Samba-3 PDC</p></li><li class="listitem"><p>Idealx smbldap scripts</p></li><li class="listitem"><p>LDAP initialization</p></li><li class="listitem"><p>Create user and group accounts</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profile directories</p></li><li class="listitem"><p>Logon scripts</p></li><li class="listitem"><p>Configuration of user rights and privileges</p></li></ol></div></li><li class="listitem"><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profiles directories</p></li></ol></div></li><li class="listitem"><p>Windows XP Client Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Default profile folder redirection</p></li><li class="listitem"><p>MS Outlook PST file relocation</p></li><li class="listitem"><p>Delete roaming profile on logout</p></li><li class="listitem"><p>Upload printer drivers to Samba servers</p></li><li class="listitem"><p>Install software</p></li><li class="listitem"><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" title="Samba Server Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id342434"></a>Samba Server Implementation</h2></div></div></div><p> 844 <a class="indexterm" name="id342442"></a> 845 <a class="indexterm" name="id342449"></a> 846 846 The network design shown in <a class="link" href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">“Network Topology 500 User Network Using ldapsam passdb backend”</a> is not comprehensive. It is assumed 847 847 that you will install additional file servers and possibly additional BDCs. 848 848 </p><div class="figure"><a name="chap6net"></a><p class="title"><b>Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap6-net.png" width="270" alt="Network Topology 500 User Network Using ldapsam passdb backend"></div></div></div><br class="figure-break"><p> 849 <a class="indexterm" name="id34 3983"></a>850 <a class="indexterm" name="id34 3990"></a>849 <a class="indexterm" name="id342509"></a> 850 <a class="indexterm" name="id342516"></a> 851 851 All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE 852 852 Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to … … 869 869 <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> before commencing at <a class="link" href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">“OpenLDAP Server Configuration”</a>. 870 870 </p><div class="sect2" title="OpenLDAP Server Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> 871 <a class="indexterm" name="id34 4059"></a>872 <a class="indexterm" name="id34 4066"></a>873 <a class="indexterm" name="id34 4073"></a>871 <a class="indexterm" name="id342586"></a> 872 <a class="indexterm" name="id342593"></a> 873 <a class="indexterm" name="id342600"></a> 874 874 Confirm that the packages shown in <a class="link" href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">“Required OpenLDAP Linux Packages”</a> are installed on your system. 875 875 </p><div class="table"><a name="oldapreq"></a><p class="title"><b>Table 5.2. Required OpenLDAP Linux Packages</b></p><div class="table-contents"><table summary="Required OpenLDAP Linux Packages" border="1"><colgroup><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">SUSE Linux 8.x</th><th align="center">SUSE Linux 9.x</th><th align="center">Red Hat Linux</th></tr></thead><tbody><tr><td align="left">nss_ldap</td><td align="left">nss_ldap</td><td align="left">nss_ldap</td></tr><tr><td align="left">pam_ldap</td><td align="left">pam_ldap</td><td align="left">pam_ldap</td></tr><tr><td align="left">openldap2</td><td align="left">openldap2</td><td align="left">openldap</td></tr><tr><td align="left">openldap2-client</td><td align="left">openldap2-client</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><p> … … 877 877 for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you 878 878 follow these guidelines, the resulting system should work fine. 879 </p><div class="procedure" title="Procedure 5.2. OpenLDAP Server Configuration Steps"><a name="id34 4202"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>880 <a class="indexterm" name="id34 4213"></a>879 </p><div class="procedure" title="Procedure 5.2. OpenLDAP Server Configuration Steps"><a name="id342728"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 880 <a class="indexterm" name="id342739"></a> 881 881 Install the file shown in <a class="link" href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">“LDAP Master Configuration File /etc/openldap/slapd.conf Part A”</a> in the directory 882 882 <code class="filename">/etc/openldap</code>. 883 883 </p></li><li class="step" title="Step 2"><p> 884 <a class="indexterm" name="id34 4240"></a>885 <a class="indexterm" name="id34 4247"></a>886 <a class="indexterm" name="id34 4253"></a>884 <a class="indexterm" name="id342766"></a> 885 <a class="indexterm" name="id342773"></a> 886 <a class="indexterm" name="id342779"></a> 887 887 Remove all files from the directory <code class="filename">/data/ldap</code>, making certain that 888 888 the directory exists with permissions: … … 893 893 This may require you to add a user and a group account for LDAP if they do not exist. 894 894 </p></li><li class="step" title="Step 3"><p> 895 <a class="indexterm" name="id34 4286"></a>895 <a class="indexterm" name="id342812"></a> 896 896 Install the file shown in <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a> in the directory 897 897 <code class="filename">/data/ldap</code>. In the event that this file is added after <code class="constant">ldap</code> … … 900 900 <code class="filename">/data/ldap</code> directory, and then restarting the <code class="constant">LDAP</code> server. 901 901 </p></li><li class="step" title="Step 4"><p> 902 <a class="indexterm" name="id34 4336"></a>902 <a class="indexterm" name="id342862"></a> 903 903 Performance logging can be enabled and should preferably be sent to a file on 904 904 a file system that is large enough to handle significantly sized logs. To enable … … 976 976 index default sub 977 977 </pre></div></div><br class="example-break"></div><div class="sect2" title="PAM and NSS Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> 978 <a class="indexterm" name="id34 4468"></a>979 <a class="indexterm" name="id34 4474"></a>980 <a class="indexterm" name="id34 4481"></a>978 <a class="indexterm" name="id342994"></a> 979 <a class="indexterm" name="id343001"></a> 980 <a class="indexterm" name="id343007"></a> 981 981 The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and 982 982 groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure 983 983 the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. 984 984 </p><p> 985 <a class="indexterm" name="id34 4493"></a>986 <a class="indexterm" name="id34 4502"></a>985 <a class="indexterm" name="id343019"></a> 986 <a class="indexterm" name="id343028"></a> 987 987 Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely 988 988 that you may want to use them for UNIX system (Linux) local machine logons. This necessitates … … 991 991 module also has the ability to redirect authentication requests through LDAP. 992 992 </p><p> 993 <a class="indexterm" name="id34 4527"></a>994 <a class="indexterm" name="id34 4534"></a>995 <a class="indexterm" name="id34 4541"></a>996 <a class="indexterm" name="id34 4548"></a>993 <a class="indexterm" name="id343054"></a> 994 <a class="indexterm" name="id343060"></a> 995 <a class="indexterm" name="id343067"></a> 996 <a class="indexterm" name="id343074"></a> 997 997 You have chosen to configure these services by directly editing the system files, but of course, you 998 998 know that this configuration can be done using system tools provided by the Linux system vendor. … … 1000 1000 configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <code class="literal">authconfig</code> 1001 1001 tool for this. 1002 </p><div class="procedure" title="Procedure 5.3. PAM and NSS Client Configuration Steps"><a name="id34 4584"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen">1002 </p><div class="procedure" title="Procedure 5.3. PAM and NSS Client Configuration Steps"><a name="id343111"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> 1003 1003 host 127.0.0.1 1004 1004 … … 1043 1043 ssl off 1044 1044 </pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1045 <a class="indexterm" name="id34 4595"></a>1046 <a class="indexterm" name="id34 4602"></a>1047 <a class="indexterm" name="id34 4609"></a>1045 <a class="indexterm" name="id343122"></a> 1046 <a class="indexterm" name="id343129"></a> 1047 <a class="indexterm" name="id343136"></a> 1048 1048 Execute the following command to find where the <code class="filename">nss_ldap</code> module 1049 1049 expects to find its control file: … … 1058 1058 <a class="link" href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">“Configuration File for NSS LDAP Clients Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1059 1059 </p></li><li class="step" title="Step 3"><p> 1060 <a class="indexterm" name="id34 4734"></a>1060 <a class="indexterm" name="id343259"></a> 1061 1061 Edit the NSS control file (<code class="filename">/etc/nsswitch.conf</code>) so that the lines that 1062 1062 control user and group resolution will obtain information from the normal system files as … … 1081 1081 <code class="filename">nsswitch.conf</code> file is a significant cause of operational problems with LDAP. 1082 1082 </p></li><li class="step" title="Step 4"><p> 1083 <a class="indexterm" name="id34 4800"></a>1083 <a class="indexterm" name="id343325"></a> 1084 1084 For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following 1085 1085 files in the <code class="filename">/etc/pam.d</code> directory: <code class="literal">login</code>, <code class="literal">password</code>, … … 1103 1103 </pre><p> 1104 1104 </p><p> 1105 <a class="indexterm" name="id34 4872"></a>1105 <a class="indexterm" name="id343397"></a> 1106 1106 On other Linux systems that do not have an LDAP-enabled <code class="literal">pam_unix2.so</code> module, 1107 1107 you must edit these files by adding the <code class="literal">pam_ldap.so</code> modules as shown here: … … 1127 1127 LDAP, you probably want to use it rather than add an additional module. 1128 1128 </p></li></ol></div></div><div class="sect2" title="Samba-3 PDC Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> 1129 <a class="indexterm" name="id34 4942"></a>1129 <a class="indexterm" name="id343467"></a> 1130 1130 Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server 1131 1131 before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the … … 1134 1134 Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that 1135 1135 is included with this book. 1136 </p><div class="procedure" title="Procedure 5.4. Configuration of PDC Called MASSIVE"><a name="id34 4954"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1136 </p><div class="procedure" title="Procedure 5.4. Configuration of PDC Called MASSIVE"><a name="id343478"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1137 1137 Install the files in <a class="link" href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part A”</a>, 1138 1138 <a class="link" href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part B”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, … … 1144 1144 the next step. 1145 1145 </p></li><li class="step" title="Step 2"><p> 1146 <a class="indexterm" name="id34 5025"></a>1146 <a class="indexterm" name="id343552"></a> 1147 1147 Create and verify the contents of the <code class="filename">smb.conf</code> file that is generated by: 1148 1148 </p><pre class="screen"> … … 1181 1181 </pre><p> 1182 1182 </p></li><li class="step" title="Step 4"><p> 1183 <a class="indexterm" name="id34 5117"></a>1184 <a class="indexterm" name="id34 5124"></a>1183 <a class="indexterm" name="id343643"></a> 1184 <a class="indexterm" name="id343650"></a> 1185 1185 Samba-3 communicates with the LDAP server. The password that it uses to 1186 1186 authenticate to the LDAP server must be stored in the <code class="filename">secrets.tdb</code> … … 1195 1195 </pre><p> 1196 1196 </p></li><li class="step" title="Step 5"><p> 1197 <a class="indexterm" name="id34 5169"></a>1198 <a class="indexterm" name="id34 5176"></a>1197 <a class="indexterm" name="id343695"></a> 1198 <a class="indexterm" name="id343702"></a> 1199 1199 Samba-3 generates a Windows Security Identifier (SID) only when <code class="literal">smbd</code> 1200 1200 has been started. For this reason, you start Samba. After a few seconds delay, … … 1230 1230 When a positive domain SID has been reported, stop Samba. 1231 1231 </p></li><li class="step" title="Step 7"><p> 1232 <a class="indexterm" name="id34 5275"></a>1233 <a class="indexterm" name="id34 5281"></a>1234 <a class="indexterm" name="id34 5288"></a>1235 <a class="indexterm" name="id34 5295"></a>1232 <a class="indexterm" name="id343801"></a> 1233 <a class="indexterm" name="id343808"></a> 1234 <a class="indexterm" name="id343815"></a> 1235 <a class="indexterm" name="id343821"></a> 1236 1236 Configure the NFS server for your Linux system. So you can complete the steps that 1237 1237 follow, enter into the <code class="filename">/etc/exports</code> the following entry: … … 1251 1251 Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with 1252 1252 configuration of the LDAP server. 1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id34 5373"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id345384"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id345396"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id345407"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id345418"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345430"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id345442"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345453"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id345465"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id345476"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id345488"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id345499"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id345511"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id345522"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id345534"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345545"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id345557"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id345568"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345580"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345592"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345604"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345616"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345628"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345640"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345652"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id345688"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id345700"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id345711"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id345723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345746"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345757"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id345769"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id345780"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id345792"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id345804"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id345815"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id345827"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id345839"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id345850"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id345862"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345873"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id345884"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Install and Configure Idealx smbldap-tools Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p>1254 <a class="indexterm" name="id34 5910"></a>1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id343898"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id343910"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id343921"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id343933"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id343944"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id343956"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id343968"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id343979"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id343991"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id344002"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id344014"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id344025"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id344037"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id344048"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id344060"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344071"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id344083"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id344094"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id344106"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id344118"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id344130"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id344142"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id344154"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id344166"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id344178"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id344214"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id344226"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id344237"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id344249"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344260"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344272"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344283"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id344295"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id344306"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id344318"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id344329"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id344341"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id344353"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id344364"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id344376"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id344387"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344399"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id344410"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Install and Configure Idealx smbldap-tools Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> 1254 <a class="indexterm" name="id344436"></a> 1255 1255 The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts 1256 1256 on the LDAP server. You have chosen the Idealx scripts because they are the best-known … … 1269 1269 The scripts are not needed on BDC machines because all LDAP updates are handled by 1270 1270 the PDC alone. 1271 </p><div class="sect3" title="Installation of smbldap-tools from the Tarball"><div class="titlepage"><div><div><h4 class="title"><a name="id34 5968"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p>1271 </p><div class="sect3" title="Installation of smbldap-tools from the Tarball"><div class="titlepage"><div><div><h4 class="title"><a name="id344495"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> 1272 1272 To perform a manual installation of the smbldap-tools scripts, the following procedure may be used: 1273 1273 </p><div class="procedure" title="Procedure 5.5. Unpacking and Installation Steps for the smbldap-tools Tarball"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> … … 1321 1321 The smbldap-tools scripts are now ready for the configuration step outlined in 1322 1322 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">“Configuration of smbldap-tools”</a>. 1323 </p></li></ol></div></div><div class="sect3" title="Installing smbldap-tools from the RPM Package"><div class="titlepage"><div><div><h4 class="title"><a name="id34 6204"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p>1323 </p></li></ol></div></div><div class="sect3" title="Installing smbldap-tools from the RPM Package"><div class="titlepage"><div><div><h4 class="title"><a name="id344729"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> 1324 1324 In the event that you have elected to use the RPM package provided by Idealx, download the 1325 1325 source RPM <code class="filename">smbldap-tools-0.9.1-1.src.rpm</code>, then follow this procedure: 1326 </p><div class="procedure" title="Procedure 5.6. Installation Steps for smbldap-tools RPM's"><a name="id34 6220"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1326 </p><div class="procedure" title="Procedure 5.6. Installation Steps for smbldap-tools RPM's"><a name="id344745"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1327 1327 Install the source RPM that has been downloaded as follows: 1328 1328 </p><pre class="screen"> … … 1369 1369 The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included 1370 1370 in the <code class="filename">smb.conf</code> file. 1371 </p><div class="procedure" title="Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use"><a name="id34 6402"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1371 </p><div class="procedure" title="Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use"><a name="id344928"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1372 1372 Change into the directory that contains the <code class="filename">configure.pl</code> script. 1373 1373 </p><pre class="screen"> … … 1475 1475 </p></li></ol></div><p> 1476 1476 The smbldap-tools are now ready for use. 1477 </p></div></div><div class="sect2" title="LDAP Initialization and Creation of User and Group Accounts"><div class="titlepage"><div><div><h3 class="title"><a name="id34 6546"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p>1477 </p></div></div><div class="sect2" title="LDAP Initialization and Creation of User and Group Accounts"><div class="titlepage"><div><div><h3 class="title"><a name="id345072"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> 1478 1478 The LDAP database must be populated with well-known Windows domain user accounts and domain group 1479 1479 accounts before Samba can be used. The following procedures step you through the process. … … 1488 1488 Addition of an account to the LDAP backend can be done in two ways: 1489 1489 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1490 <a class="indexterm" name="id34 6574"></a>1491 <a class="indexterm" name="id34 6580"></a>1492 <a class="indexterm" name="id34 6587"></a>1493 <a class="indexterm" name="id34 6594"></a>1494 <a class="indexterm" name="id34 6601"></a>1495 <a class="indexterm" name="id34 6608"></a>1490 <a class="indexterm" name="id345099"></a> 1491 <a class="indexterm" name="id345106"></a> 1492 <a class="indexterm" name="id345113"></a> 1493 <a class="indexterm" name="id345120"></a> 1494 <a class="indexterm" name="id345126"></a> 1495 <a class="indexterm" name="id345133"></a> 1496 1496 If you always have a user account in the <code class="filename">/etc/passwd</code> on every 1497 1497 server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in … … 1511 1511 is included on the enclosed CD-ROM under <code class="filename">Chap06/Tools.</code> 1512 1512 </p></li></ul></div><p> 1513 <a class="indexterm" name="id34 6659"></a>1513 <a class="indexterm" name="id345184"></a> 1514 1514 If you wish to have more control over how the LDAP database is initialized or 1515 1515 if you don't want to use the Idealx smbldap-tools, you should refer to 1516 1516 <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">“Alternative LDAP Database Initialization”</a>. 1517 1517 </p><p> 1518 <a class="indexterm" name="id34 6685"></a>1518 <a class="indexterm" name="id345210"></a> 1519 1519 The following steps initialize the LDAP database, and then you can add user and group 1520 1520 accounts that Samba can use. You use the <code class="literal">smbldap-populate</code> to … … 1522 1522 The list of users does not cover all 500 network users; it provides examples only. 1523 1523 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1524 <a class="indexterm" name="id34 6712"></a>1525 <a class="indexterm" name="id34 6720"></a>1526 <a class="indexterm" name="id34 6730"></a>1524 <a class="indexterm" name="id345236"></a> 1525 <a class="indexterm" name="id345245"></a> 1526 <a class="indexterm" name="id345255"></a> 1527 1527 In the following examples, as the LDAP database is initialized, we do create a container 1528 1528 for Computer (machine) accounts. In the Samba-3 <code class="filename">smb.conf</code> files, specific use is made … … 1601 1601 </pre><p> 1602 1602 </p></li><li class="step" title="Step 6"><p> 1603 <a class="indexterm" name="id34 7108"></a>1603 <a class="indexterm" name="id345631"></a> 1604 1604 So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. 1605 1605 There are several ways you can check that your LDAP database is able to receive IDMAP information. One of … … 1610 1610 ou: idmap 1611 1611 </pre><p> 1612 <a class="indexterm" name="id34 7129"></a>1612 <a class="indexterm" name="id345652"></a> 1613 1613 If the execution of this command does not return IDMAP entries, you need to create an LDIF 1614 1614 template file (see <a class="link" href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 1620 1620 Samba automatically populates this LDAP directory container when it needs to. 1621 1621 </p></li><li class="step" title="Step 7"><p> 1622 <a class="indexterm" name="id34 7164"></a>1622 <a class="indexterm" name="id345688"></a> 1623 1623 It looks like all has gone well, as expected. Let's confirm that this is the case 1624 1624 by running a few tests. First we check the contents of the database directly … … 1658 1658 This looks good so far. 1659 1659 </p></li><li class="step" title="Step 8"><p> 1660 <a class="indexterm" name="id34 7205"></a>1660 <a class="indexterm" name="id345729"></a> 1661 1661 The next step is to prove that the LDAP server is running and responds to a 1662 1662 search request. Execute the following as shown (output has been cut to save space): … … 1703 1703 Good. It is all working just fine. 1704 1704 </p></li><li class="step" title="Step 9"><p> 1705 <a class="indexterm" name="id34 7246"></a>1705 <a class="indexterm" name="id345770"></a> 1706 1706 You must now make certain that the NSS resolver can interrogate LDAP also. 1707 1707 Execute the following commands: … … 1716 1716 Domain Computers:x:553: 1717 1717 </pre><p> 1718 <a class="indexterm" name="id34 7273"></a>1718 <a class="indexterm" name="id345797"></a> 1719 1719 This demonstrates that the <code class="literal">nss_ldap</code> library is functioning 1720 1720 as it should. If these two steps fail to produce this information, refer to … … 1723 1723 have been successfully completed. 1724 1724 </p></li><li class="step" title="Step 10"><p> 1725 <a class="indexterm" name="id34 7301"></a>1726 <a class="indexterm" name="id34 7308"></a>1727 <a class="indexterm" name="id34 7314"></a>1725 <a class="indexterm" name="id345825"></a> 1726 <a class="indexterm" name="id345832"></a> 1727 <a class="indexterm" name="id345838"></a> 1728 1728 Our database is now ready for the addition of network users. For each user for 1729 1729 whom an account must be created, execute the following: … … 1741 1741 where <code class="constant">username</code> is the login ID for each user. 1742 1742 </p></li><li class="step" title="Step 11"><p> 1743 <a class="indexterm" name="id34 7372"></a>1743 <a class="indexterm" name="id345896"></a> 1744 1744 Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the 1745 1745 following: … … 1769 1769 by system tools that make a getentpw() system call. 1770 1770 </p></li><li class="step" title="Step 13"><p> 1771 <a class="indexterm" name="id34 7429"></a>1771 <a class="indexterm" name="id345953"></a> 1772 1772 The root account must have UID=0; if not, this means that operations conducted from 1773 1773 a Windows client using tools such as the Domain User Manager fails under UNIX because … … 1803 1803 This is precisely what we want to see. 1804 1804 </p></li><li class="step" title="Step 16"><p> 1805 <a class="indexterm" name="id34 7517"></a>1806 <a class="indexterm" name="id34 7524"></a>1805 <a class="indexterm" name="id346041"></a> 1806 <a class="indexterm" name="id346048"></a> 1807 1807 The final validation step involves making certain that Samba-3 can obtain the user 1808 1808 accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: … … 1835 1835 This looks good. Of course, you fully expected that it would all work, didn't you? 1836 1836 </p></li><li class="step" title="Step 17"><p> 1837 <a class="indexterm" name="id34 7558"></a>1837 <a class="indexterm" name="id346082"></a> 1838 1838 Now you add the group accounts that are used on the Abmas network. Execute 1839 1839 the following exactly as shown: … … 1846 1846 output is of no concern. 1847 1847 </p></li><li class="step" title="Step 18"><p> 1848 <a class="indexterm" name="id34 7598"></a>1848 <a class="indexterm" name="id346122"></a> 1849 1849 You really do want to confirm that UNIX group resolution from LDAP is functioning 1850 1850 as it should. Let's do this as shown here: … … 1863 1863 as our own site-specific group accounts, are correctly listed. This is looking good. 1864 1864 </p></li><li class="step" title="Step 19"><p> 1865 <a class="indexterm" name="id34 7627"></a>1865 <a class="indexterm" name="id346151"></a> 1866 1866 The final step we need to validate is that Samba can see all the Windows domain groups 1867 1867 and that they are correctly mapped to the respective UNIX group account. To do this, … … 1918 1918 </pre><p> 1919 1919 </p></li><li class="step" title="Step 23"><p> 1920 <a class="indexterm" name="id34 7824"></a>1920 <a class="indexterm" name="id346348"></a> 1921 1921 You may now check Samba-3 operation as follows: 1922 1922 </p><pre class="screen"> … … 1964 1964 The server <code class="constant">MASSIVE</code> is now configured, and it is time to move onto the next task. 1965 1965 </p></div><div class="sect2" title="Printer Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> 1966 <a class="indexterm" name="id34 7908"></a>1966 <a class="indexterm" name="id346432"></a> 1967 1967 The configuration for Samba-3 to enable CUPS raw-print-through printing has already been 1968 1968 taken care of in the <code class="filename">smb.conf</code> file. The only preparation needed for <code class="constant">smart</code> 1969 1969 printing to be possible involves creation of the directories in which Samba-3 stores 1970 1970 Windows printing driver files. 1971 </p><div class="procedure" title="Procedure 5.9. Printer Configuration Steps"><a name="id34 7927"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1971 </p><div class="procedure" title="Procedure 5.9. Printer Configuration Steps"><a name="id346451"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1972 1972 Configure all network-attached printers to have a fixed IP address. 1973 1973 </p></li><li class="step" title="Step 2"><p> … … 1981 1981 to port 9100. Use any other port the manufacturer specifies for direct mode, 1982 1982 raw printing. This allows the CUPS spooler to print using raw mode protocols. 1983 <a class="indexterm" name="id34 7982"></a>1984 <a class="indexterm" name="id34 7989"></a>1983 <a class="indexterm" name="id346506"></a> 1984 <a class="indexterm" name="id346513"></a> 1985 1985 </p></li><li class="step" title="Step 4"><p> 1986 <a class="indexterm" name="id34 8002"></a>1987 <a class="indexterm" name="id34 8009"></a>1986 <a class="indexterm" name="id346526"></a> 1987 <a class="indexterm" name="id346533"></a> 1988 1988 Only on the server to which the printer is attached, configure the CUPS Print 1989 1989 Queues as follows: … … 1992 1992 -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 1993 1993 </pre><p> 1994 <a class="indexterm" name="id34 8043"></a>1994 <a class="indexterm" name="id346567"></a> 1995 1995 This step creates the necessary print queue to use no assigned print filter. This 1996 1996 is ideal for raw printing, that is, printing without use of filters. … … 2012 2012 </pre><p> 2013 2013 </p></li><li class="step" title="Step 7"><p> 2014 <a class="indexterm" name="id34 8117"></a>2015 <a class="indexterm" name="id34 8124"></a>2016 <a class="indexterm" name="id34 8130"></a>2014 <a class="indexterm" name="id346641"></a> 2015 <a class="indexterm" name="id346648"></a> 2016 <a class="indexterm" name="id346654"></a> 2017 2017 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 2018 2018 </p><pre class="screen"> … … 2020 2020 </pre><p> 2021 2021 </p></li><li class="step" title="Step 8"><p> 2022 <a class="indexterm" name="id34 8157"></a>2022 <a class="indexterm" name="id346681"></a> 2023 2023 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 2024 2024 </p><pre class="screen"> … … 2039 2039 <code class="prompt">root# </code> chmod -R ug=rwx,o=rx /var/lib/samba/drivers 2040 2040 </pre><p> 2041 </p></li></ol></div></div></div><div class="sect1" title="Samba-3 BDC Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure" title="Procedure 5.10. Configuration of BDC Called: BLDG1"><a name="id34 8233"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>2041 </p></li></ol></div></div></div><div class="sect1" title="Samba-3 BDC Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure" title="Procedure 5.10. Configuration of BDC Called: BLDG1"><a name="id346757"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2042 2042 Install the files in <a class="link" href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">“LDAP Based smb.conf File, Server: BLDG1”</a>, 2043 2043 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> … … 2082 2082 This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. 2083 2083 </p></li><li class="step" title="Step 5"><p> 2084 <a class="indexterm" name="id34 8380"></a>2084 <a class="indexterm" name="id346904"></a> 2085 2085 The next step in the verification process involves testing the operation of UNIX group 2086 2086 resolution via the NSS LDAP resolver. Execute these commands: … … 2112 2112 is able to communicate correctly with the LDAP server (<code class="constant">MASSIVE</code>). 2113 2113 </p></li><li class="step" title="Step 6"><p> 2114 <a class="indexterm" name="id34 8415"></a>2114 <a class="indexterm" name="id346938"></a> 2115 2115 You must now set the LDAP administrative password into the Samba-3 <code class="filename">secrets.tdb</code> 2116 2116 file by executing this command: … … 2144 2144 This indicates that the domain security account for the BDC has been correctly created. 2145 2145 </p></li><li class="step" title="Step 9"><p> 2146 <a class="indexterm" name="id34 8504"></a>2146 <a class="indexterm" name="id347028"></a> 2147 2147 Verify that user and group account resolution works via Samba-3 tools as follows: 2148 2148 </p><pre class="screen"> … … 2232 2232 </p></li><li class="step" title="Step 2"><p> 2233 2233 Follow carefully the steps shown in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>, starting at step 2. 2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id34 8810"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id348821"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id348832"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id348844"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id348856"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id348867"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id348879"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id348890"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id348902"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id348913"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id348925"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id348936"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id348948"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id348959"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id348971"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id348982"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id348994"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id349006"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349017"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id349028"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id349040"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349052"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349063"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349075"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id349086"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id349098"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349110"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349122"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349133"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349144"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id349156"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id349201"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id349213"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id349224"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id349236"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349247"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349259"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id349270"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id349282"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id349293"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id349305"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id349316"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id349328"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id349339"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id349351"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id349362"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id349374"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id349386"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id349397"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349409"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id349420"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id349432"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349443"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349455"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349466"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id349478"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id349490"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349501"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349513"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349525"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349536"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id349548"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id349592"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id349604"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id349615"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id349635"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id349647"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id349658"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id349679"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id349690"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id349702"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id349722"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id349734"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id349745"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id349757"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id349777"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id349789"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id349800"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349812"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349823"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id349868"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id349879"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id349891"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id349902"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id349922"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id349934"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id349946"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349957"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id349978"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id349989"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id350001"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350012"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id350032"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id350044"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id350056"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350067"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id350088"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id350099"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id350111"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id350122"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id350134"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id350145"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id347334"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id347345"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id347357"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id347368"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id347380"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id347391"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id347403"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id347414"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id347426"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id347438"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id347449"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id347460"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id347472"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id347484"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id347495"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id347507"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id347518"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id347530"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id347541"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id347553"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id347564"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id347576"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id347588"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id347599"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id347611"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id347622"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id347634"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id347646"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id347657"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id347669"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id347680"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id347725"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id347737"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id347748"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id347760"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id347772"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id347783"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id347795"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id347806"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id347818"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id347829"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id347841"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id347852"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id347864"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id347875"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id347887"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id347898"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id347910"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id347921"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id347933"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id347944"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id347956"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id347968"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id347979"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id347991"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id348002"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id348014"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id348026"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id348037"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id348049"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id348060"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id348072"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id348117"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id348128"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id348140"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id348160"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id348172"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id348183"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id348204"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id348215"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id348227"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id348247"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id348259"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id348270"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id348282"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id348302"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id348314"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id348325"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id348337"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id348348"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id348392"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id348404"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id348415"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id348427"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id348447"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id348459"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id348470"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id348482"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id348502"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id348514"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id348525"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id348537"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id348557"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id348569"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id348580"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id348592"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id348612"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id348624"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id348636"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id348647"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id348658"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id348670"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 2235 2235 dn: ou=Idmap,dc=abmas,dc=biz 2236 2236 objectClass: organizationalUnit 2237 2237 ou: idmap 2238 2238 structuralObjectClass: organizationalUnit 2239 </pre></div></div><br class="example-break"></div><div class="sect1" title="Miscellaneous Server Preparation Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 50178"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p>2239 </pre></div></div><br class="example-break"></div><div class="sect1" title="Miscellaneous Server Preparation Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id348703"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> 2240 2240 My father would say, <span class="quote">“<span class="quote">Dinner is not over until the dishes have been done.</span>”</span> 2241 2241 The makings of a great network environment take a lot of effort and attention to detail. … … 2244 2244 a few more steps that must be completed so that your network runs like a well-rehearsed 2245 2245 orchestra. 2246 </p><div class="sect2" title="Configuring Directory Share Point Roots"><div class="titlepage"><div><div><h3 class="title"><a name="id3 50194"></a>Configuring Directory Share Point Roots</h3></div></div></div><p>2246 </p><div class="sect2" title="Configuring Directory Share Point Roots"><div class="titlepage"><div><div><h3 class="title"><a name="id348720"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> 2247 2247 In your <code class="filename">smb.conf</code> file, you have specified Windows shares. Each has a <em class="parameter"><code>path</code></em> 2248 2248 parameter. Even though it is obvious to all, one of the common Samba networking problems is … … 2262 2262 <code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps 2263 2263 </pre><p> 2264 </p></div><div class="sect2" title="Configuring Profile Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id3 50283"></a>Configuring Profile Directories</h3></div></div></div><p>2264 </p></div><div class="sect2" title="Configuring Profile Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id348809"></a>Configuring Profile Directories</h3></div></div></div><p> 2265 2265 You made a conscious decision to do everything it would take to improve network client 2266 2266 performance. One of your decisions was to implement folder redirection. This means that Windows … … 2287 2287 </pre><p> 2288 2288 </p><p> 2289 <a class="indexterm" name="id3 50393"></a>2290 <a class="indexterm" name="id3 50399"></a>2289 <a class="indexterm" name="id348918"></a> 2290 <a class="indexterm" name="id348925"></a> 2291 2291 You have three options insofar as the dynamically loaded portion of the roaming profile 2292 2292 is concerned: … … 2296 2296 that is, just by changing the filename extension. 2297 2297 </p><p> 2298 <a class="indexterm" name="id3 50445"></a>2299 <a class="indexterm" name="id3 50452"></a>2298 <a class="indexterm" name="id348970"></a> 2299 <a class="indexterm" name="id348977"></a> 2300 2300 The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. 2301 2301 You can manage this using the Idealx smbldap-tools or using the … … 2310 2310 <code class="prompt">root# </code> chmod 700 /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> 2311 2311 </pre><p> 2312 </p></div><div class="sect2" title="Preparation of Logon Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="id3 50512"></a>Preparation of Logon Scripts</h3></div></div></div><p>2313 <a class="indexterm" name="id3 50519"></a>2312 </p></div><div class="sect2" title="Preparation of Logon Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="id349037"></a>Preparation of Logon Scripts</h3></div></div></div><p> 2313 <a class="indexterm" name="id349045"></a> 2314 2314 The use of a logon script with Windows XP Professional is an option that every site should consider. 2315 2315 Unless you have locked down the desktop so the user cannot change anything, there is risk that … … 2336 2336 Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon 2337 2337 facilities in use today is called <a class="ulink" href="http://www.kixtart.org" target="_top">KiXtart</a>. 2338 </p></div><div class="sect2" title="Assigning User Rights and Privileges"><div class="titlepage"><div><div><h3 class="title"><a name="id3 50609"></a>Assigning User Rights and Privileges</h3></div></div></div><p>2338 </p></div><div class="sect2" title="Assigning User Rights and Privileges"><div class="titlepage"><div><div><h3 class="title"><a name="id349135"></a>Assigning User Rights and Privileges</h3></div></div></div><p> 2339 2339 The ability to perform tasks such as joining Windows clients to the domain can be assigned to 2340 2340 normal user accounts. By default, only the domain administrator account (<code class="constant">root</code> on UNIX … … 2348 2348 are granted rights can be restricted to particular machines. It is left to the network administrator 2349 2349 to determine which rights should be provided and to whom. 2350 </p><div class="procedure" title="Procedure 5.12. Steps for Assignment of User Rights and Privileges"><a name="id3 50638"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>2350 </p><div class="procedure" title="Procedure 5.12. Steps for Assignment of User Rights and Privileges"><a name="id349164"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2351 2351 Log onto the PDC as the <code class="constant">root</code> account. 2352 2352 </p></li><li class="step" title="Step 2"><p> … … 2406 2406 SeDiskOperatorPrivilege 2407 2407 </pre><p> 2408 </p></li></ol></div></div></div><div class="sect1" title="Windows Client Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 50723"></a>Windows Client Configuration</h2></div></div></div><p>2409 <a class="indexterm" name="id3 50731"></a>2408 </p></li></ol></div></div></div><div class="sect1" title="Windows Client Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id349248"></a>Windows Client Configuration</h2></div></div></div><p> 2409 <a class="indexterm" name="id349256"></a> 2410 2410 In the next few sections, you can configure a new Windows XP Professional disk image on a staging 2411 2411 machine. You will configure all software, printer settings, profile and policy handling, and desktop … … 2420 2420 2421 2421 </p><div class="sect2" title="Configuration of Default Profile with Folder Redirection"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> 2422 <a class="indexterm" name="id3 50774"></a>2422 <a class="indexterm" name="id349299"></a> 2423 2423 Log onto the Windows XP Professional workstation as the local <code class="constant">Administrator</code>. 2424 2424 It is necessary to expose folders that are generally hidden to provide access to the 2425 2425 <code class="constant">Default User</code> folder. 2426 </p><div class="procedure" title="Procedure 5.13. Expose Hidden Folders"><a name="id3 50791"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>2426 </p><div class="procedure" title="Procedure 5.13. Expose Hidden Folders"><a name="id349316"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2427 2427 Launch the Windows Explorer by clicking 2428 2428 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. … … 2430 2430 and click <span class="guibutton">OK</span>. Exit Windows Explorer. 2431 2431 </p></li><li class="step" title="Step 2"><p> 2432 <a class="indexterm" name="id3 50856"></a>2432 <a class="indexterm" name="id349380"></a> 2433 2433 Launch the Registry Editor. Click 2434 2434 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. Key in <code class="literal">regedt32</code>, and click … … 2436 2436 </p></li></ol></div><p> 2437 2437 </p><div class="procedure" title="Procedure 5.14. Redirect Folders in Default System User Profile"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2438 <a class="indexterm" name="id3 50912"></a>2439 <a class="indexterm" name="id3 50919"></a>2438 <a class="indexterm" name="id349437"></a> 2439 <a class="indexterm" name="id349443"></a> 2440 2440 Give focus to <code class="constant">HKEY_LOCAL_MACHINE</code> hive entry in the left panel. 2441 2441 Click <span class="guimenu">File</span> → <span class="guimenuitem">Load Hive...</span> → <span class="guimenuitem">Documents and Settings</span> → <span class="guimenuitem">Default User</span> → <span class="guimenuitem">NTUSER</span> → <span class="guimenuitem">Open</span>. In the dialog box that opens, enter the key name … … 2449 2449 The right panel reveals the contents as shown in <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 2450 2450 </p></li><li class="step" title="Step 3"><p> 2451 <a class="indexterm" name="id3 51008"></a>2452 <a class="indexterm" name="id3 51015"></a>2451 <a class="indexterm" name="id349532"></a> 2452 <a class="indexterm" name="id349539"></a> 2453 2453 You edit hive keys. Acceptable values to replace the 2454 2454 <code class="constant">%USERPROFILE%</code> variable includes: … … 2457 2457 <code class="constant">\\MASSIVE\profdata</code></p></li><li class="listitem"><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> 2458 2458 </p></li><li class="step" title="Step 4"><p> 2459 <a class="indexterm" name="id3 51059"></a>2459 <a class="indexterm" name="id349583"></a> 2460 2460 Set the registry keys as shown in <a class="link" href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">“Default Profile Redirections”</a>. Your implementation makes the assumption 2461 2461 that users have statically located machines. Notebook computers (mobile users) need to be … … 2465 2465 Click <span class="guimenu">File</span> → <span class="guimenuitem">Unload Hive...</span> → <span class="guimenuitem">Yes</span>. 2466 2466 </p></li><li class="step" title="Step 6"><p> 2467 <a class="indexterm" name="id3 51112"></a>2467 <a class="indexterm" name="id349636"></a> 2468 2468 Click <span class="guimenu">File</span> → <span class="guimenuitem">Exit</span>. This exits the 2469 2469 Registry Editor. … … 2472 2472 have redirected is in the exclusion list. 2473 2473 </p></li><li class="step" title="Step 8"><p> 2474 You are now ready to copy<sup>[<a name="id3 51153" href="#ftn.id351153" class="footnote">11</a>]</sup>2474 You are now ready to copy<sup>[<a name="id349677" href="#ftn.id349677" class="footnote">11</a>]</sup> 2475 2475 the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, 2476 2476 and use it to copy the full contents of the directory <code class="filename">Default User</code> that … … 2483 2483 desktop behavior should be returned to the original Microsoft settings. The following steps achieve 2484 2484 that ojective: 2485 </p><div class="procedure" title="Procedure 5.15. Reset Folder Display to Original Behavior"><a name="id3 51213"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul class="procedure"><li class="step" title="Step 1"><p>2485 </p><div class="procedure" title="Procedure 5.15. Reset Folder Display to Original Behavior"><a name="id349737"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul class="procedure"><li class="step" title="Step 1"><p> 2486 2486 To launch the Windows Explorer, click 2487 2487 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. 2488 2488 Deselect <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. 2489 2489 Exit Windows Explorer. 2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Configuration of MS Outlook to Relocate PST File"><div class="titlepage"><div><div><h3 class="title"><a name="id3 51441"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p>2491 <a class="indexterm" name="id3 51449"></a>2492 <a class="indexterm" name="id3 51458"></a>2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Configuration of MS Outlook to Relocate PST File"><div class="titlepage"><div><div><h3 class="title"><a name="id349965"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> 2491 <a class="indexterm" name="id349973"></a> 2492 <a class="indexterm" name="id349982"></a> 2493 2493 Microsoft Outlook can store a Personal Storage file, generally known as a PST file. 2494 2494 It is the nature of email storage that this file grows, at times quite rapidly. … … 2499 2499 To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave 2500 2500 slightly differently), follow these steps: 2501 </p><div class="procedure" title="Procedure 5.16. Outlook PST File Relocation"><a name="id35 1476"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>2501 </p><div class="procedure" title="Procedure 5.16. Outlook PST File Relocation"><a name="id350000"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2502 2502 Close Outlook if it is open. 2503 2503 </p></li><li class="step" title="Step 2"><p> … … 2529 2529 Go back to the <span class="guimenu">Data Files</span> window, then delete the old data file entry. 2530 2530 </p></li></ol></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2531 <a class="indexterm" name="id35 1615"></a>2531 <a class="indexterm" name="id350139"></a> 2532 2532 You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise 2533 2533 the user may be not be able to retrieve contacts when addressing a new email message. 2534 2534 </p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2535 <a class="indexterm" name="id35 1628"></a>2535 <a class="indexterm" name="id350152"></a> 2536 2536 Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook 2537 2537 Express storage files can not be redirected to network shares. The options panel will not permit … … 2542 2542 registry, experience has shown that data corruption and loss of email messages will result. 2543 2543 </p><p> 2544 <a class="indexterm" name="id35 1646"></a>2545 <a class="indexterm" name="id35 1653"></a>2544 <a class="indexterm" name="id350170"></a> 2545 <a class="indexterm" name="id350177"></a> 2546 2546 In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with 2547 2547 roaming profiles this can result in excruciatingly long login and logout behavior will files are … … 2549 2549 profiles are used. 2550 2550 </p></div><p> 2551 <a class="indexterm" name="id35 1665"></a>2551 <a class="indexterm" name="id350190"></a> 2552 2552 Microsoft does not support storing PST files on network shares, although the practice does appear 2553 2553 to be rather popular. Anyone who does relocation the PST file to a network resource should refer … … 2555 2555 understand the issues. 2556 2556 </p><p> 2557 <a class="indexterm" name="id35 1684"></a>2557 <a class="indexterm" name="id350208"></a> 2558 2558 Apart from manually moving PST files to a network share, it is possible to set the default PST 2559 2559 location for new accounts by following the instructions at the WindowsITPro <a class="ulink" href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site. 2560 2560 </p><p> 2561 <a class="indexterm" name="id35 1701"></a>2561 <a class="indexterm" name="id350226"></a> 2562 2562 User feedback suggests that disabling of oplocks on PST files will significantly improve 2563 2563 network performance by reducing locking overheads. One way this can be done is to add to the … … 2566 2566 veto oplock files = /*.pdf/*.PST/ 2567 2567 </pre><p> 2568 </p></div><div class="sect2" title="Configure Delete Cached Profiles on Logout"><div class="titlepage"><div><div><h3 class="title"><a name="id35 1724"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p>2568 </p></div><div class="sect2" title="Configure Delete Cached Profiles on Logout"><div class="titlepage"><div><div><h3 class="title"><a name="id350249"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> 2569 2569 Configure the Windows XP Professional client to auto-delete roaming profiles on logout: 2570 2570 </p><p> 2571 <a class="indexterm" name="id35 1736"></a>2571 <a class="indexterm" name="id350261"></a> 2572 2572 Click 2573 2573 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. In the dialog box, enter <code class="literal">MMC</code> and click <span class="guibutton">OK</span>. … … 2577 2577 <span class="guimenu">File</span> → <span class="guimenuitem">Add/Remove Snap-in</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Group Policy</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Finish</span> → <span class="guimenuitem">Close</span> → <span class="guimenuitem">OK</span>. 2578 2578 </p><p> 2579 <a class="indexterm" name="id35 1830"></a>2579 <a class="indexterm" name="id350355"></a> 2580 2580 The Microsoft Management Console now shows the <span class="guimenu">Group Policy</span> 2581 2581 utility that enables you to set the policies needed. In the left panel, click … … 2585 2585 Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies 2586 2586 made of this system to deploy the new standard desktop system. 2587 </p></div><div class="sect2" title="Uploading Printer Drivers to Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id35 1896"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p>2588 <a class="indexterm" name="id35 1904"></a>2587 </p></div><div class="sect2" title="Uploading Printer Drivers to Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id350420"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> 2588 <a class="indexterm" name="id350428"></a> 2589 2589 Users want to be able to use network printers. You have a vested interest in making 2590 2590 it easy for them to print. You have chosen to install the printer drivers onto the Samba … … 2593 2593 print to the printer chosen. The following procedure must be followed for every network 2594 2594 printer: 2595 </p><div class="procedure" title="Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers"><a name="id35 1918"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>2595 </p><div class="procedure" title="Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers"><a name="id350443"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2596 2596 Join your Windows XP Professional workstation (the staging machine) to the 2597 2597 <code class="constant">MEGANET2</code> domain. If you are not sure of the procedure, … … 2618 2618 button that is next to the <span class="guimenu">Driver</span> box. This launches the <span class="quote">“<span class="quote">Add Printer Wizard</span>”</span>. 2619 2619 </p></li><li class="step" title="Step 6"><p> 2620 <a class="indexterm" name="id35 2097"></a>2621 <a class="indexterm" name="id35 2106"></a>2620 <a class="indexterm" name="id350622"></a> 2621 <a class="indexterm" name="id350631"></a> 2622 2622 The <span class="quote">“<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>”</span> panel 2623 2623 is now presented. Click <span class="guimenu">Next</span> to continue. From the left panel, select the … … 2628 2628 directed at the network server <code class="constant">\\massive\ps01-color</code>. 2629 2629 </p></li><li class="step" title="Step 7"><p> 2630 <a class="indexterm" name="id35 2150"></a>2631 <a class="indexterm" name="id35 2160"></a>2632 <a class="indexterm" name="id35 2169"></a>2633 <a class="indexterm" name="id35 2178"></a>2634 <a class="indexterm" name="id35 2187"></a>2635 <a class="indexterm" name="id35 2196"></a>2630 <a class="indexterm" name="id350675"></a> 2631 <a class="indexterm" name="id350685"></a> 2632 <a class="indexterm" name="id350694"></a> 2633 <a class="indexterm" name="id350703"></a> 2634 <a class="indexterm" name="id350712"></a> 2635 <a class="indexterm" name="id350721"></a> 2636 2636 The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, 2637 2637 you are returned to the <span class="guimenu">Advanced</span> tab in the <span class="guimenu">Properties</span> panel. … … 2642 2642 (Applicable to Active Directory use only.) 2643 2643 </p></li><li class="step" title="Step 8"><p> 2644 <a class="indexterm" name="id35 2247"></a>2644 <a class="indexterm" name="id350772"></a> 2645 2645 Click <span class="guimenu">OK</span>. It will take a minute or so to upload the settings to the server. 2646 2646 You are now returned to the <span class="guimenu">Printers and Faxes on Massive</span> monitor. … … 2654 2654 click <span class="guimenu">Apply</span> again. 2655 2655 </p></li><li class="step" title="Step 10"><p> 2656 <a class="indexterm" name="id35 2314"></a>2656 <a class="indexterm" name="id350840"></a> 2657 2657 Verify that all printer settings are at the desired configuration. When you are satisfied that they are, 2658 2658 click the <span class="guimenu">General</span> tab. Now click the <span class="guimenu">Print Test Page</span> button. … … 2664 2664 When you have finished uploading drivers to all printers, close all applications. The next task 2665 2665 is to install software your users require to do their work. 2666 </p></li></ol></div></div><div class="sect2" title="Software Installation"><div class="titlepage"><div><div><h3 class="title"><a name="id35 2365"></a>Software Installation</h3></div></div></div><p>2666 </p></li></ol></div></div><div class="sect2" title="Software Installation"><div class="titlepage"><div><div><h3 class="title"><a name="id350890"></a>Software Installation</h3></div></div></div><p> 2667 2667 Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is 2668 2668 a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. … … 2679 2679 and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in 2680 2680 case a user may have specific needs you had not anticipated. 2681 </p></div><div class="sect2" title="Roll-out Image Creation"><div class="titlepage"><div><div><h3 class="title"><a name="id35 2391"></a>Roll-out Image Creation</h3></div></div></div><p>2681 </p></div><div class="sect2" title="Roll-out Image Creation"><div class="titlepage"><div><div><h3 class="title"><a name="id350916"></a>Roll-out Image Creation</h3></div></div></div><p> 2682 2682 The final steps before preparing the distribution Norton Ghost image file you might follow are: 2683 2683 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 2688 2688 in better performance and often significantly reduces the size of the compressed disk image. That 2689 2689 also means it will take less time to deploy the image onto 500 workstations. 2690 </p></blockquote></div></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 2420"></a>Key Points Learned</h2></div></div></div><p>2690 </p></blockquote></div></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id350946"></a>Key Points Learned</h2></div></div></div><p> 2691 2691 This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately 2692 2692 avoided any consideration of security. Security does not just happen; you must design it into your total … … 2697 2697 of compromise. 2698 2698 </p><p> 2699 <a class="indexterm" name="id35 2437"></a>2700 <a class="indexterm" name="id35 2445"></a>2699 <a class="indexterm" name="id350962"></a> 2700 <a class="indexterm" name="id350971"></a> 2701 2701 As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be 2702 2702 configured to use secure protocols for all communications over the network. Of course, secure networking … … 2725 2725 </p></li><li class="listitem"><p> 2726 2726 Use of the CUPS printing system together with Samba-based printer driver auto-download. 2727 </p></li></ul></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 2508"></a>Questions and Answers</h2></div></div></div><p>2727 </p></li></ul></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id351033"></a>Questions and Answers</h2></div></div></div><p> 2728 2728 Well, here we are at the end of this chapter and we have only ten questions to help you to 2729 2729 remember so much. There are bound to be some sticky issues here. 2730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id35 2518"></a><dl><dt> <a href="happy.html#id352525">2730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id351044"></a><dl><dt> <a href="happy.html#id351050"> 2731 2731 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2732 2732 network administrators to implement insecure solutions? 2733 </a></dt><dt> <a href="happy.html#id35 2558">2733 </a></dt><dt> <a href="happy.html#id351084"> 2734 2734 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2735 2735 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant 2736 2736 to the Linux I might be using? 2737 </a></dt><dt> <a href="happy.html#id35 2600">2737 </a></dt><dt> <a href="happy.html#id351126"> 2738 2738 You did not use SWAT to configure Samba. Is there something wrong with it? 2739 </a></dt><dt> <a href="happy.html#id35 2635">2739 </a></dt><dt> <a href="happy.html#id351160"> 2740 2740 You have exposed a well-used password not24get. Is that 2741 2741 not irresponsible? 2742 </a></dt><dt> <a href="happy.html#id35 2657">2742 </a></dt><dt> <a href="happy.html#id351183"> 2743 2743 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2744 2744 a good thing? 2745 </a></dt><dt> <a href="happy.html#id35 2681">2745 </a></dt><dt> <a href="happy.html#id351206"> 2746 2746 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2747 </a></dt><dt> <a href="happy.html#id35 2701">2747 </a></dt><dt> <a href="happy.html#id351227"> 2748 2748 Why are the Windows domain RID portions not the same as the UNIX UID? 2749 </a></dt><dt> <a href="happy.html#id35 2732">2749 </a></dt><dt> <a href="happy.html#id351258"> 2750 2750 Printer configuration examples all show printing to the HP port 9100. Does this 2751 2751 mean that I must have HP printers for these solutions to work? 2752 </a></dt><dt> <a href="happy.html#id35 2757">2752 </a></dt><dt> <a href="happy.html#id351282"> 2753 2753 Is folder redirection dangerous? I've heard that you can lose your data that way. 2754 </a></dt><dt> <a href="happy.html#id35 2779">2754 </a></dt><dt> <a href="happy.html#id351304"> 2755 2755 Is it really necessary to set a local Group Policy to exclude the redirected 2756 2756 folders from the roaming profile? 2757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id35 2525"></a><a name="id352527"></a></td><td align="left" valign="top"><p>2757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id351050"></a><a name="id351052"></a></td><td align="left" valign="top"><p> 2758 2758 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2759 2759 network administrators to implement insecure solutions? … … 2774 2774 that you should implement a network without provision for data recovery and for disaster 2775 2775 management? Back to our focus: The deployment of Samba has been clearly demonstrated. 2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2558"></a><a name="id352561"></a></td><td align="left" valign="top"><p>2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351084"></a><a name="id351086"></a></td><td align="left" valign="top"><p> 2777 2777 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2778 2778 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant … … 2801 2801 features of both products (companies also). No bias in presentation is intended. 2802 2802 Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. 2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2600"></a><a name="id352603"></a></td><td align="left" valign="top"><p>2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351126"></a><a name="id351128"></a></td><td align="left" valign="top"><p> 2804 2804 You did not use SWAT to configure Samba. Is there something wrong with it? 2805 2805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2812 2812 and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I 2813 2813 hope to have brought their interests on board. SWAT is well covered is <span class="emphasis"><em>TOSHARG2</em></span>. 2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2635"></a><a name="id352637"></a></td><td align="left" valign="top"><p>2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351160"></a><a name="id351162"></a></td><td align="left" valign="top"><p> 2815 2815 You have exposed a well-used password <span class="emphasis"><em>not24get</em></span>. Is that 2816 2816 not irresponsible? … … 2819 2819 used throughout. I guess you can figure out that in a real deployment it would make 2820 2820 sense to use a more secure and original password. 2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2657"></a><a name="id352660"></a></td><td align="left" valign="top"><p>2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351183"></a><a name="id351185"></a></td><td align="left" valign="top"><p> 2822 2822 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2823 2823 a good thing? … … 2827 2827 and, besides, it does no harm to create accounts that are not now used at some time 2828 2828 Samba may well use them. 2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2681"></a><a name="id352683"></a></td><td align="left" valign="top"><p>2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351206"></a><a name="id351208"></a></td><td align="left" valign="top"><p> 2830 2830 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2831 2831 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2835 2835 password files in sync? I think that having everything in LDAP makes a lot of sense 2836 2836 for the UNIX administrator who is still learning the craft and is migrating from MS Windows. 2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2701"></a><a name="id352703"></a></td><td align="left" valign="top"><p>2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351227"></a><a name="id351229"></a></td><td align="left" valign="top"><p> 2838 2838 Why are the Windows domain RID portions not the same as the UNIX UID? 2839 2839 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2844 2844 permit you to override that to some extent. See the <code class="filename">smb.conf</code> man page entry 2845 2845 for <em class="parameter"><code>algorithmic rid base</code></em>. 2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2732"></a><a name="id352735"></a></td><td align="left" valign="top"><p>2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351258"></a><a name="id351260"></a></td><td align="left" valign="top"><p> 2847 2847 Printer configuration examples all show printing to the HP port 9100. Does this 2848 2848 mean that I must have HP printers for these solutions to work? … … 2854 2854 argument to the <code class="constant">lpadmin -v</code> option that is right for your 2855 2855 printer. 2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2757"></a><a name="id352759"></a></td><td align="left" valign="top"><p>2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351282"></a><a name="id351284"></a></td><td align="left" valign="top"><p> 2857 2857 Is folder redirection dangerous? I've heard that you can lose your data that way. 2858 2858 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2864 2864 folder. That was not the case, so by declining to move the data back, he wiped out 2865 2865 the data. You cannot hold the tool responsible for that. Caveat emptor still applies. 2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 2779"></a><a name="id352781"></a></td><td align="left" valign="top"><p>2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id351304"></a><a name="id351306"></a></td><td align="left" valign="top"><p> 2867 2867 Is it really necessary to set a local Group Policy to exclude the redirected 2868 2868 folders from the roaming profile? … … 2870 2870 Yes. If you do not do this, the data will still be copied from the network folder 2871 2871 (share) to the local cached copy of the profile. 2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 51153" href="#id351153" class="para">11</a>] </sup>2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id349677" href="#id349677" class="para">11</a>] </sup> 2873 2873 There is an alternate method by which a default user profile can be added to the 2874 2874 <code class="constant">NETLOGON</code> share. This facility in the Windows System tool -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/index.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" title="Samba-3 by Example"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id 280658">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id280788">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id280825">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280643">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id322292">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id322341">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id322920">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id323089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id330143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id357946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id366117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id373183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id377126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id382225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id384815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id390627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" title="Samba-3 by Example"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id314105">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id281184">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id281221">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280852">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id320789">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id320838">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id321418">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id321589">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id321619">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id321657">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id322302">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id325424">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id325808">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325825">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id325871">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325916">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id326088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id326106">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327557">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id328132">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id328152">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id328216">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id328642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328676">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id328885">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328897">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id329242">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id329275">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330030">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id334042">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id334095">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id334536">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334566">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334641">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id334670">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id334846">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id334866">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335580">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336096">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id339071">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id339124">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id339991">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340067">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id340195">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id340598">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342251">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id342264">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id342434">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id348703">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id348720">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id348809">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id349037">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id349135">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id349248">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id350249">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id350890">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id350916">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350946">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id351033">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id351371">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351396">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id351452">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351698">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id352520">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352534">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id355551">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id355690">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id356470">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356518">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id356547">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id357171">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id357255">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363529">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id363573">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id364642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id364726">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id365940">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366596">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id366712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366809">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366993">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367371">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id367517">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367593">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367644">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367806">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id368109">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id368129">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370790">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id370824">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id371710">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371809">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id371886">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371958">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id372125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id372134">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id375655">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376238">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id376252">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376618">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378100">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378435">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378992">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379357">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380041">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id380163">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id380752">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380775">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id380865">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380894">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id381040">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id381058">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382809">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382864">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id383342">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id383418">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id383870">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id383895">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id384336">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id384636">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id384704">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id384766">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id384858">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id384991">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id385073">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id385222">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id385420">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386084">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386477">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id386779">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386790">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386834">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id386933">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id386988">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id387443">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388364">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388795">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388933">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id389009">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id389151">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id389288">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389338">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id389445">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389558">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id390654">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id391645">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391746">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 2 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id39 3828">A.3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id392352">A. 4 4 Preamble 5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3937">A.5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392460">A. 6 6 TERMS AND CONDITIONS 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 3940">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392464">A. 8 8 0. Definitions. 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4004">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392528">A. 10 10 1. Source Code. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4066">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392590">A. 12 12 2. Basic Permissions. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4094">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392617">A. 14 14 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4116">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392639">A. 16 16 4. Conveying Verbatim Copies. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4135">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392659">A. 18 18 5. Conveying Modified Source Versions. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4207">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392731">A. 20 20 6. Conveying Non-Source Forms. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4339">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392863">A. 22 22 7. Additional Terms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4444">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id392969">A. 24 24 8. Termination. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4476">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393000">A. 26 26 9. Acceptance Not Required for Having Copies. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4495">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393019">A. 28 28 10. Automatic Licensing of Downstream Recipients. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4529">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393053">A. 30 30 11. Patents. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4618">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393142">A. 32 32 12. No Surrender of Others’ Freedom. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4633">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393158">A. 34 34 13. Use with the ???TITLE??? Affero General Public License. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4657">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393181">A. 36 36 14. Revised Versions of this License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4704">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393229">A. 38 38 15. Disclaimer of Warranty. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4722">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393246">A. 40 40 16. Limitation of Liability. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4736">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393261">A. 42 42 17. Interpretation of Sections 15 and 16. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4749">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393273">A. 44 44 END OF TERMS AND CONDITIONS 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id39 4752">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393277">A. 46 46 How to Apply These Terms to Your New Programs 47 47 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="net2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="net2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="net2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="net2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="net2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="net2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="net2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the <code class="literal">net rpc vampire</code> Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: <code class="constant">MEGANET</code>, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office <code class="filename">smb.conf</code> File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office <code class="filename">smb.conf</code> New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office <code class="filename">smb.conf</code> Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="net2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.2. <a href="net2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.3. <a href="net2000users.html#ch7-massmbconfA">Primary Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.4. <a href="net2000users.html#ch7-massmbconfB">Primary Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>6.5. <a href="net2000users.html#ch7-massmbconfC">Primary Domain Controller <code class="filename">smb.conf</code> File Part C</a></dt><dt>6.6. <a href="net2000users.html#ch7-slvsmbocnfA">Backup Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.7. <a href="net2000users.html#ch7-slvsmbocnfB">Backup Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain <code class="filename">smb.conf</code> File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM <code class="filename">login</code> Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM <code class="filename">xdm</code> Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: <code class="filename">/etc/pam.d/system-auth</code> Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File <code class="filename">/etc/security/pam_unix2.conf</code></a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List <code class="filename">/root/excludes.txt</code></a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: <code class="filename">/etc/krb5.conf</code></a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: <code class="filename">/var/lib/named/localhost.zone</code></a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: <code class="filename">/var/lib/named/127.0.0.zone</code></a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: <code class="filename">/var/lib/named/root.hint</code></a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File <code class="filename">config.cfg</code></a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File <code class="filename">lam.conf</code></a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/ix01.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index" title="Index"><div class="titlepage"><div><div><h2 class="title"><a name="id39 5334"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id342818">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id336338">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id352420">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id357994">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id383905">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id386548">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="net2000users.html#id353212">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id384815">Introduction</a>, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id341463">Introduction</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id323158">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id373282">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id368664">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358731">Implementation</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id357946">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id357946">Introduction</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358731">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id390920">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id323158">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id323219">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381156">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id335012">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id393223">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id343123">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id352846">Introduction</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id357946">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id391158">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id350512">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id327371">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="net2000users.html#id353175">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id327606">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id366964">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366964">Change of hostname</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id342906">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id350723">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id390763">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id341463">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id336113">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id373183">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#id342906">Using a Network Default User Profile</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id393094">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id330742">Political Issues</a>, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381156">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id373183">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id336038">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id384815">Introduction</a>, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id368384">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id323158">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a>, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>routers, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>scalable, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id368069">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id325807">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id364460">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367023">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id383905">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id366117">Introduction</a>, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id366117">Introduction</a>, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>VPN, <a class="indexterm" href="net2000users.html#id352871">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id358022">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368384">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id327326">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id390920">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367023">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index" title="Index"><div class="titlepage"><div><div><h2 class="title"><a name="id393859"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id341344">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id321762">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id341816">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id326106">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id341816">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id341816">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id321762">Implementation</a>, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id334866">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id382178">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id322563">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id350946">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id388933">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id388933">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id356518">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id382434">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id364642">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id367371">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id385073">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382178">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id382809">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="net2000users.html#id351735">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id329122">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342434">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id355551">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id366712">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id366712">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id384083">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id389683">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="primer.html#id389338">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id389009">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id321762">Implementation</a>, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id389683">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id383342">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id383342">Introduction</a>, <a class="indexterm" href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id385420">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id339991">Introduction</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id364642">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id321657">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id366712">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id371809">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id385420">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="small.html#id328152">Key Points Learned</a>, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id388933">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id341344">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="small.html#id328152">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id326106">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id328897">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id357171">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="HA.html#id384766">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id384083">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id325916">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id325916">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id367193">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id328152">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id357255">Implementation</a>, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id386988">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id356470">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id356470">Introduction</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id357255">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id348809">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id364642">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id328897">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id389683">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id389445">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id325916">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id388795">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id383870">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id321657">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id389009">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id321719">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id342434">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id321762">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id389009">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id384766">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id364642">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id379683">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id364726">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id364726">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id333541">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id391746">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id389338">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id390308">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id357171">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id328897">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id381058">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#id341649">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id351371">Introduction</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="net2000users.html#id355551">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id367593">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id366838">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id366838">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id367593">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id386988">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id356470">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id389683">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id390308">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id328897">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id341816">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#id349037">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id368129">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id357171">Political Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#id348809">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id329122">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id367517">Introduction</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id350249">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id325871">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="net2000users.html#id351698">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id388795">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id381058">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id384766">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id388795">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id322563">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="primer.html#id389338">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id326106">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id328897">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id384083">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id365491">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id365491">Change of hostname</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id341432">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id349248">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id321762">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id389338">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id389288">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id389151">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id339991">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id389151">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id389338">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id334641">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id329122">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id357171">Political Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id371710">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id382178">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id382809">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a>, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id341344">Profile Changes</a>, <a class="indexterm" href="happy.html#id341432">Using a Network Default User Profile</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id390873">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id391618">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id357171">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id389009">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id388933">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id329242">Political Issues</a>, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id379683">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id321762">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id366712">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id366838">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id367593">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id322563">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id390654">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id371710">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id334566">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id368129">Implementation</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id383342">Introduction</a>, <a class="indexterm" href="HA.html#id384246">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id378849">Override Controls</a>, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id368129">Implementation</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id379357">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id364642">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id322302">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id322302">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id350420">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id366912">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id389151">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id349965">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id329122">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id341486">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id362164">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id388795">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id321657">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id342434">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id322563">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id341344">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id383870">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="HA.html#id383905">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id348809">Configuring Profile Directories</a>, <a class="indexterm" href="net2000users.html#id351735">User Needs</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="happy.html#id341073">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id326106">Implementation</a></dt><dt>routers, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id321762">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id321762">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id383342">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id383342">Introduction</a></dt><dt>scalable, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id362716">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366596">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id366838">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id324306">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379406">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id382809">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id390654">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id390654">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id362988">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id378435">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id378100">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id361596">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id365549">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id386988">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id379357">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id341816">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id384858">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id345072">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id383418">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id367644">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id382434">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="happy.html#id348809">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id321762">Implementation</a>, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id326106">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id329122">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id322302">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id381058">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342434">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381058">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id381292">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id384721">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="net2000users.html#id351735">User Needs</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id328897">Technical Issues</a>, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id340067">Assignment Tasks</a>, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id366838">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id367806">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id384336">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id340195">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id322563">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id379357">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id371886">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id390654">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id322394">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id339866">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id340598">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id377804">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id387443">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id385420">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id364642">Introduction</a>, <a class="indexterm" href="upgrades.html#id364726">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id364642">Introduction</a>, <a class="indexterm" href="upgrades.html#id364726">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id368129">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id385222">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id329275">Implementation</a>, <a class="indexterm" href="primer.html#id390654">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id336107">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#id330030">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id335580">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id365792">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id370824">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id376252">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id366712">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id386084">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>VPN, <a class="indexterm" href="net2000users.html#id351396">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id380775">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id382809">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id382809">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id366596">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id371958">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="net2000users.html#id351735">User Needs</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id355551">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id384636">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id384817">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="net2000users.html#id352534">Implementation</a>, <a class="indexterm" href="unixclients.html#id356547">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id375655">Introduction</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id380894">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id382178">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id376618">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380041">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id378564">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id327557">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id366912">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id381656">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id386477">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id356570">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id379357">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id380163">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id340598">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id379845">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id372194">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id375655">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id325825">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id322563">Implementation</a>, <a class="indexterm" href="small.html#id325916">Technical Issues</a>, <a class="indexterm" href="small.html#id326106">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id334670">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id351811">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id363573">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id384083">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="net2000users.html#id355690">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id329275">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id367004">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id389151">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id389445">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id378992">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id321762">Implementation</a>, <a class="indexterm" href="upgrades.html#id364816">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id365549">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id390308">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id357255">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id382864">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id389009">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="net2000users.html#id351452">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="net2000users.html#id352534">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="net2000users.html#id352108">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/kerberos.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 11. Active Directory, Kerberos, and Security"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id37 7126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id377075"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 11. Active Directory, Kerberos, and Security"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id375655">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376238">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id376252">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id376618">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378100">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378435">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id378992">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379357">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380041">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id380163">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id375604"></a> 2 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 3 More importantly, if you have implemented the examples given, you are well on your way to becoming … … 5 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id37 7090"></a>7 </p><p><a class="indexterm" name="id375618"></a> 8 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 9 The casual observer might conclude that this book is one-eyed about Samba. It is what … … 14 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id37 7113"></a>16 </p><p><a class="indexterm" name="id375642"></a> 17 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 18 out of thin air. They were drawn from comments made by Samba users and from criticism during … … 20 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 7126"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id377133"></a><a class="indexterm" name="id377141"></a><a class="indexterm" name="id377148"></a><a class="indexterm" name="id377156"></a><a class="indexterm" name="id377164"></a>22 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id375655"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id375661"></a><a class="indexterm" name="id375669"></a><a class="indexterm" name="id375677"></a><a class="indexterm" name="id375685"></a><a class="indexterm" name="id375693"></a> 23 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an … … 29 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id37 7182"></a>31 </p><p><a class="indexterm" name="id375710"></a> 32 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. … … 36 36 technologies.</span>”</span> This comment was made by one of Christine's staff as they were installing a new 37 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id37 7201"></a><a class="indexterm" name="id377209"></a>38 </p><p><a class="indexterm" name="id375729"></a><a class="indexterm" name="id375737"></a> 39 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id37 7221" href="#ftn.id377221" class="footnote">12</a>]</sup> on his unit's operations42 of an outside security systems consultant to report<sup>[<a name="id375749" href="#ftn.id375749" class="footnote">12</a>]</sup> on his unit's operations 43 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id37 7230"></a><a class="indexterm" name="id377238"></a><a class="indexterm" name="id377246"></a><a class="indexterm" name="id377254"></a>45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id375759"></a><a class="indexterm" name="id375767"></a><a class="indexterm" name="id375775"></a><a class="indexterm" name="id375782"></a> 46 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. … … 50 50 </p><p> 51 51 ... 52 </p><p><a class="indexterm" name="id37 7272"></a><a class="indexterm" name="id377283"></a><a class="indexterm" name="id377294"></a><a class="indexterm" name="id377302"></a><a class="indexterm" name="id377310"></a><a class="indexterm" name="id377318"></a>52 </p><p><a class="indexterm" name="id375800"></a><a class="indexterm" name="id375812"></a><a class="indexterm" name="id375823"></a><a class="indexterm" name="id375831"></a><a class="indexterm" name="id375839"></a><a class="indexterm" name="id375847"></a> 53 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id37 7332"></a><a class="indexterm" name="id377340"></a><a class="indexterm" name="id377347"></a>56 </p><p><a class="indexterm" name="id375860"></a><a class="indexterm" name="id375868"></a><a class="indexterm" name="id375876"></a> 57 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 58 a secure network. 59 </p><p><a class="indexterm" name="id37 7363"></a><a class="indexterm" name="id377371"></a><a class="indexterm" name="id377379"></a><a class="indexterm" name="id377387"></a>59 </p><p><a class="indexterm" name="id375892"></a><a class="indexterm" name="id375900"></a><a class="indexterm" name="id375907"></a><a class="indexterm" name="id375915"></a> 60 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data … … 64 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id37 7412"></a><a class="indexterm" name="id377420"></a><a class="indexterm" name="id377428"></a>66 </p><p><a class="indexterm" name="id375941"></a><a class="indexterm" name="id375949"></a><a class="indexterm" name="id375957"></a> 67 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network … … 73 73 </p><p> 74 74 ... 75 </p><p><a class="indexterm" name="id37 7448"></a><a class="indexterm" name="id377456"></a><a class="indexterm" name="id377464"></a><a class="indexterm" name="id377471"></a>75 </p><p><a class="indexterm" name="id375976"></a><a class="indexterm" name="id375984"></a><a class="indexterm" name="id375992"></a><a class="indexterm" name="id376000"></a> 76 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft … … 81 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id37 7489"></a><a class="indexterm" name="id377496"></a><a class="indexterm" name="id377504"></a><a class="indexterm" name="id377512"></a><a class="indexterm" name="id377520"></a><a class="indexterm" name="id377528"></a><a class="indexterm" name="id377536"></a>83 </p><p><a class="indexterm" name="id376017"></a><a class="indexterm" name="id376025"></a><a class="indexterm" name="id376033"></a><a class="indexterm" name="id376041"></a><a class="indexterm" name="id376049"></a><a class="indexterm" name="id376056"></a><a class="indexterm" name="id376064"></a> 84 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id37 7549"></a><a class="indexterm" name="id377557"></a><a class="indexterm" name="id377565"></a>87 </p><p><a class="indexterm" name="id376078"></a><a class="indexterm" name="id376086"></a><a class="indexterm" name="id376094"></a> 88 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id37 7578"></a><a class="indexterm" name="id377586"></a>90 </p></blockquote></div><p><a class="indexterm" name="id376106"></a><a class="indexterm" name="id376114"></a> 91 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 92 discussion, but it gets further out of hand. When you return to your office, you find the following … … 101 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id37 7616"></a><a class="indexterm" name="id377624"></a><a class="indexterm" name="id377632"></a><a class="indexterm" name="id377640"></a>103 </p><p><a class="indexterm" name="id376145"></a><a class="indexterm" name="id376153"></a><a class="indexterm" name="id376160"></a><a class="indexterm" name="id376168"></a> 104 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id37 7655"></a><a class="indexterm" name="id377662"></a><a class="indexterm" name="id377670"></a><a class="indexterm" name="id377678"></a><a class="indexterm" name="id377686"></a><a class="indexterm" name="id377694"></a>108 </p><p><a class="indexterm" name="id376183"></a><a class="indexterm" name="id376191"></a><a class="indexterm" name="id376199"></a><a class="indexterm" name="id376207"></a><a class="indexterm" name="id376215"></a><a class="indexterm" name="id376222"></a> 109 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered … … 113 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id37 7710"></a>Assignment Tasks</h3></div></div></div><p>115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id376238"></a>Assignment Tasks</h3></div></div></div><p> 116 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 7723"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id377730"></a><a class="indexterm" name="id377738"></a><a class="indexterm" name="id377746"></a><a class="indexterm" name="id377754"></a><a class="indexterm" name="id377761"></a><a class="indexterm" name="id377769"></a><a class="indexterm" name="id377777"></a>119 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id376252"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id376258"></a><a class="indexterm" name="id376266"></a><a class="indexterm" name="id376274"></a><a class="indexterm" name="id376282"></a><a class="indexterm" name="id376290"></a><a class="indexterm" name="id376298"></a><a class="indexterm" name="id376306"></a> 120 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. … … 125 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id37 7794"></a><a class="indexterm" name="id377802"></a><a class="indexterm" name="id377809"></a><a class="indexterm" name="id377817"></a><a class="indexterm" name="id377825"></a>127 </p><p><a class="indexterm" name="id376322"></a><a class="indexterm" name="id376330"></a><a class="indexterm" name="id376338"></a><a class="indexterm" name="id376346"></a><a class="indexterm" name="id376354"></a> 128 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide … … 131 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id37 7841"></a><a class="indexterm" name="id377848"></a><a class="indexterm" name="id377856"></a><a class="indexterm" name="id377864"></a>133 </p><p><a class="indexterm" name="id376369"></a><a class="indexterm" name="id376377"></a><a class="indexterm" name="id376385"></a><a class="indexterm" name="id376393"></a> 134 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 137 that is broken. 138 </p><p><a class="indexterm" name="id37 7878"></a><a class="indexterm" name="id377886"></a><a class="indexterm" name="id377894"></a><a class="indexterm" name="id377902"></a><a class="indexterm" name="id377913"></a><a class="indexterm" name="id377921"></a><a class="indexterm" name="id377929"></a><a class="indexterm" name="id377937"></a><a class="indexterm" name="id377945"></a><a class="indexterm" name="id377952"></a><a class="indexterm" name="id377960"></a>138 </p><p><a class="indexterm" name="id376407"></a><a class="indexterm" name="id376414"></a><a class="indexterm" name="id376422"></a><a class="indexterm" name="id376430"></a><a class="indexterm" name="id376442"></a><a class="indexterm" name="id376450"></a><a class="indexterm" name="id376457"></a><a class="indexterm" name="id376465"></a><a class="indexterm" name="id376473"></a><a class="indexterm" name="id376481"></a><a class="indexterm" name="id376489"></a> 139 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 140 accountable for the defects in products. Open Source software comes with no warranty, so it is … … 144 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id37 7977"></a><a class="indexterm" name="id377985"></a><a class="indexterm" name="id377993"></a><a class="indexterm" name="id378001"></a><a class="indexterm" name="id378009"></a><a class="indexterm" name="id378016"></a>146 </p><p><a class="indexterm" name="id376506"></a><a class="indexterm" name="id376514"></a><a class="indexterm" name="id376521"></a><a class="indexterm" name="id376529"></a><a class="indexterm" name="id376537"></a><a class="indexterm" name="id376545"></a> 147 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id37 8031"></a><a class="indexterm" name="id378039"></a><a class="indexterm" name="id378047"></a><a class="indexterm" name="id378055"></a><a class="indexterm" name="id378062"></a><a class="indexterm" name="id378070"></a><a class="indexterm" name="id378078"></a>151 </p><p><a class="indexterm" name="id376560"></a><a class="indexterm" name="id376567"></a><a class="indexterm" name="id376575"></a><a class="indexterm" name="id376583"></a><a class="indexterm" name="id376591"></a><a class="indexterm" name="id376599"></a><a class="indexterm" name="id376606"></a> 152 152 Open Source software at least puts you in possession of the source code. This means that when 153 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id37 8089"></a>Technical Issues</h3></div></div></div><p>154 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id376618"></a>Technical Issues</h3></div></div></div><p> 155 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id37 8109"></a><a class="indexterm" name="id378117"></a><a class="indexterm" name="id378125"></a><a class="indexterm" name="id378136"></a><a class="indexterm" name="id378144"></a><a class="indexterm" name="id378152"></a><a class="indexterm" name="id378160"></a><a class="indexterm" name="id378168"></a><a class="indexterm" name="id378175"></a><a class="indexterm" name="id378183"></a>157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id376638"></a><a class="indexterm" name="id376645"></a><a class="indexterm" name="id376653"></a><a class="indexterm" name="id376665"></a><a class="indexterm" name="id376672"></a><a class="indexterm" name="id376680"></a><a class="indexterm" name="id376688"></a><a class="indexterm" name="id376696"></a><a class="indexterm" name="id376704"></a><a class="indexterm" name="id376712"></a> 158 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 159 exposes all domain users so that they may use their domain account credentials to … … 161 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id37 8204"></a><a class="indexterm" name="id378212"></a><a class="indexterm" name="id378220"></a><a class="indexterm" name="id378227"></a>163 </p><p><a class="indexterm" name="id376732"></a><a class="indexterm" name="id376740"></a><a class="indexterm" name="id376748"></a><a class="indexterm" name="id376756"></a> 164 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 165 client, the same as one would obtain by adding a Microsoft Windows server or … … 167 167 and therefore requires handling a little differently from the familiar Windows systems. 168 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id37 8247"></a><a class="indexterm" name="id378255"></a><a class="indexterm" name="id378263"></a><a class="indexterm" name="id378271"></a><a class="indexterm" name="id378279"></a><a class="indexterm" name="id378290"></a>169 </p><p><a class="indexterm" name="id376776"></a><a class="indexterm" name="id376783"></a><a class="indexterm" name="id376791"></a><a class="indexterm" name="id376799"></a><a class="indexterm" name="id376807"></a><a class="indexterm" name="id376818"></a> 170 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 171 not, and cannot, override account controls set using the Active Directory management 172 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id37 8309"></a><a class="indexterm" name="id378317"></a><a class="indexterm" name="id378328"></a><a class="indexterm" name="id378336"></a><a class="indexterm" name="id378344"></a><a class="indexterm" name="id378352"></a><a class="indexterm" name="id378360"></a><a class="indexterm" name="id378368"></a><a class="indexterm" name="id378375"></a><a class="indexterm" name="id378383"></a>173 </p><p><a class="indexterm" name="id376837"></a><a class="indexterm" name="id376845"></a><a class="indexterm" name="id376856"></a><a class="indexterm" name="id376864"></a><a class="indexterm" name="id376872"></a><a class="indexterm" name="id376880"></a><a class="indexterm" name="id376888"></a><a class="indexterm" name="id376896"></a><a class="indexterm" name="id376904"></a><a class="indexterm" name="id376911"></a> 174 174 Where Samba and the ADS domain account information obtained through the use of 175 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to … … 179 179 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Shares themselves (i.e., the logical share itself)</p></li><li class="listitem"><p>The share definition in <code class="filename">smb.conf</code></p></li><li class="listitem"><p>The shared directories and files using UNIX permissions</p></li><li class="listitem"><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 180 Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id37 8452"></a><a class="indexterm" name="id378460"></a><a class="indexterm" name="id378471"></a><a class="indexterm" name="id378483"></a><a class="indexterm" name="id378490"></a><a class="indexterm" name="id378498"></a><a class="indexterm" name="id378506"></a><a class="indexterm" name="id378514"></a><a class="indexterm" name="id378522"></a>181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id376981"></a><a class="indexterm" name="id376989"></a><a class="indexterm" name="id377000"></a><a class="indexterm" name="id377011"></a><a class="indexterm" name="id377019"></a><a class="indexterm" name="id377027"></a><a class="indexterm" name="id377035"></a><a class="indexterm" name="id377042"></a><a class="indexterm" name="id377050"></a> 182 182 User and group management facilities as known in the Windows ADS environment may be 183 183 used to provide equivalent access control constraints or to provide equivalent … … 186 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id37 8537"></a><a class="indexterm" name="id378545"></a><a class="indexterm" name="id378553"></a><a class="indexterm" name="id378561"></a><a class="indexterm" name="id378572"></a><a class="indexterm" name="id378580"></a><a class="indexterm" name="id378588"></a>188 </p><p><a class="indexterm" name="id377066"></a><a class="indexterm" name="id377074"></a><a class="indexterm" name="id377082"></a><a class="indexterm" name="id377089"></a><a class="indexterm" name="id377101"></a><a class="indexterm" name="id377109"></a><a class="indexterm" name="id377116"></a> 189 189 In any serious analysis of system security, it is important to examine the safeguards 190 190 that remain when all other protective measures fail. An administrator may inadvertently … … 194 194 possible to guard against that by enforcing controls on the share definition itself. You 195 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id37 8610"></a><a class="indexterm" name="id378618"></a>196 </p><p><a class="indexterm" name="id377138"></a><a class="indexterm" name="id377146"></a> 197 197 The report that is critical of Samba really ought to have exercised greater due 198 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id37 8638"></a>199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id377166"></a> 200 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 202 system in any way. All software has potential defects, and Samba is no exception. 203 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id37 8652"></a><a class="indexterm" name="id378660"></a><a class="indexterm" name="id378668"></a><a class="indexterm" name="id378676"></a>204 </p><p><a class="indexterm" name="id377180"></a><a class="indexterm" name="id377188"></a><a class="indexterm" name="id377196"></a><a class="indexterm" name="id377204"></a> 205 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 206 every security facility to provide a level of protection and security that is necessary … … 209 209 security be publicly condoned; yet this is the practice by many Windows network 210 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id37 8691"></a><a class="indexterm" name="id378699"></a><a class="indexterm" name="id378707"></a><a class="indexterm" name="id378715"></a><a class="indexterm" name="id378723"></a><a class="indexterm" name="id378730"></a><a class="indexterm" name="id378738"></a>211 </p><p><a class="indexterm" name="id377220"></a><a class="indexterm" name="id377228"></a><a class="indexterm" name="id377235"></a><a class="indexterm" name="id377243"></a><a class="indexterm" name="id377251"></a><a class="indexterm" name="id377259"></a><a class="indexterm" name="id377267"></a> 212 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 213 online updates need to be applied almost weekly. The answer to the criticism … … 215 215 user needs are being increasingly met or exceeded, and security updates are issued 216 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id37 8753"></a><a class="indexterm" name="id378761"></a><a class="indexterm" name="id378768"></a><a class="indexterm" name="id378776"></a><a class="indexterm" name="id378784"></a>217 </p><p><a class="indexterm" name="id377281"></a><a class="indexterm" name="id377289"></a><a class="indexterm" name="id377297"></a><a class="indexterm" name="id377305"></a><a class="indexterm" name="id377313"></a> 218 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 219 complete rewrite to permit extensive modularization and to prepare Samba for new … … 222 222 degree of dependability and on charter development consistent with published 223 223 roadmap projections. 224 </p><p><a class="indexterm" name="id37 8803"></a><a class="indexterm" name="id378811"></a><a class="indexterm" name="id378822"></a><a class="indexterm" name="id378833"></a><a class="indexterm" name="id378841"></a><a class="indexterm" name="id378849"></a><a class="indexterm" name="id378857"></a>224 </p><p><a class="indexterm" name="id377331"></a><a class="indexterm" name="id377339"></a><a class="indexterm" name="id377351"></a><a class="indexterm" name="id377362"></a><a class="indexterm" name="id377370"></a><a class="indexterm" name="id377378"></a><a class="indexterm" name="id377385"></a> 225 225 Not well published is the fact that Microsoft was a foundation member of 226 226 the Common Internet File System (CIFS) initiative, together with the participation … … 231 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id37 8881"></a><a class="indexterm" name="id378889"></a><a class="indexterm" name="id378897"></a>233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id377410"></a><a class="indexterm" name="id377418"></a><a class="indexterm" name="id377425"></a> 234 234 The report correctly mentions that Samba did not support the most recent 235 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features … … 239 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id37 8923"></a><a class="indexterm" name="id378930"></a><a class="indexterm" name="id378938"></a><a class="indexterm" name="id378946"></a><a class="indexterm" name="id378953"></a><a class="indexterm" name="id378968"></a><a class="indexterm" name="id378976"></a>241 </p><p><a class="indexterm" name="id377451"></a><a class="indexterm" name="id377458"></a><a class="indexterm" name="id377466"></a><a class="indexterm" name="id377474"></a><a class="indexterm" name="id377482"></a><a class="indexterm" name="id377497"></a><a class="indexterm" name="id377505"></a> 242 242 It should be pointed out that had clear public specifications for the protocols 243 243 been published, it would have been much easier to implement these features and would have … … 247 247 and defensible standards is obvious to all and would have enabled more secure networking 248 248 for everyone. 249 </p><p><a class="indexterm" name="id37 8992"></a><a class="indexterm" name="id379000"></a>249 </p><p><a class="indexterm" name="id377520"></a><a class="indexterm" name="id377528"></a> 250 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 251 the users of Microsoft's products also. Those who are first to criticize Samba … … 259 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id37 9032"></a><a class="indexterm" name="id379040"></a><a class="indexterm" name="id379048"></a><a class="indexterm" name="id379056"></a><a class="indexterm" name="id379064"></a><a class="indexterm" name="id379072"></a><a class="indexterm" name="id379080"></a><a class="indexterm" name="id379088"></a><a class="indexterm" name="id379096"></a>261 </p><p><a class="indexterm" name="id377561"></a><a class="indexterm" name="id377569"></a><a class="indexterm" name="id377577"></a><a class="indexterm" name="id377585"></a><a class="indexterm" name="id377593"></a><a class="indexterm" name="id377600"></a><a class="indexterm" name="id377608"></a><a class="indexterm" name="id377616"></a><a class="indexterm" name="id377624"></a> 262 262 One final comment is warranted. If companies want more secure networking protocols, 263 263 the most effective method by which this can be achieved is by users seeking … … 268 268 help the consumer to make a better choice. 269 269 </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba 270 <a class="indexterm" name="id37 9116"></a><a class="indexterm" name="id379128"></a><a class="indexterm" name="id379136"></a><a class="indexterm" name="id379143"></a>270 <a class="indexterm" name="id377645"></a><a class="indexterm" name="id377656"></a><a class="indexterm" name="id377664"></a><a class="indexterm" name="id377672"></a> 271 271 272 272 </span></dt><dd><p> … … 278 278 and yet by which they are made to interoperate in ways that the components do not 279 279 support. 280 </p><p><a class="indexterm" name="id37 9174"></a><a class="indexterm" name="id379185"></a><a class="indexterm" name="id379193"></a><a class="indexterm" name="id379201"></a><a class="indexterm" name="id379209"></a>280 </p><p><a class="indexterm" name="id377702"></a><a class="indexterm" name="id377714"></a><a class="indexterm" name="id377721"></a><a class="indexterm" name="id377729"></a><a class="indexterm" name="id377737"></a> 281 281 In order to make the popular request for Samba to be an Active Directory Server a 282 282 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls … … 286 286 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 287 287 into the Samba project, this dream request cannot become a reality. 288 </p><p><a class="indexterm" name="id37 9225"></a><a class="indexterm" name="id379233"></a><a class="indexterm" name="id379241"></a><a class="indexterm" name="id379252"></a><a class="indexterm" name="id379260"></a>288 </p><p><a class="indexterm" name="id377753"></a><a class="indexterm" name="id377761"></a><a class="indexterm" name="id377769"></a><a class="indexterm" name="id377780"></a><a class="indexterm" name="id377788"></a> 289 289 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 290 290 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered … … 292 292 The Samba Team is most committed to permitting Samba to be a full ADS domain member 293 293 that is increasingly capable of being managed using Microsoft Windows MMC tools. 294 </p></dd></dl></div><div class="sect3" title="Kerberos Exposed"><div class="titlepage"><div><div><h4 class="title"><a name="id37 9276"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id379282"></a><a class="indexterm" name="id379290"></a><a class="indexterm" name="id379298"></a>294 </p></dd></dl></div><div class="sect3" title="Kerberos Exposed"><div class="titlepage"><div><div><h4 class="title"><a name="id377804"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id377810"></a><a class="indexterm" name="id377818"></a><a class="indexterm" name="id377826"></a> 295 295 Kerberos is a network authentication protocol that provides secure authentication for 296 296 client-server applications by using secret-key cryptography. Firewalls are an insufficient … … 298 298 traffic but cannot prevent network traffic that comes from authorized locations from 299 299 performing unauthorized activities. 300 </p><p><a class="indexterm" name="id37 9312"></a><a class="indexterm" name="id379320"></a><a class="indexterm" name="id379328"></a>300 </p><p><a class="indexterm" name="id377841"></a><a class="indexterm" name="id377848"></a><a class="indexterm" name="id377856"></a> 301 301 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 302 302 strong cryptography so that a client can prove its identity to a server (and vice versa) across an … … 304 304 they can also encrypt all of their communications to assure privacy and data integrity as they go 305 305 about their business. 306 </p><p><a class="indexterm" name="id37 9343"></a><a class="indexterm" name="id379351"></a><a class="indexterm" name="id379359"></a><a class="indexterm" name="id379367"></a><a class="indexterm" name="id379378"></a>306 </p><p><a class="indexterm" name="id377871"></a><a class="indexterm" name="id377879"></a><a class="indexterm" name="id377887"></a><a class="indexterm" name="id377895"></a><a class="indexterm" name="id377906"></a> 307 307 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 308 308 server) that is trusted by all the entities on the network (users and services, usually called … … 311 311 trusting the kerberos server, users and services can authenticate each other. 312 312 </p><p> 313 <a class="indexterm" name="id37 9394"></a>314 <a class="indexterm" name="id37 9401"></a>315 <a class="indexterm" name="id37 9408"></a>313 <a class="indexterm" name="id377922"></a> 314 <a class="indexterm" name="id377929"></a> 315 <a class="indexterm" name="id377936"></a> 316 316 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 317 317 For many years that hindered global adoption of more secure networking technologies both within the United States … … 323 323 and use of Kerberos across the spectrum of the information technology industry. 324 324 </p><p> 325 <a class="indexterm" name="id37 9430"></a>325 <a class="indexterm" name="id377958"></a> 326 326 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 327 327 of it. For example, a 2002 328 328 <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 329 report<sup>[<a name="id37 9447" href="#ftn.id379447" class="footnote">13</a>]</sup> by329 report<sup>[<a name="id377975" href="#ftn.id377975" class="footnote">13</a>]</sup> by 330 330 states: 331 331 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 335 335 use of the Kerberos authentication specification, not everyone agrees. 336 336 </p><p> 337 <a class="indexterm" name="id37 9470"></a>337 <a class="indexterm" name="id377998"></a> 338 338 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 339 339 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version … … 343 343 that software developers could add their own authorization information, he said. 344 344 </p></blockquote></div><p> 345 <a class="indexterm" name="id37 9488"></a>346 <a class="indexterm" name="id37 9494"></a>345 <a class="indexterm" name="id378016"></a> 346 <a class="indexterm" name="id378022"></a> 347 347 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 348 348 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, … … 356 356 <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 357 357 technet</a> article: 358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id37 9523"></a><a class="indexterm" name="id379535"></a>358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id378051"></a><a class="indexterm" name="id378063"></a> 359 359 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 360 360 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos … … 366 366 </p></blockquote></div></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 367 367 The following procedures outline the implementation of the security measures discussed so far. 368 </p><div class="sect2" title="Share Access Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id37 9573"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id379580"></a><a class="indexterm" name="id379588"></a><a class="indexterm" name="id379596"></a>368 </p><div class="sect2" title="Share Access Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id378100"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id378107"></a><a class="indexterm" name="id378115"></a><a class="indexterm" name="id378123"></a> 369 369 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 370 370 Windows XP Pro) attempts to make a connection to the Samba server. 371 </p><div class="procedure" title="Procedure 11.1. Create/Edit/Delete Share ACLs"><a name="id37 9607"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id379617"></a><a class="indexterm" name="id379625"></a>371 </p><div class="procedure" title="Procedure 11.1. Create/Edit/Delete Share ACLs"><a name="id378134"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id378144"></a><a class="indexterm" name="id378152"></a> 372 372 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 373 373 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 378 378 In the left panel, 379 379 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id37 9745"></a>380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id378272"></a> 381 381 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 382 382 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, … … 384 384 </p></li><li class="step" title="Step 4"><p> 385 385 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 386 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id37 9806"></a><a class="indexterm" name="id379814"></a>386 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id378334"></a><a class="indexterm" name="id378342"></a> 387 387 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 388 388 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 389 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id37 9836"></a><a class="indexterm" name="id379844"></a><a class="indexterm" name="id379852"></a><a class="indexterm" name="id379860"></a><a class="indexterm" name="id379868"></a><a class="indexterm" name="id379875"></a>389 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id378363"></a><a class="indexterm" name="id378371"></a><a class="indexterm" name="id378379"></a><a class="indexterm" name="id378387"></a><a class="indexterm" name="id378395"></a><a class="indexterm" name="id378403"></a> 390 390 You may now edit/add/remove access control settings. Be very careful. Many problems have been 391 391 created by people who decided that everyone should be rejected but one particular group should … … 396 396 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 397 397 buttons. 398 </p></li></ol></div></div><div class="sect2" title="Share Definition Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id37 9908"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id379914"></a><a class="indexterm" name="id379926"></a><a class="indexterm" name="id379934"></a><a class="indexterm" name="id379942"></a><a class="indexterm" name="id379949"></a><a class="indexterm" name="id379957"></a>398 </p></li></ol></div></div><div class="sect2" title="Share Definition Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id378435"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id378442"></a><a class="indexterm" name="id378453"></a><a class="indexterm" name="id378461"></a><a class="indexterm" name="id378469"></a><a class="indexterm" name="id378477"></a><a class="indexterm" name="id378484"></a> 399 399 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 400 400 checkpoint can be used to require someone who wants to get through to meet certain requirements, so … … 403 403 credential-related objectives, the user can be granted powers and privileges that would not normally be 404 404 available under default settings. 405 </p><p><a class="indexterm" name="id37 9973"></a><a class="indexterm" name="id379981"></a><a class="indexterm" name="id379989"></a><a class="indexterm" name="id379997"></a>405 </p><p><a class="indexterm" name="id378500"></a><a class="indexterm" name="id378508"></a><a class="indexterm" name="id378516"></a><a class="indexterm" name="id378524"></a> 406 406 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 407 407 that act as a superstructure over normal directory and file access controls. However, share-level … … 409 409 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 410 410 by Samba and Windows networking consists of: 411 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Share-level ACLs</p></li><li class="listitem"><p>Share-definition controls</p></li><li class="listitem"><p>Directory and file permissions</p></li><li class="listitem"><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" title="Checkpoint Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id3 80037"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id380044"></a>411 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Share-level ACLs</p></li><li class="listitem"><p>Share-definition controls</p></li><li class="listitem"><p>Directory and file permissions</p></li><li class="listitem"><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" title="Checkpoint Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id378564"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id378571"></a> 412 412 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 413 413 </p><pre class="screen"> … … 420 420 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 421 421 access the share. 422 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id3 80077"></a><a class="indexterm" name="id380088"></a><a class="indexterm" name="id380096"></a><a class="indexterm" name="id380104"></a><a class="indexterm" name="id380112"></a>422 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id378604"></a><a class="indexterm" name="id378616"></a><a class="indexterm" name="id378624"></a><a class="indexterm" name="id378632"></a><a class="indexterm" name="id378639"></a> 423 423 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 424 424 been specified, the use of domain accounts in security controls requires fully qualified domain specification, … … 426 426 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 427 427 delimiter. 428 </p></div><p><a class="indexterm" name="id3 80145"></a><a class="indexterm" name="id380152"></a><a class="indexterm" name="id380160"></a>428 </p></div><p><a class="indexterm" name="id378672"></a><a class="indexterm" name="id378679"></a><a class="indexterm" name="id378687"></a> 429 429 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 430 430 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through … … 432 432 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 433 433 would immediately fail to validate. 434 </p><p><a class="indexterm" name="id3 80188"></a>434 </p><p><a class="indexterm" name="id378715"></a> 435 435 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 436 436 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be … … 445 445 invalid users = patrickj 446 446 </pre><p> 447 <a class="indexterm" name="id3 80224"></a>447 <a class="indexterm" name="id378751"></a> 448 448 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 449 449 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write … … 457 457 admin users = gbshaw 458 458 </pre><p> 459 <a class="indexterm" name="id3 80251"></a>459 <a class="indexterm" name="id378779"></a> 460 460 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 461 461 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have … … 479 479 write list = peters 480 480 </pre><p> 481 <a class="indexterm" name="id3 80303"></a>481 <a class="indexterm" name="id378830"></a> 482 482 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 483 483 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 484 484 the checkpoint controls that Samba implements. 485 </p></div><div class="sect3" title="Override Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id3 80322"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id380328"></a>485 </p></div><div class="sect3" title="Override Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id378849"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id378856"></a> 486 486 Override controls implemented by Samba permit actions like the adoption of a different identity 487 487 during file system operations, the forced overwriting of normal file and directory permissions, … … 501 501 force group = Mentors 502 502 </pre><p> 503 <a class="indexterm" name="id3 80366"></a><a class="indexterm" name="id380374"></a>503 <a class="indexterm" name="id378893"></a><a class="indexterm" name="id378901"></a> 504 504 That is all there is to it. Well, it is almost that simple. The downside of this method is that 505 505 users are logged onto the Windows client as themselves, and then immediately before accessing the … … 508 508 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 509 509 (but with lower system CPU overheads) is described next. 510 </p><p><a class="indexterm" name="id3 80389"></a><a class="indexterm" name="id380397"></a><a class="indexterm" name="id380405"></a><a class="indexterm" name="id380416"></a><a class="indexterm" name="id380424"></a>510 </p><p><a class="indexterm" name="id378917"></a><a class="indexterm" name="id378924"></a><a class="indexterm" name="id378932"></a><a class="indexterm" name="id378944"></a><a class="indexterm" name="id378952"></a> 511 511 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 512 512 also have a severe impact on system (particularly on Windows client) performance. If opportunistic … … 518 518 apparent performance degradation as the client continually attempts to reconnect to overcome the 519 519 effect of the lost <code class="constant">oplock break</code>, or time-out. 520 </p></div></div><div class="sect2" title="Share Point Directory and File Permissions"><div class="titlepage"><div><div><h3 class="title"><a name="id3 80465"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id380472"></a><a class="indexterm" name="id380480"></a><a class="indexterm" name="id380488"></a><a class="indexterm" name="id380496"></a>520 </p></div></div><div class="sect2" title="Share Point Directory and File Permissions"><div class="titlepage"><div><div><h3 class="title"><a name="id378992"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id378999"></a><a class="indexterm" name="id379007"></a><a class="indexterm" name="id379015"></a><a class="indexterm" name="id379023"></a> 521 521 Samba has been designed and implemented so that it respects as far as is feasible the security and 522 522 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing … … 526 526 from a basic UNIX training guide. Instead, one common example of a typical problem is used 527 527 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 528 </p><p><a class="indexterm" name="id3 80512"></a><a class="indexterm" name="id380520"></a><a class="indexterm" name="id380528"></a>528 </p><p><a class="indexterm" name="id379040"></a><a class="indexterm" name="id379048"></a><a class="indexterm" name="id379055"></a> 529 529 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 530 530 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: … … 546 546 want to know when this <span class="quote">“<span class="quote">bug</span>”</span> will be fixed. The fact is, this is not a bug in Samba at all. 547 547 Here is the real sequence of what happens in this case. 548 </p><p><a class="indexterm" name="id3 80609"></a><a class="indexterm" name="id380617"></a><a class="indexterm" name="id380624"></a>548 </p><p><a class="indexterm" name="id379136"></a><a class="indexterm" name="id379143"></a><a class="indexterm" name="id379151"></a> 549 549 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 550 550 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow … … 564 564 simple steps to create a share in which all files will consistently be owned by the same user and the 565 565 same group: 566 </p><div class="procedure" title="Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership"><a name="id3 80661"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>566 </p><div class="procedure" title="Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership"><a name="id379188"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 567 567 Change your share definition so that it matches this pattern: 568 568 </p><pre class="screen"> … … 572 572 read only = No 573 573 </pre><p> 574 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id3 80685"></a><a class="indexterm" name="id380696"></a>574 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id379212"></a><a class="indexterm" name="id379223"></a> 575 575 Set consistent user and group permissions recursively down the directory tree as shown here: 576 576 </p><pre class="screen"> 577 577 <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 578 578 </pre><p> 579 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id3 80727"></a>579 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id379254"></a> 580 580 Set the files and directory permissions to be read/write for owner and group, and not accessible 581 581 to others (everyone), using the following command: … … 583 583 <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 584 584 </pre><p> 585 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id3 80754"></a>585 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id379281"></a> 586 586 Set the SGID (supergroup) bit on all directories from the top down. This means all files 587 587 can be created with the permissions of the group set on the directory. It means all users … … 593 593 </pre><p> 594 594 595 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id3 80791"></a><a class="indexterm" name="id380799"></a><a class="indexterm" name="id380807"></a>595 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id379318"></a><a class="indexterm" name="id379326"></a><a class="indexterm" name="id379334"></a> 596 596 Make sure all users that must have read/write access to the directory have 597 597 <code class="constant">finance</code> group membership as their primary group, 598 598 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 599 </p></li></ol></div></div><div class="sect2" title="Managing Windows 200x ACLs"><div class="titlepage"><div><div><h3 class="title"><a name="id3 80830"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id380837"></a><a class="indexterm" name="id380845"></a><a class="indexterm" name="id380853"></a><a class="indexterm" name="id380860"></a>599 </p></li></ol></div></div><div class="sect2" title="Managing Windows 200x ACLs"><div class="titlepage"><div><div><h3 class="title"><a name="id379357"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id379364"></a><a class="indexterm" name="id379372"></a><a class="indexterm" name="id379379"></a><a class="indexterm" name="id379387"></a> 600 600 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 601 601 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means … … 605 605 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 606 606 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 607 </p><div class="sect3" title="Using the MMC Computer Management Interface"><div class="titlepage"><div><div><h4 class="title"><a name="id3 80879"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>607 </p><div class="sect3" title="Using the MMC Computer Management Interface"><div class="titlepage"><div><div><h4 class="title"><a name="id379406"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 608 608 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 609 609 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 620 620 </p></li><li class="step" title="Step 4"><p> 621 621 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 622 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id3 81056"></a><a class="indexterm" name="id381064"></a><a class="indexterm" name="id381072"></a><a class="indexterm" name="id381080"></a>622 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id379583"></a><a class="indexterm" name="id379591"></a><a class="indexterm" name="id379599"></a><a class="indexterm" name="id379606"></a> 623 623 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 624 624 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best … … 627 627 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 628 628 to a Samba domain server. 629 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id3 81116"></a><a class="indexterm" name="id381124"></a>629 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id379643"></a><a class="indexterm" name="id379651"></a> 630 630 You may now edit/add/remove access control settings. Be very careful. Many problems have been 631 631 created by people who decided that everyone should be rejected but one particular group should … … 636 636 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 637 637 buttons until the last panel closes. 638 </p></li></ol></div></div><div class="sect3" title="Using MS Windows Explorer (File Manager)"><div class="titlepage"><div><div><h4 class="title"><a name="id3 81156"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>638 </p></li></ol></div></div><div class="sect3" title="Using MS Windows Explorer (File Manager)"><div class="titlepage"><div><div><h4 class="title"><a name="id379683"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 639 639 The following alternative method may be used from a Windows workstation. In this example we work 640 640 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a … … 644 644 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 645 645 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 646 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id3 81277"></a><a class="indexterm" name="id381285"></a>646 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id379804"></a><a class="indexterm" name="id379812"></a> 647 647 You may now edit/add/remove access control settings. Be very careful. Many problems have been 648 648 created by people who decided that everyone should be rejected but one particular group should … … 653 653 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 654 654 buttons until the last panel closes. 655 </p></li></ol></div></div><div class="sect3" title="Setting Posix ACLs in UNIX/Linux"><div class="titlepage"><div><div><h4 class="title"><a name="id3 81318"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id381325"></a><a class="indexterm" name="id381333"></a>655 </p></li></ol></div></div><div class="sect3" title="Setting Posix ACLs in UNIX/Linux"><div class="titlepage"><div><div><h4 class="title"><a name="id379845"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id379852"></a><a class="indexterm" name="id379860"></a> 656 656 Yet another alternative method for setting desired security settings on the shared resource files and 657 657 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line … … 676 676 other::r-x 677 677 </pre><p> 678 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id3 81401"></a>678 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id379928"></a> 679 679 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 680 680 manage the applications (apps) share. It is important to set the ACL recursively … … 699 699 </pre><p> 700 700 This confirms that the change of POSIX ACL permissions has been effective. 701 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id3 81451"></a><a class="indexterm" name="id381459"></a><a class="indexterm" name="id381467"></a><a class="indexterm" name="id381475"></a><a class="indexterm" name="id381483"></a>701 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id379978"></a><a class="indexterm" name="id379986"></a><a class="indexterm" name="id379994"></a><a class="indexterm" name="id380002"></a><a class="indexterm" name="id380010"></a> 702 702 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 703 703 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 704 704 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 705 705 of setting <code class="constant">inheritance</code> properties. 706 </p></li></ol></div></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id38 1514"></a>Key Points Learned</h3></div></div></div><p>706 </p></li></ol></div></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id380041"></a>Key Points Learned</h3></div></div></div><p> 707 707 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 708 708 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 709 709 The highlights covered are as follows: 710 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id38 1529"></a><a class="indexterm" name="id381537"></a><a class="indexterm" name="id381545"></a><a class="indexterm" name="id381553"></a>710 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id380056"></a><a class="indexterm" name="id380064"></a><a class="indexterm" name="id380072"></a><a class="indexterm" name="id380080"></a> 711 711 Winbind honors and does not override account controls set in Active Directory. 712 712 This means that password change, logon hours, and so on, are (or soon will be) enforced … … 714 714 change is enforced. At this time, if logon hours expire, the user is not forcibly 715 715 logged off. That may be implemented at some later date. 716 </p></li><li class="listitem"><p><a class="indexterm" name="id38 1568"></a><a class="indexterm" name="id381576"></a>716 </p></li><li class="listitem"><p><a class="indexterm" name="id380096"></a><a class="indexterm" name="id380103"></a> 717 717 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 718 718 problems acknowledged by Microsoft as having been fixed but reported by some as still 719 719 possibly an open issue. 720 </p></li><li class="listitem"><p><a class="indexterm" name="id38 1590"></a><a class="indexterm" name="id381598"></a><a class="indexterm" name="id381606"></a><a class="indexterm" name="id381614"></a>720 </p></li><li class="listitem"><p><a class="indexterm" name="id380117"></a><a class="indexterm" name="id380125"></a><a class="indexterm" name="id380133"></a><a class="indexterm" name="id380141"></a> 721 721 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 722 722 Active Directory. The possibility to do this is not planned in the current Samba-3 … … 727 727 the four key methodologies was reviewed with specific reference to example deployment 728 728 techniques. 729 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 1636"></a>Questions and Answers</h2></div></div></div><p>730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id38 1645"></a><dl><dt> <a href="kerberos.html#id381651">729 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id380163"></a>Questions and Answers</h2></div></div></div><p> 730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id380172"></a><dl><dt> <a href="kerberos.html#id380179"> 731 731 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 732 </a></dt><dt> <a href="kerberos.html#id38 1720">732 </a></dt><dt> <a href="kerberos.html#id380247"> 733 733 Does Samba-3 support Active Directory? 734 </a></dt><dt> <a href="kerberos.html#id38 1747">734 </a></dt><dt> <a href="kerberos.html#id380274"> 735 735 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 736 736 necessary with Samba-2? 737 </a></dt><dt> <a href="kerberos.html#id38 1782">737 </a></dt><dt> <a href="kerberos.html#id380310"> 738 738 Is it safe to set share-level access controls in Samba? 739 </a></dt><dt> <a href="kerberos.html#id38 1809">739 </a></dt><dt> <a href="kerberos.html#id380336"> 740 740 Is it mandatory to set share ACLs to get a secure Samba-3 server? 741 </a></dt><dt> <a href="kerberos.html#id38 1882">741 </a></dt><dt> <a href="kerberos.html#id380409"> 742 742 The valid users did not work on the [homes]. 743 743 Has this functionality been restored yet? 744 </a></dt><dt> <a href="kerberos.html#id38 1944">744 </a></dt><dt> <a href="kerberos.html#id380472"> 745 745 Is the bias against use of the force user and force group 746 746 really warranted? 747 </a></dt><dt> <a href="kerberos.html#id38 2006">747 </a></dt><dt> <a href="kerberos.html#id380533"> 748 748 The example given for file and directory access control forces all files to be owned by one 749 749 particular user. I do not like that. Is there any way I can see who created the file? 750 </a></dt><dt> <a href="kerberos.html#id38 2050">750 </a></dt><dt> <a href="kerberos.html#id380576"> 751 751 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 752 752 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 753 753 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 754 </a></dt><dt> <a href="kerberos.html#id38 2110">754 </a></dt><dt> <a href="kerberos.html#id380636"> 755 755 I tried to set valid users = @Engineers, but it does not work. My Samba 756 756 server is an Active Directory domain member server. Has this been fixed now? 757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id38 1651"></a><a name="id381654"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381657"></a><a class="indexterm" name="id381665"></a>757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id380179"></a><a name="id380181"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380184"></a><a class="indexterm" name="id380192"></a> 758 758 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1683"></a><a class="indexterm" name="id381691"></a><a class="indexterm" name="id381699"></a>759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380210"></a><a class="indexterm" name="id380218"></a><a class="indexterm" name="id380226"></a> 760 760 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 761 761 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1720"></a><a name="id381722"></a></td><td align="left" valign="top"><p>762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380247"></a><a name="id380249"></a></td><td align="left" valign="top"><p> 763 763 Does Samba-3 support Active Directory? 764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1732"></a>764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380259"></a> 765 765 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 766 766 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 767 767 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 768 768 and it can function as an Active Directory domain member server. 769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1747"></a><a name="id381749"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381752"></a>769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380274"></a><a name="id380276"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380280"></a> 770 770 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 771 771 necessary with Samba-2? 772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1768"></a>772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380295"></a> 773 773 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 774 774 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 775 775 because Samba-3 can join a native Windows 2003 Server ADS domain. 776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1782"></a><a name="id381785"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381788"></a>776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380310"></a><a name="id380312"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380315"></a> 777 777 Is it safe to set share-level access controls in Samba? 778 778 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 very mature technology. Not enough sites make use of this powerful capability, neither on 781 781 Windows server or with Samba servers. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1809"></a><a name="id381811"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381814"></a>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380336"></a><a name="id380338"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380342"></a> 783 783 Is it mandatory to set share ACLs to get a secure Samba-3 server? 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1829"></a><a class="indexterm" name="id381837"></a><a class="indexterm" name="id381845"></a><a class="indexterm" name="id381853"></a><a class="indexterm" name="id381861"></a>784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380357"></a><a class="indexterm" name="id380364"></a><a class="indexterm" name="id380372"></a><a class="indexterm" name="id380380"></a><a class="indexterm" name="id380388"></a> 785 785 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 786 786 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 787 787 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 788 788 to it. 789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1882"></a><a name="id381884"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381887"></a>789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380409"></a><a name="id380411"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380414"></a> 790 790 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 791 791 Has this functionality been restored yet? 792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1914"></a>792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380441"></a> 793 793 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 794 794 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 795 795 <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = %S</a>. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 1944"></a><a name="id381947"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381950"></a><a class="indexterm" name="id381958"></a><a class="indexterm" name="id381966"></a>796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380472"></a><a name="id380474"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380477"></a><a class="indexterm" name="id380485"></a><a class="indexterm" name="id380493"></a> 797 797 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 798 798 really warranted? 799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 1992"></a>799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380519"></a> 800 800 There is no bias. There is a determination to recommend the right tool for the task at hand. 801 801 After all, it is better than putting users through performance problems, isn't it? 802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 2006"></a><a name="id382008"></a></td><td align="left" valign="top"><p>802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380533"></a><a name="id380535"></a></td><td align="left" valign="top"><p> 803 803 The example given for file and directory access control forces all files to be owned by one 804 804 particular user. I do not like that. Is there any way I can see who created the file? 805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 2019"></a>805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380546"></a> 806 806 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 807 807 to permit file ownership to be retained by the user who created it: … … 811 811 Note that this required no more than removing the <code class="constant">u</code> argument so that the 812 812 SUID bit is not set for the owner. 813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 2050"></a><a name="id382052"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382055"></a>813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380576"></a><a name="id380578"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380581"></a> 814 814 In the book, <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”</span>, you recommended use 815 815 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 816 816 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id38 2081"></a><a class="indexterm" name="id382088"></a>817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id380607"></a><a class="indexterm" name="id380614"></a> 818 818 Either tool can be used with equal effect. There is no benefit of one over the other, except that 819 819 the MMC utility is present on all Windows 200x/XP systems and does not require additional software … … 821 821 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 822 822 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 2110"></a><a name="id382112"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382116"></a><a class="indexterm" name="id382123"></a><a class="indexterm" name="id382130"></a>823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id380636"></a><a name="id380638"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id380642"></a><a class="indexterm" name="id380649"></a><a class="indexterm" name="id380657"></a> 824 824 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 825 825 server is an Active Directory domain member server. Has this been fixed now? … … 827 827 The use of this parameter has always required the full specification of the domain account, for 828 828 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id37 7221" href="#id377221" class="para">12</a>] </sup>This report is entirely fictitious.830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id37 9447" href="#id379447" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id375749" href="#id375749" class="para">12</a>] </sup>This report is entirely fictitious. 830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id377975" href="#id377975" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still 831 831 available from <a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top">ITWorld.com</a> (July 5, 2005)</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/net2000users.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 6. A Distributed 2000-User Network"><div class="titlepage"><div><div><h2 class="title"><a name="net2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="net2000users.html#id35 2846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 6. A Distributed 2000-User Network"><div class="titlepage"><div><div><h2 class="title"><a name="net2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="net2000users.html#id351371">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351396">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id351452">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id351698">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id352520">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352534">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id355551">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id355690">Questions and Answers</a></span></dt></dl></div><p> 2 2 There is something indeed mystical about things that are 3 3 big. Large networks exhibit a certain magnetism and exude a sense of … … 31 31 specifics of implementing LDAP changes, Samba changes, and approach and 32 32 design of the solution and its deployment. 33 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 2846"></a>Introduction</h2></div></div></div><p>33 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id351371"></a>Introduction</h2></div></div></div><p> 34 34 Abmas is a miracle company. Most businesses would have collapsed under 35 35 the weight of rapid expansion that this company has experienced. Samba … … 40 40 Samba server just to change the way your network should function. 41 41 </p><p> 42 <a class="indexterm" name="id35 2861"></a>42 <a class="indexterm" name="id351386"></a> 43 43 Network growth is common to all organizations. In this exercise, 44 44 your preoccupation is with the mechanics of implementing Samba and 45 45 LDAP so that network users on each network segment can work 46 46 without impediment. 47 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id35 2871"></a>Assignment Tasks</h3></div></div></div><p>47 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id351396"></a>Assignment Tasks</h3></div></div></div><p> 48 48 Starting with the configuration files for the server called 49 49 <code class="constant">MASSIVE</code> in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you now deal with the … … 52 52 alternatives, and then design and implement a solution. 53 53 </p><p> 54 <a class="indexterm" name="id35 2896"></a>54 <a class="indexterm" name="id351421"></a> 55 55 Remember, you have users based in London (UK), Los Angeles, 56 56 Washington. DC, and, three buildings in New York. A significant portion … … 73 73 DirectPointe. Your concern is server maintenance and third-level 74 74 support. Build a plan and show what must be done. 75 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 2928"></a>Dissection and Discussion</h2></div></div></div><p>76 <a class="indexterm" name="id35 2936"></a>77 <a class="indexterm" name="id35 2942"></a>75 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id351452"></a>Dissection and Discussion</h2></div></div></div><p> 76 <a class="indexterm" name="id351460"></a> 77 <a class="indexterm" name="id351467"></a> 78 78 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented an LDAP server that provided the 79 79 <em class="parameter"><code>passdb backend</code></em> for the Samba servers. You … … 81 81 took control of network performance. 82 82 </p><p> 83 <a class="indexterm" name="id35 2966"></a>84 <a class="indexterm" name="id35 2972"></a>85 <a class="indexterm" name="id35 2979"></a>86 <a class="indexterm" name="id35 2986"></a>83 <a class="indexterm" name="id351490"></a> 84 <a class="indexterm" name="id351497"></a> 85 <a class="indexterm" name="id351504"></a> 86 <a class="indexterm" name="id351510"></a> 87 87 The implementation of an LDAP-based passdb backend (known as 88 88 <span class="emphasis"><em>ldapsam</em></span> in Samba parlance), or some form of database … … 97 97 managers. 98 98 </p><p> 99 <a class="indexterm" name="id35 3021"></a>100 <a class="indexterm" name="id35 3028"></a>99 <a class="indexterm" name="id351546"></a> 100 <a class="indexterm" name="id351552"></a> 101 101 The new <span class="emphasis"><em>tdbsam</em></span> facility supports functionality 102 102 that is similar to an <span class="emphasis"><em>ldapsam</em></span>, but the lack of … … 106 106 backend? Is support for these tools broken? Answers to these 107 107 questions require a bit of background.</p><p> 108 <a class="indexterm" name="id35 3049"></a>109 <a class="indexterm" name="id35 3055"></a>110 <a class="indexterm" name="id35 3062"></a>111 <a class="indexterm" name="id35 3069"></a>108 <a class="indexterm" name="id351572"></a> 109 <a class="indexterm" name="id351579"></a> 110 <a class="indexterm" name="id351586"></a> 111 <a class="indexterm" name="id351593"></a> 112 112 <span class="emphasis"><em>What is a directory?</em></span> A directory is a 113 113 collection of information regarding objects that can be accessed to … … 117 117 information is organized to facilitate read access rather than to 118 118 support transaction processing.</p><p> 119 <a class="indexterm" name="id35 3086"></a>120 <a class="indexterm" name="id35 3095"></a>121 <a class="indexterm" name="id35 3102"></a>122 <a class="indexterm" name="id35 3109"></a>119 <a class="indexterm" name="id351610"></a> 120 <a class="indexterm" name="id351619"></a> 121 <a class="indexterm" name="id351626"></a> 122 <a class="indexterm" name="id351632"></a> 123 123 The Lightweight Directory Access Protocol (LDAP) differs 124 124 considerably from a traditional database. It has a simple search … … 127 127 the data repository and for keeping all copies (slaves) in sync with 128 128 the master repository.</p><p> 129 <a class="indexterm" name="id35 3122"></a>130 <a class="indexterm" name="id35 3129"></a>131 <a class="indexterm" name="id35 3135"></a>129 <a class="indexterm" name="id351646"></a> 130 <a class="indexterm" name="id351652"></a> 131 <a class="indexterm" name="id351659"></a> 132 132 Samba is a flexible and powerful file and print sharing 133 133 technology. It can use many external authentication sources and can be … … 137 137 avoid the proprietary implications of Microsoft Active Directory 138 138 naturally gravitate toward OpenLDAP.</p><p> 139 <a class="indexterm" name="id35 3149"></a>139 <a class="indexterm" name="id351673"></a> 140 140 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you had to deal with a locally routed 141 141 network. All deployment concerns focused around making users happy, … … 148 148 access information globally. And you must make the network robust 149 149 enough so that it can sustain partial breakdown without causing loss of 150 productivity.</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id35 3175"></a>Technical Issues</h3></div></div></div><p>150 productivity.</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id351698"></a>Technical Issues</h3></div></div></div><p> 151 151 There are at least three areas that need to be addressed as you 152 152 approach the challenge of designing a network solution for the newly 153 153 expanded business: 154 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id35 3189"></a>155 User needs such as mobility and data access</p></li><li class="listitem"><p>The nature of Windows networking protocols</p></li><li class="listitem"><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" title="User Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id35 3212"></a>User Needs</h4></div></div></div><p>154 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id351713"></a> 155 User needs such as mobility and data access</p></li><li class="listitem"><p>The nature of Windows networking protocols</p></li><li class="listitem"><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" title="User Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id351735"></a>User Needs</h4></div></div></div><p> 156 156 The new company has three divisions. Staff for each division are spread across 157 157 the company. Some staff are office-bound and some are mobile users. Mobile … … 164 164 off for reasons outside the scope of this discussion. 165 165 </p><p> 166 <a class="indexterm" name="id35 3231"></a>166 <a class="indexterm" name="id351755"></a> 167 167 Decisions must be made regarding where data is to be stored, how it will be 168 168 replicated (if at all), and what the network bandwidth implications are. For … … 175 175 to the network. 176 176 </p><p> 177 <a class="indexterm" name="id35 3252"></a>178 <a class="indexterm" name="id35 3262"></a>177 <a class="indexterm" name="id351776"></a> 178 <a class="indexterm" name="id351785"></a> 179 179 No matter which way you look at this, the bandwidth requirements 180 180 for acceptable performance are substantial even if only 10 percent of … … 189 189 server to and from the client. 190 190 </p><p> 191 <a class="indexterm" name="id35 3277"></a>191 <a class="indexterm" name="id351801"></a> 192 192 Obviously then, user needs and wide-area practicalities dictate the economic and 193 193 technical aspects of your network design as well as for standard operating procedures. 194 </p></div><div class="sect3" title="The Nature of Windows Networking Protocols"><div class="titlepage"><div><div><h4 class="title"><a name="id35 3288"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p>195 <a class="indexterm" name="id35 3296"></a>194 </p></div><div class="sect3" title="The Nature of Windows Networking Protocols"><div class="titlepage"><div><div><h4 class="title"><a name="id351811"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p> 195 <a class="indexterm" name="id351819"></a> 196 196 Network logons that include roaming profile handling requires from 140 KB to 2 MB. 197 197 The inclusion of support for a minimal set of common desktop applications can push … … 201 201 part of a total service-level assurance program that might be implemented. 202 202 </p><p> 203 <a class="indexterm" name="id35 3312"></a>204 <a class="indexterm" name="id35 3319"></a>203 <a class="indexterm" name="id351836"></a> 204 <a class="indexterm" name="id351843"></a> 205 205 One way to reduce the network bandwidth impact of user logon 206 206 traffic is through folder redirection. In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you … … 211 211 logon or logout. Redirected folders are analogous to network drive 212 212 connections. 213 </p><p><a class="indexterm" name="id35 3343"></a>213 </p><p><a class="indexterm" name="id351867"></a> 214 214 Of course, network applications should only be run off 215 215 local application servers. As a general rule, even with 2 Mb/sec … … 218 218 server that is located in New York. 219 219 </p><p> 220 <a class="indexterm" name="id35 3356"></a>220 <a class="indexterm" name="id351879"></a> 221 221 When network bandwidth becomes a precious commodity (that is most 222 222 of the time), there is a significant demand to understand network … … 227 227 the network, several important things must happen. 228 228 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 229 <a class="indexterm" name="id35 3375"></a>229 <a class="indexterm" name="id351899"></a> 230 230 The client obtains an IP address via DHCP. (DHCP is 231 231 necessary so that users can roam between offices.) 232 232 </p></li><li class="listitem"><p> 233 <a class="indexterm" name="id35 3387"></a>234 <a class="indexterm" name="id35 3394"></a>233 <a class="indexterm" name="id351911"></a> 234 <a class="indexterm" name="id351918"></a> 235 235 The client must register itself with the WINS and/or DNS server. 236 236 </p></li><li class="listitem"><p> 237 <a class="indexterm" name="id35 3406"></a>237 <a class="indexterm" name="id351929"></a> 238 238 The client must locate the closest domain controller. 239 239 </p></li><li class="listitem"><p> … … 257 257 at the WINS server. 258 258 </p><p> 259 <a class="indexterm" name="id35 3444"></a>260 <a class="indexterm" name="id35 3450"></a><a class="indexterm" name="id353460"></a>259 <a class="indexterm" name="id351967"></a> 260 <a class="indexterm" name="id351974"></a><a class="indexterm" name="id351983"></a> 261 261 Given that the client is already a domain member, it then sends 262 262 a directed (Unicast) request to the WINS server seeking the list of 263 263 IP addresses for domain controllers (NetBIOS name type 0x1C). The 264 264 WINS server replies with the information requested.</p><p> 265 <a class="indexterm" name="id35 3472"></a>266 <a class="indexterm" name="id35 3481"></a>267 <a class="indexterm" name="id35 3488"></a>265 <a class="indexterm" name="id351995"></a> 266 <a class="indexterm" name="id352004"></a> 267 <a class="indexterm" name="id352011"></a> 268 268 The client sends two netlogon mailslot broadcast requests 269 269 to the local network and to each of the IP addresses returned by … … 275 275 domain controllers. 276 276 </p><p> 277 <a class="indexterm" name="id35 3502"></a>278 <a class="indexterm" name="id35 3511"></a>279 <a class="indexterm" name="id35 3518"></a>277 <a class="indexterm" name="id352025"></a> 278 <a class="indexterm" name="id352035"></a> 279 <a class="indexterm" name="id352041"></a> 280 280 The logon process begins with negotiation of the SMB/CIFS 281 281 protocols that are to be used; this is followed by an exchange of … … 288 288 local domain controllers fail or break? 289 289 </p><p> 290 <a class="indexterm" name="id35 3533"></a>291 <a class="indexterm" name="id35 3540"></a>292 <a class="indexterm" name="id35 3546"></a>293 <a class="indexterm" name="id35 3553"></a>290 <a class="indexterm" name="id352056"></a> 291 <a class="indexterm" name="id352063"></a> 292 <a class="indexterm" name="id352070"></a> 293 <a class="indexterm" name="id352076"></a> 294 294 Under most circumstances, the nearest domain controller 295 295 responds to the netlogon mailslot broadcast. The exception to this … … 300 300 domain controllers are by definition BDCs. 301 301 </p><p> 302 <a class="indexterm" name="id35 3566"></a>303 <a class="indexterm" name="id35 3573"></a>302 <a class="indexterm" name="id352090"></a> 303 <a class="indexterm" name="id352097"></a> 304 304 The provision of sufficient servers that are BDCs is an 305 305 important design factor. The second important design factor … … 307 307 data. That is the subject of the next section, which involves key 308 308 decisions regarding Identity Management facilities. 309 </p></div><div class="sect3" title="Identity Management Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id35 3585"></a>Identity Management Needs</h4></div></div></div><p>310 <a class="indexterm" name="id35 3593"></a>311 <a class="indexterm" name="id35 3600"></a>312 <a class="indexterm" name="id35 3606"></a>313 <a class="indexterm" name="id35 3613"></a>309 </p></div><div class="sect3" title="Identity Management Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id352108"></a>Identity Management Needs</h4></div></div></div><p> 310 <a class="indexterm" name="id352116"></a> 311 <a class="indexterm" name="id352123"></a> 312 <a class="indexterm" name="id352130"></a> 313 <a class="indexterm" name="id352136"></a> 314 314 Network managers recognize that in large organizations users 315 315 generally need to be given resource access based on needs, while … … 320 320 rights and privileges are allocated. 321 321 </p><p> 322 <a class="indexterm" name="id35 3627"></a>323 <a class="indexterm" name="id35 3634"></a>324 <a class="indexterm" name="id35 3640"></a>322 <a class="indexterm" name="id352150"></a> 323 <a class="indexterm" name="id352157"></a> 324 <a class="indexterm" name="id352164"></a> 325 325 Unfortunately, network resources tend to have their own Identity 326 326 Management facilities, the quality and manageability of which varies … … 334 334 as <code class="constant">Network Information System</code> (NIS). 335 335 </p><p> 336 <a class="indexterm" name="id35 3666"></a>336 <a class="indexterm" name="id352189"></a> 337 337 NIS gained a strong following throughout the UNIX/VMS space in a short 338 338 period of time and retained that appeal and use for over a decade. … … 344 344 other information systems is catching on. 345 345 </p><p> 346 <a class="indexterm" name="id35 3681"></a>347 <a class="indexterm" name="id35 3687"></a>348 <a class="indexterm" name="id35 3694"></a>346 <a class="indexterm" name="id352204"></a> 347 <a class="indexterm" name="id352211"></a> 348 <a class="indexterm" name="id352217"></a> 349 349 Nevertheless, both NIS and NIS+ continue to hold ground in 350 350 business areas where UNIX still has major sway. Examples of … … 354 354 focus. 355 355 </p><p> 356 <a class="indexterm" name="id35 3707"></a>357 <a class="indexterm" name="id35 3714"></a>356 <a class="indexterm" name="id352230"></a> 357 <a class="indexterm" name="id352237"></a> 358 358 Today's networking world needs a scalable, distributed Identity 359 359 Management infrastructure, commonly called a directory. The most … … 361 361 and a number of LDAP implementations. 362 362 </p><p> 363 <a class="indexterm" name="id35 3726"></a>363 <a class="indexterm" name="id352249"></a> 364 364 The problem of managing multiple directories has become a focal 365 365 point over the past decade, creating a large market for … … 370 370 having to remember and deal with fewer login identities and 371 371 passwords.</p><p> 372 <a class="indexterm" name="id35 3740"></a>372 <a class="indexterm" name="id352263"></a> 373 373 The challenge of every large network is to find the optimum 374 374 balance of internal systems and facilities for Identity … … 376 376 implemented has potentially significant impact on network bandwidth 377 377 and systems response needs.</p><p> 378 <a class="indexterm" name="id35 3754"></a>379 <a class="indexterm" name="id35 3761"></a>380 <a class="indexterm" name="id35 3770"></a>378 <a class="indexterm" name="id352278"></a> 379 <a class="indexterm" name="id352285"></a> 380 <a class="indexterm" name="id352294"></a> 381 381 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented a single LDAP server for the 382 382 entire network. This may work for smaller networks, but almost … … 387 387 servers within the context of a distributed 2,000-user network is a 388 388 question that remains to be answered.</p><p> 389 <a class="indexterm" name="id35 3796"></a>390 <a class="indexterm" name="id35 3803"></a>389 <a class="indexterm" name="id352319"></a> 390 <a class="indexterm" name="id352326"></a> 391 391 One possibility that has great appeal is to create a single, 392 392 large distributed domain. The practical implications of this … … 399 399 maintenance. 400 400 </p><p> 401 <a class="indexterm" name="id35 3826"></a>401 <a class="indexterm" name="id352350"></a> 402 402 The network design in <a class="link" href="net2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">“Network Topology 2000 User Complex Design B”</a> takes the approach 403 403 that management of networks that are too remote to be managed … … 410 410 in how they may access global resources. 411 411 </p><p> 412 <a class="indexterm" name="id35 3848"></a>412 <a class="indexterm" name="id352371"></a> 413 413 Desk-bound users need not be negatively affected by this design, since 414 414 the use of interdomain trusts can be used to satisfy the need for global 415 415 data sharing. 416 416 </p><p> 417 <a class="indexterm" name="id35 3859"></a>418 <a class="indexterm" name="id35 3866"></a>419 <a class="indexterm" name="id35 3875"></a>417 <a class="indexterm" name="id352382"></a> 418 <a class="indexterm" name="id352389"></a> 419 <a class="indexterm" name="id352398"></a> 420 420 When Samba-3 is configured to use an LDAP backend, it stores the domain 421 421 account information in a directory entry. This account entry contains the … … 423 423 possible to operate with more than one PDC on a distributed network. 424 424 </p><p> 425 <a class="indexterm" name="id35 3887"></a>426 <a class="indexterm" name="id35 3894"></a>427 <a class="indexterm" name="id35 3901"></a>425 <a class="indexterm" name="id352411"></a> 426 <a class="indexterm" name="id352417"></a> 427 <a class="indexterm" name="id352424"></a> 428 428 How might this peculiar feature be exploited? The answer is simple. It is 429 429 imperative that each network segment have its own WINS server. Major … … 435 435 single LDAP backend, users have unfettered ability to roam. 436 436 </p><p> 437 <a class="indexterm" name="id35 3921"></a>438 <a class="indexterm" name="id35 3930"></a>437 <a class="indexterm" name="id352444"></a> 438 <a class="indexterm" name="id352454"></a> 439 439 This concept has not been exhaustively validated, though we can see no reason 440 440 why this should not work. The important facets are the following: The name of … … 447 447 that are in fact slave LDAP servers on the local segments. 448 448 </p><p> 449 <a class="indexterm" name="id35 3946"></a>450 <a class="indexterm" name="id35 3956"></a>451 <a class="indexterm" name="id35 3962"></a>452 <a class="indexterm" name="id35 3972"></a>449 <a class="indexterm" name="id352470"></a> 450 <a class="indexterm" name="id352479"></a> 451 <a class="indexterm" name="id352486"></a> 452 <a class="indexterm" name="id352495"></a> 453 453 With a single master LDAP server, all network updates are effected on a single 454 454 server. In the event that this should become excessively fragile or network … … 464 464 procedures for managing the directory, because retroactive correction of 465 465 inconsistent directory information can be exceedingly difficult. 466 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id35 3997"></a>Political Issues</h3></div></div></div><p>466 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id352520"></a>Political Issues</h3></div></div></div><p> 467 467 As organizations grow, the number of points of control increases 468 468 also. In a large distributed organization, it is important that the … … 472 472 minutes rather than days (the old limitation of highly manual 473 473 systems). 474 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 4011"></a>Implementation</h2></div></div></div><p>475 <a class="indexterm" name="id35 4019"></a>476 <a class="indexterm" name="id35 4026"></a>477 <a class="indexterm" name="id35 4032"></a>478 <a class="indexterm" name="id35 4039"></a>474 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352534"></a>Implementation</h2></div></div></div><p> 475 <a class="indexterm" name="id352542"></a> 476 <a class="indexterm" name="id352549"></a> 477 <a class="indexterm" name="id352556"></a> 478 <a class="indexterm" name="id352562"></a> 479 479 Samba-3 has the ability to use multiple password (authentication and 480 480 identity resolution) backends. The diagram in <a class="link" href="net2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">“Samba and Authentication Backend Search Pathways”</a> … … 484 484 using the specific systems shown. 485 485 </p><div class="figure"><a name="chap7idres"></a><p class="title"><b>Figure 6.1. Samba and Authentication Backend Search Pathways</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-idresol.png" width="297" alt="Samba and Authentication Backend Search Pathways"></div></div></div><br class="figure-break"><p> 486 <a class="indexterm" name="id35 4099"></a>487 <a class="indexterm" name="id35 4106"></a>488 <a class="indexterm" name="id35 4113"></a>489 <a class="indexterm" name="id35 4120"></a>490 <a class="indexterm" name="id35 4126"></a>491 <a class="indexterm" name="id35 4133"></a>492 <a class="indexterm" name="id35 4140"></a>486 <a class="indexterm" name="id352623"></a> 487 <a class="indexterm" name="id352630"></a> 488 <a class="indexterm" name="id352637"></a> 489 <a class="indexterm" name="id352643"></a> 490 <a class="indexterm" name="id352650"></a> 491 <a class="indexterm" name="id352657"></a> 492 <a class="indexterm" name="id352664"></a> 493 493 Samba is capable of using the <code class="constant">smbpasswd</code>, 494 494 <code class="constant">tdbsam</code>, <code class="constant">xmlsam</code>, … … 498 498 operations. 499 499 </p><p> 500 <a class="indexterm" name="id35 4166"></a>500 <a class="indexterm" name="id352690"></a> 501 501 Additionally, it is possible to use multiple passdb backends 502 502 concurrently as well as have multiple LDAP backends. As a result, you … … 510 510 This configuration tells Samba to use a single LDAP server, as shown in <a class="link" href="net2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">“Samba Configuration to Use a Single LDAP Server”</a>. 511 511 </p><div class="figure"><a name="ch7singleLDAP"></a><p class="title"><b>Figure 6.2. Samba Configuration to Use a Single LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-singleLDAP.png" width="351" alt="Samba Configuration to Use a Single LDAP Server"></div></div></div><p><br class="figure-break"> 512 <a class="indexterm" name="id35 4234"></a>513 <a class="indexterm" name="id35 4244"></a>512 <a class="indexterm" name="id352758"></a> 513 <a class="indexterm" name="id352768"></a> 514 514 The addition of a failover LDAP server can simply be done by adding a 515 515 second entry for the failover server to the single <em class="parameter"><code>ldapsam</code></em> … … 533 533 ... 534 534 </pre><p> 535 <a class="indexterm" name="id35 4323"></a>535 <a class="indexterm" name="id352848"></a> 536 536 The effect of this style of entry is that Samba lists the users 537 537 that are in both LDAP databases. If both contain the same information, … … 554 554 pattern similar to what was covered in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. The following steps 555 555 permit the operation of a master/slave OpenLDAP arrangement. 556 </p><div class="procedure" title="Procedure 6.1. Implementation Steps for an LDAP Slave Server"><a name="id35 4454"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>557 <a class="indexterm" name="id35 4465"></a>558 <a class="indexterm" name="id35 4472"></a>556 </p><div class="procedure" title="Procedure 6.1. Implementation Steps for an LDAP Slave Server"><a name="id352976"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 557 <a class="indexterm" name="id352987"></a> 558 <a class="indexterm" name="id352994"></a> 559 559 Log onto the master LDAP server as <code class="constant">root</code>. 560 560 You are about to change the configuration of the LDAP server, so it … … 569 569 </pre><p> 570 570 </p></li><li class="step" title="Step 2"><p> 571 <a class="indexterm" name="id35 4514"></a>571 <a class="indexterm" name="id353036"></a> 572 572 Edit the <code class="filename">/etc/openldap/slapd.conf</code> file so it 573 573 matches the content of <a class="link" href="net2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">“LDAP Master Server Configuration File /etc/openldap/slapd.conf”</a>. … … 593 593 </pre><p> 594 594 </p></li><li class="step" title="Step 5"><p> 595 <a class="indexterm" name="id35 4583"></a>596 <a class="indexterm" name="id35 4590"></a>595 <a class="indexterm" name="id353106"></a> 596 <a class="indexterm" name="id353112"></a> 597 597 Change directory to a suitable place to dump the contents of the 598 598 LDAP server. The dump file (and LDIF file) is used to preload … … 603 603 Each record is written to the file. 604 604 </p></li><li class="step" title="Step 6"><p> 605 <a class="indexterm" name="id35 4620"></a>605 <a class="indexterm" name="id353142"></a> 606 606 Copy the file <code class="filename">LDAP-transfer-LDIF.txt</code> to the intended 607 607 slave LDAP server. A good location could be in the directory … … 653 653 </pre><p> 654 654 </p></li><li class="step" title="Step 10"><p> 655 <a class="indexterm" name="id35 4767"></a>656 <a class="indexterm" name="id35 4774"></a>657 <a class="indexterm" name="id35 4781"></a>655 <a class="indexterm" name="id353290"></a> 656 <a class="indexterm" name="id353296"></a> 657 <a class="indexterm" name="id353303"></a> 658 658 Go back to the master LDAP server. Execute the following to start LDAP as well 659 659 as <code class="literal">slurpd</code>, the synchronization daemon, as shown here: … … 664 664 <code class="prompt">root# </code> chkconfig slurpd on 665 665 </pre><p> 666 <a class="indexterm" name="id35 4824"></a>666 <a class="indexterm" name="id353347"></a> 667 667 On Red Hat Linux, check the equivalent command to start <code class="literal">slurpd</code>. 668 668 </p></li><li class="step" title="Step 11"><p> 669 <a class="indexterm" name="id35 4844"></a>669 <a class="indexterm" name="id353367"></a> 670 670 On the master LDAP server you may now add an account to validate that replication 671 671 is working. Assuming the configuration shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, execute: … … 792 792 index sambaDomainName eq 793 793 index default sub 794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id35 5074"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id355085"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id355097"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355108"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id355120"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id355131"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355143"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id355154"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355166"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id355177"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id355189"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355200"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id355212"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355224"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355236"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355248"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355259"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355272"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355284"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355296"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355308"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id355319"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id355331"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id355343"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id355354"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id355366"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355377"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355389"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355400"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355412"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355423"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355435"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id355447"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id355458"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355470"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355482"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355493"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355505"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id355516"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id355561"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id355581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id355593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id355604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id355625"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id355636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id355648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id355668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id355680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id355691"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id355712"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id355723"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id355735"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355746"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id355767"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id355778"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id355790"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355801"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355813"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id355857"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id355869"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id355880"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id355892"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id355912"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id355924"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id355936"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id355947"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355959"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id355979"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id355990"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356002"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356034"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356046"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id356057"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356069"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id356089"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356101"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356112"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id356124"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356172"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id356183"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id356195"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id356206"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356218"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id356229"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id356241"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356252"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id356264"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id356275"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356287"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id356298"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id356310"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id356322"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id356333"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id356345"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id356356"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356368"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id356379"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id356391"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id356402"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356414"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356425"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356437"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id356449"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id356460"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356472"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356483"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356495"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356507"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356518"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id356538"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id356550"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id356562"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id356582"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id356594"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id356605"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id356650"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id356661"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id356673"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356693"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356705"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356716"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356728"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356748"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356760"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356771"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356783"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356794"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id356815"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id356826"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id356838"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id356849"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id356870"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id356881"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id356893"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356904"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id356925"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id356936"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356948"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356959"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356980"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356991"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id357003"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id357014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id357027"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>795 <a class="indexterm" name="id35 7038"></a><a class="indexterm" name="id357043"></a>794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id353596"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id353608"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id353619"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id353631"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id353643"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id353654"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id353666"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id353677"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id353689"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id353700"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id353712"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id353723"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id353735"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353746"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353758"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id353770"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id353782"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353794"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353806"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353818"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id353830"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id353842"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id353854"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id353865"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id353877"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id353888"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id353900"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id353911"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id353923"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id353934"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id353946"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id353958"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id353969"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id353981"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id353993"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id354004"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id354016"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id354027"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id354039"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id354084"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id354104"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id354116"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id354127"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id354148"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id354159"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id354171"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id354191"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id354203"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id354214"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id354234"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id354246"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id354258"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id354269"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id354289"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id354301"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id354312"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id354324"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id354335"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id354381"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id354392"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id354404"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id354415"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id354436"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id354447"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id354459"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id354470"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id354482"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id354502"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id354514"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id354525"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id354537"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id354557"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id354569"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id354580"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id354592"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id354612"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id354624"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id354636"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id354647"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id354695"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id354706"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id354718"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id354729"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id354741"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id354753"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id354764"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id354776"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id354787"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id354799"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id354810"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id354822"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id354833"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id354845"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id354856"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id354868"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id354880"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id354891"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id354902"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id354914"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id354926"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id354937"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id354949"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id354960"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id354972"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id354984"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id354995"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355007"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355018"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355030"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355041"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id355062"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id355073"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id355085"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id355105"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id355117"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id355128"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id355174"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id355185"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id355197"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id355217"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id355229"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id355240"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355252"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id355272"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id355284"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id355295"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355307"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355318"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id355338"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id355350"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id355362"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id355373"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id355393"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id355405"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id355417"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355428"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id355448"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id355460"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id355472"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355483"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id355503"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id355515"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id355527"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355538"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id355551"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 795 <a class="indexterm" name="id355562"></a><a class="indexterm" name="id355567"></a> 796 796 Where Samba-3 is used as a domain controller, the use of LDAP is an 797 797 essential component to permit the use of BDCs. 798 798 </p></li><li class="listitem"><p> 799 <a class="indexterm" name="id35 7055"></a>799 <a class="indexterm" name="id355579"></a> 800 800 Replication of the LDAP master server to create a network of BDCs 801 801 is an important mechanism for limiting WAN traffic. … … 809 809 departure from this may clog wide-area arteries and slow legitimate network 810 810 traffic to a crawl. 811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 7166"></a>Questions and Answers</h2></div></div></div><p>811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id355690"></a>Questions and Answers</h2></div></div></div><p> 812 812 There is much rumor and misinformation regarding the use of MS Windows networking protocols. 813 813 These questions are just a few of those frequently asked. 814 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id35 7176"></a><dl><dt> <a href="net2000users.html#id357182">814 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id355700"></a><dl><dt> <a href="net2000users.html#id355707"> 815 815 816 816 817 817 Is it true that DHCP uses lots of WAN bandwidth? 818 </a></dt><dt> <a href="net2000users.html#id35 7303">818 </a></dt><dt> <a href="net2000users.html#id355828"> 819 819 820 820 821 821 How much background communication takes place between a master LDAP server and its slave LDAP servers? 822 </a></dt><dt> <a href="net2000users.html#id35 7360">822 </a></dt><dt> <a href="net2000users.html#id355885"> 823 823 LDAP has a database. Is LDAP not just a fancy database front end? 824 </a></dt><dt> <a href="net2000users.html#id35 7417">824 </a></dt><dt> <a href="net2000users.html#id355941"> 825 825 826 826 Can Active Directory obtain account information from an OpenLDAP server? 827 </a></dt><dt> <a href="net2000users.html#id35 7449">827 </a></dt><dt> <a href="net2000users.html#id355974"> 828 828 What are the parts of a roaming profile? How large is each part? 829 </a></dt><dt> <a href="net2000users.html#id35 7590">829 </a></dt><dt> <a href="net2000users.html#id356115"> 830 830 Can the My Documents folder be stored on a network drive? 831 </a></dt><dt> <a href="net2000users.html#id35 7635">831 </a></dt><dt> <a href="net2000users.html#id356159"> 832 832 833 833 834 834 835 835 How much WAN bandwidth does WINS consume? 836 </a></dt><dt> <a href="net2000users.html#id35 7712">836 </a></dt><dt> <a href="net2000users.html#id356236"> 837 837 How many BDCs should I have? What is the right number of Windows clients per server? 838 </a></dt><dt> <a href="net2000users.html#id35 7739">838 </a></dt><dt> <a href="net2000users.html#id356263"> 839 839 840 840 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 841 841 run an NIS server? 842 </a></dt><dt> <a href="net2000users.html#id35 7770">842 </a></dt><dt> <a href="net2000users.html#id356294"> 843 843 Can I use NIS in place of LDAP? 844 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id35 7182"></a><a name="id357185"></a></td><td align="left" valign="top"><p>845 <a class="indexterm" name="id35 7189"></a>846 <a class="indexterm" name="id35 7196"></a>844 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id355707"></a><a name="id355709"></a></td><td align="left" valign="top"><p> 845 <a class="indexterm" name="id355713"></a> 846 <a class="indexterm" name="id355720"></a> 847 847 Is it true that DHCP uses lots of WAN bandwidth? 848 848 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 849 <a class="indexterm" name="id35 7212"></a>850 <a class="indexterm" name="id35 7221"></a>851 <a class="indexterm" name="id35 7228"></a>849 <a class="indexterm" name="id355736"></a> 850 <a class="indexterm" name="id355745"></a> 851 <a class="indexterm" name="id355752"></a> 852 852 It is a smart practice to localize DHCP servers on each network segment. As a 853 853 rule, there should be two DHCP servers per network segment. This means that if … … 856 856 routers. This makes it possible to run fewer DHCP servers. 857 857 </p><p> 858 <a class="indexterm" name="id35 7244"></a>859 <a class="indexterm" name="id35 7253"></a>858 <a class="indexterm" name="id355768"></a> 859 <a class="indexterm" name="id355777"></a> 860 860 A DHCP network address request and confirmation usually results in about six UDP packets. 861 861 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP … … 875 875 From this can be seen that the traffic impact would be minimal. 876 876 </p><p> 877 <a class="indexterm" name="id35 7282"></a>878 <a class="indexterm" name="id35 7291"></a>877 <a class="indexterm" name="id355807"></a> 878 <a class="indexterm" name="id355816"></a> 879 879 Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link, 880 880 the impact of the update is no more than the DHCP IP address renewal traffic and thus 881 881 still insignificant for most practical purposes. 882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7303"></a><a name="id357305"></a></td><td align="left" valign="top"><p>883 <a class="indexterm" name="id35 7310"></a>884 <a class="indexterm" name="id35 7317"></a>882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id355828"></a><a name="id355830"></a></td><td align="left" valign="top"><p> 883 <a class="indexterm" name="id355834"></a> 884 <a class="indexterm" name="id355841"></a> 885 885 How much background communication takes place between a master LDAP server and its slave LDAP servers? 886 886 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 887 <a class="indexterm" name="id35 7336"></a>887 <a class="indexterm" name="id355860"></a> 888 888 The process that controls the replication of data from the master LDAP server to the slave LDAP 889 889 servers is called <code class="literal">slurpd</code>. The <code class="literal">slurpd</code> remains nascent (quiet) 890 890 until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete) 891 891 two user accounts requires less than 10KB traffic. 892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7360"></a><a name="id357362"></a></td><td align="left" valign="top"><p>892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id355885"></a><a name="id355887"></a></td><td align="left" valign="top"><p> 893 893 LDAP has a database. Is LDAP not just a fancy database front end? 894 894 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 895 <a class="indexterm" name="id35 7374"></a>896 <a class="indexterm" name="id35 7381"></a>897 <a class="indexterm" name="id35 7390"></a>898 <a class="indexterm" name="id35 7396"></a>895 <a class="indexterm" name="id355898"></a> 896 <a class="indexterm" name="id355905"></a> 897 <a class="indexterm" name="id355914"></a> 898 <a class="indexterm" name="id355921"></a> 899 899 LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific 900 900 data storage system. This type of database is indexed so that records can be rapidly located, but the … … 905 905 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific 906 906 simple queries. The term <code class="constant">database</code> is heavily overloaded and thus much misunderstood. 907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7417"></a><a name="id357419"></a></td><td align="left" valign="top"><p>908 <a class="indexterm" name="id35 7423"></a>907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id355941"></a><a name="id355943"></a></td><td align="left" valign="top"><p> 908 <a class="indexterm" name="id355948"></a> 909 909 Can Active Directory obtain account information from an OpenLDAP server? 910 910 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 911 <a class="indexterm" name="id35 7437"></a>911 <a class="indexterm" name="id355962"></a> 912 912 No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP 913 913 database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface 914 914 to OpenLDAP using standard LDAP queries and updates. 915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7449"></a><a name="id357452"></a></td><td align="left" valign="top"><p>915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id355974"></a><a name="id355976"></a></td><td align="left" valign="top"><p> 916 916 What are the parts of a roaming profile? How large is each part? 917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id35 7462"></a>917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id355986"></a> 918 918 A roaming profile consists of 919 919 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> … … 923 923 <code class="constant">Local Settings,</code> and more. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 924 924 </p><p> 925 <a class="indexterm" name="id35 7521"></a>925 <a class="indexterm" name="id356045"></a> 926 926 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all 927 927 such folders can be redirected to network drive resources. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a> … … 930 930 A static or rewritable portion that is typically only a few files (2-5 KB of information). 931 931 </p></li><li class="listitem"><p> 932 <a class="indexterm" name="id35 7545"></a>933 <a class="indexterm" name="id35 7551"></a>932 <a class="indexterm" name="id356069"></a> 933 <a class="indexterm" name="id356076"></a> 934 934 The registry load file that modifies the <code class="constant">HKEY_LOCAL_USER</code> hive. This is 935 935 the <code class="filename">NTUSER.DAT</code> file. It can be from 0.4 to 1.5 MB. 936 936 </p></li></ul></div><p> 937 <a class="indexterm" name="id35 7573"></a>937 <a class="indexterm" name="id356097"></a> 938 938 Microsoft Outlook PST files may be stored in the <code class="constant">Local Settings\Application Data</code> 939 939 folder. It can be up to 2 GB in size per PST file. 940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7590"></a><a name="id357592"></a></td><td align="left" valign="top"><p>940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id356115"></a><a name="id356117"></a></td><td align="left" valign="top"><p> 941 941 Can the <code class="constant">My Documents</code> folder be stored on a network drive? 942 942 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 943 <a class="indexterm" name="id35 7607"></a>944 <a class="indexterm" name="id35 7614"></a>943 <a class="indexterm" name="id356132"></a> 944 <a class="indexterm" name="id356138"></a> 945 945 Yes. More correctly, such folders can be redirected to network shares. No specific network drive 946 946 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal 947 947 Naming Convention) resource, though it is possible to specify a network drive letter instead of a 948 948 UNC name. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7635"></a><a name="id357637"></a></td><td align="left" valign="top"><p>950 <a class="indexterm" name="id35 7641"></a>951 <a class="indexterm" name="id35 7648"></a>952 <a class="indexterm" name="id35 7657"></a>949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id356159"></a><a name="id356162"></a></td><td align="left" valign="top"><p> 950 <a class="indexterm" name="id356166"></a> 951 <a class="indexterm" name="id356173"></a> 952 <a class="indexterm" name="id356182"></a> 953 953 How much WAN bandwidth does WINS consume? 954 954 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 955 <a class="indexterm" name="id35 7671"></a>956 <a class="indexterm" name="id35 7680"></a>957 <a class="indexterm" name="id35 7687"></a>955 <a class="indexterm" name="id356196"></a> 956 <a class="indexterm" name="id356205"></a> 957 <a class="indexterm" name="id356212"></a> 958 958 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. 959 959 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS … … 967 967 In conclusion, the total load afforded through WINS traffic is again marginal to total operational 968 968 usage as it should be. 969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7712"></a><a name="id357714"></a></td><td align="left" valign="top"><p>969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id356236"></a><a name="id356238"></a></td><td align="left" valign="top"><p> 970 970 How many BDCs should I have? What is the right number of Windows clients per server? 971 971 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 981 981 As unsatisfactory as the answer might sound, it all depends on network and server load 982 982 characteristics. 983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7739"></a><a name="id357741"></a></td><td align="left" valign="top"><p>984 <a class="indexterm" name="id35 7745"></a><a class="indexterm" name="id357751"></a>983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id356263"></a><a name="id356265"></a></td><td align="left" valign="top"><p> 984 <a class="indexterm" name="id356269"></a><a class="indexterm" name="id356275"></a> 985 985 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 986 986 run an NIS server? … … 989 989 a configurable schema that can store far more information for many more purposes than 990 990 just NIS. 991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id35 7770"></a><a name="id357772"></a></td><td align="left" valign="top"><p>991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id356294"></a><a name="id356296"></a></td><td align="left" valign="top"><p> 992 992 Can I use NIS in place of LDAP? 993 993 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 994 <a class="indexterm" name="id35 7783"></a>995 <a class="indexterm" name="id35 7790"></a>994 <a class="indexterm" name="id356308"></a> 995 <a class="indexterm" name="id356314"></a> 996 996 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal 997 997 with the types of data necessary for interoperability with Microsoft Windows networking. The use -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/ntmigration.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 9. Migrating NT4 Domain to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id36 8988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 9. Migrating NT4 Domain to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id367517">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367593">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367644">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id367806">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id368109">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id368129">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id368253">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370444">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id370790">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id370824">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 8988"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id368994"></a>9 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id367517"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id367523"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id36 9009"></a>17 <a class="indexterm" name="id36 9016"></a>18 <a class="indexterm" name="id36 9025"></a>19 <a class="indexterm" name="id36 9035"></a>16 <a class="indexterm" name="id367538"></a> 17 <a class="indexterm" name="id367545"></a> 18 <a class="indexterm" name="id367554"></a> 19 <a class="indexterm" name="id367564"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id36 9049"></a>25 <a class="indexterm" name="id367578"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id36 9064"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id36 9071"></a>35 <a class="indexterm" name="id36 9078"></a>36 <a class="indexterm" name="id36 9085"></a>33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id367593"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id367600"></a> 35 <a class="indexterm" name="id367607"></a> 36 <a class="indexterm" name="id367614"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 9115"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id36 9123"></a>47 <a class="indexterm" name="id36 9129"></a>48 <a class="indexterm" name="id36 9135"></a>49 <a class="indexterm" name="id36 9147"></a>50 <a class="indexterm" name="id36 9158"></a>51 <a class="indexterm" name="id36 9165"></a>45 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id367644"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id367652"></a> 47 <a class="indexterm" name="id367658"></a> 48 <a class="indexterm" name="id367664"></a> 49 <a class="indexterm" name="id367676"></a> 50 <a class="indexterm" name="id367688"></a> 51 <a class="indexterm" name="id367694"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in … … 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 56 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id36 9187"></a>58 <a class="indexterm" name="id36 9194"></a>57 <a class="indexterm" name="id367717"></a> 58 <a class="indexterm" name="id367724"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id36 9214"></a>65 <a class="indexterm" name="id36 9223"></a>64 <a class="indexterm" name="id367743"></a> 65 <a class="indexterm" name="id367752"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id36 9237"></a>74 <a class="indexterm" name="id36 9246"></a>75 <a class="indexterm" name="id36 9253"></a>73 <a class="indexterm" name="id367767"></a> 74 <a class="indexterm" name="id367776"></a> 75 <a class="indexterm" name="id367783"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id36 9276"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id36 9284"></a>88 <a class="indexterm" name="id36 9291"></a>86 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id367806"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id367813"></a> 88 <a class="indexterm" name="id367820"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 … … 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id36 9358"></a>97 <a class="indexterm" name="id36 9365"></a>96 <a class="indexterm" name="id367887"></a> 97 <a class="indexterm" name="id367894"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id36 9383"></a>103 </p><p><a class="indexterm" name="id367912"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id36 9396"></a><a class="indexterm" name="id369404"></a><a class="indexterm" name="id369412"></a>107 </p><p><a class="indexterm" name="id367925"></a><a class="indexterm" name="id367933"></a><a class="indexterm" name="id367941"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id36 9427"></a>114 <a class="indexterm" name="id36 9433"></a>115 <a class="indexterm" name="id36 9440"></a>116 <a class="indexterm" name="id36 9447"></a>117 <a class="indexterm" name="id36 9454"></a>118 <a class="indexterm" name="id36 9461"></a>119 <a class="indexterm" name="id36 9467"></a>120 <a class="indexterm" name="id36 9474"></a>121 <a class="indexterm" name="id36 9481"></a>122 <a class="indexterm" name="id36 9488"></a>123 <a class="indexterm" name="id36 9495"></a>124 <a class="indexterm" name="id36 9501"></a>113 <a class="indexterm" name="id367956"></a> 114 <a class="indexterm" name="id367962"></a> 115 <a class="indexterm" name="id367969"></a> 116 <a class="indexterm" name="id367976"></a> 117 <a class="indexterm" name="id367983"></a> 118 <a class="indexterm" name="id367990"></a> 119 <a class="indexterm" name="id367996"></a> 120 <a class="indexterm" name="id368003"></a> 121 <a class="indexterm" name="id368010"></a> 122 <a class="indexterm" name="id368017"></a> 123 <a class="indexterm" name="id368024"></a> 124 <a class="indexterm" name="id368030"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id36 9580"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id368109"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 9600"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id368129"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX … … 165 165 migration to either a tdbsam or an ldapsam backend. 166 166 </p></li><li class="listitem"><p> 167 <a class="indexterm" name="id36 9676"></a>168 <a class="indexterm" name="id36 9682"></a>169 <a class="indexterm" name="id36 9688"></a>167 <a class="indexterm" name="id368205"></a> 168 <a class="indexterm" name="id368211"></a> 169 <a class="indexterm" name="id368218"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 175 175 </p></li><li class="listitem"><p> 176 176 Step through the migration process. 177 </p></li><li class="listitem"><p><a class="indexterm" name="id36 9706"></a>177 </p></li><li class="listitem"><p><a class="indexterm" name="id368235"></a> 178 178 Remove the NT4 PDC from the network. 179 179 </p></li><li class="listitem"><p> … … 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" title="NT4 Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id36 9724"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" title="NT4 Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id368253"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the … … 200 200 before commencing the following configuration steps. 201 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id36 9914"></a>203 <a class="indexterm" name="id36 9921"></a>204 <a class="indexterm" name="id36 9928"></a>202 <a class="indexterm" name="id368443"></a> 203 <a class="indexterm" name="id368450"></a> 204 <a class="indexterm" name="id368456"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 210 210 in the formal commands provided by Linux distributions (March 2004). 211 211 </p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id36 9961"></a>212 <a class="indexterm" name="id368489"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id36 9979"></a>216 <a class="indexterm" name="id368508"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure" title="Procedure 9.1. User Migration Steps"><a name="id36 9988"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id370046"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id370057"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id370068"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370080"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id370092"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370103"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id370115"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370126"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id370138"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id370149"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370161"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370173"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370185"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370197"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370209"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370221"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370233"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370245"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id370257"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370268"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370280"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id370291"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370303"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id370314"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370326"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id370337"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370349"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id370360"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id370372"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370384"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370395"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370407"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id370418"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id370430"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370441"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370453"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370464"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370476"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370487"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370499"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id370543"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id370555"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id370566"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id370587"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id370598"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id370610"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id370622"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370633"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id370653"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id370665"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id370676"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370688"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370699"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id370711"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id370731"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id370743"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id370754"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370766"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id370786"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id370798"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id370809"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370821"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id370841"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id370853"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id370864"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370876"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id370896"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id370908"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure" title="Procedure 9.1. User Migration Steps"><a name="id368517"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id368576"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id368587"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id368598"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id368610"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id368622"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id368633"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id368645"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id368656"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id368668"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id368679"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id368691"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id368703"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id368715"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id368727"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id368739"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id368751"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id368763"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id368775"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id368787"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id368798"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id368810"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id368821"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id368833"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id368844"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id368856"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id368867"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id368879"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id368890"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id368902"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id368914"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id368925"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id368937"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id368948"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id368960"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id368971"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id368983"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id368994"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id369006"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369017"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369029"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id369073"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id369085"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id369096"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id369116"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id369128"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id369140"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id369151"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id369163"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id369183"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id369195"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id369206"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369218"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369229"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id369240"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id369261"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id369272"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id369284"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369296"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id369316"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id369327"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id369339"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id369350"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id369371"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id369382"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id369394"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id369406"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id369426"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id369438"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 337 337 no account information can be deleted. 338 338 </p></li><li class="step" title="Step 2"><p> 339 <a class="indexterm" name="id3 70926"></a>339 <a class="indexterm" name="id369456"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. … … 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 344 </p></li><li class="step" title="Step 3"><p> 345 <a class="indexterm" name="id3 71025"></a>346 <a class="indexterm" name="id3 71032"></a>345 <a class="indexterm" name="id369553"></a> 346 <a class="indexterm" name="id369560"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 349 </p></li><li class="step" title="Step 4"><p> 350 <a class="indexterm" name="id3 71087"></a>350 <a class="indexterm" name="id369616"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. … … 393 393 </pre><p> 394 394 </p></li><li class="step" title="Step 7"><p> 395 <a class="indexterm" name="id3 71235"></a>396 <a class="indexterm" name="id3 71242"></a>397 <a class="indexterm" name="id3 71249"></a>398 <a class="indexterm" name="id3 71256"></a>395 <a class="indexterm" name="id369763"></a> 396 <a class="indexterm" name="id369770"></a> 397 <a class="indexterm" name="id369777"></a> 398 <a class="indexterm" name="id369784"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id3 71351"></a>493 <a class="indexterm" name="id3 71358"></a>494 <a class="indexterm" name="id3 71365"></a>495 <a class="indexterm" name="id3 71371"></a>492 <a class="indexterm" name="id369879"></a> 493 <a class="indexterm" name="id369886"></a> 494 <a class="indexterm" name="id369893"></a> 495 <a class="indexterm" name="id369900"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 546 546 This is expected behavior. 547 547 </p></li><li class="step" title="Step 12"><p> 548 <a class="indexterm" name="id37 1510"></a>548 <a class="indexterm" name="id370038"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 713 713 across, set up privileges, and set share and file/directory access controls. 714 714 </p></li><li class="step" title="Step 21"><p> 715 <a class="indexterm" name="id37 1765"></a>716 <a class="indexterm" name="id37 1772"></a>715 <a class="indexterm" name="id370293"></a> 716 <a class="indexterm" name="id370300"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so that … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" title="NT4 Migration Using tdbsam Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id37 1918"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" title="NT4 Migration Using tdbsam Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id370444"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure" title="Procedure 9.2. Migration Steps Using tdbsam"><a name="id37 1961"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>852 </p><div class="procedure" title="Procedure 9.2. Migration Steps Using tdbsam"><a name="id370488"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 853 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id37 1988"></a><a class="indexterm" name="id371996"></a>855 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id370515"></a><a class="indexterm" name="id370522"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a> so … … 859 859 </p></li><li class="step" title="Step 3"><p> 860 860 Start Samba as you have done previously. 861 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id37 2035"></a>861 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id370562"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id37 2068"></a>867 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id370595"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id37 2111"></a>907 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id370638"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li class="step" title="Step 7"><p><a class="indexterm" name="id37 2163"></a>939 </p></li><li class="step" title="Step 7"><p><a class="indexterm" name="id370690"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id37 2190"></a>965 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id370717"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li class="step" title="Step 9"><p><a class="indexterm" name="id37 2225"></a><a class="indexterm" name="id372233"></a>982 </p></li><li class="step" title="Step 9"><p><a class="indexterm" name="id370752"></a><a class="indexterm" name="id370760"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id37 2263"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id370790"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 988 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> … … 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 2297"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id37 2306"></a><dl><dt> <a href="ntmigration.html#id372313">998 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id370824"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id370833"></a><dl><dt> <a href="ntmigration.html#id370840"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id37 2349">1001 </a></dt><dt> <a href="ntmigration.html#id370876"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id37 2401">1003 </a></dt><dt> <a href="ntmigration.html#id370928"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id37 2571">1006 </a></dt><dt> <a href="ntmigration.html#id371098"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id37 2613">1008 </a></dt><dt> <a href="ntmigration.html#id371140"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id37 2728">1010 </a></dt><dt> <a href="ntmigration.html#id371255"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id37 2800">1013 </a></dt><dt> <a href="ntmigration.html#id371327"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id37 2858">1015 </a></dt><dt> <a href="ntmigration.html#id371385"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id37 2890">1017 </a></dt><dt> <a href="ntmigration.html#id371417"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id37 2987">1019 </a></dt><dt> <a href="ntmigration.html#id371514"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id37 2313"></a><a name="id372315"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372318"></a>1022 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id370840"></a><a name="id370842"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id370845"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2333"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id370860"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2349"></a><a name="id372351"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372354"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370876"></a><a name="id370878"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id370881"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2369"></a><a class="indexterm" name="id372377"></a><a class="indexterm" name="id372384"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id370896"></a><a class="indexterm" name="id370904"></a><a class="indexterm" name="id370911"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2401"></a><a name="id372403"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372406"></a><a class="indexterm" name="id372414"></a><a class="indexterm" name="id372422"></a><a class="indexterm" name="id372430"></a><a class="indexterm" name="id372438"></a><a class="indexterm" name="id372449"></a><a class="indexterm" name="id372460"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370928"></a><a name="id370930"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id370933"></a><a class="indexterm" name="id370941"></a><a class="indexterm" name="id370949"></a><a class="indexterm" name="id370957"></a><a class="indexterm" name="id370965"></a><a class="indexterm" name="id370976"></a><a class="indexterm" name="id370987"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2491"></a><a class="indexterm" name="id372499"></a><a class="indexterm" name="id372506"></a><a class="indexterm" name="id372514"></a><a class="indexterm" name="id372522"></a><a class="indexterm" name="id372530"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371018"></a><a class="indexterm" name="id371026"></a><a class="indexterm" name="id371033"></a><a class="indexterm" name="id371041"></a><a class="indexterm" name="id371049"></a><a class="indexterm" name="id371057"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2571"></a><a name="id372573"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372576"></a><a class="indexterm" name="id372584"></a><a class="indexterm" name="id372592"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371098"></a><a name="id371100"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id371103"></a><a class="indexterm" name="id371111"></a><a class="indexterm" name="id371119"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2613"></a><a name="id372615"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371140"></a><a name="id371142"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2626"></a><a class="indexterm" name="id372634"></a><a class="indexterm" name="id372642"></a><a class="indexterm" name="id372649"></a><a class="indexterm" name="id372657"></a><a class="indexterm" name="id372665"></a><a class="indexterm" name="id372672"></a><a class="indexterm" name="id372680"></a><a class="indexterm" name="id372688"></a><a class="indexterm" name="id372696"></a><a class="indexterm" name="id372704"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371153"></a><a class="indexterm" name="id371161"></a><a class="indexterm" name="id371168"></a><a class="indexterm" name="id371176"></a><a class="indexterm" name="id371184"></a><a class="indexterm" name="id371192"></a><a class="indexterm" name="id371199"></a><a class="indexterm" name="id371207"></a><a class="indexterm" name="id371215"></a><a class="indexterm" name="id371223"></a><a class="indexterm" name="id371231"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2728"></a><a name="id372731"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372734"></a><a class="indexterm" name="id372742"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371255"></a><a name="id371258"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id371261"></a><a class="indexterm" name="id371269"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2761"></a><a class="indexterm" name="id372769"></a><a class="indexterm" name="id372777"></a><a class="indexterm" name="id372785"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371288"></a><a class="indexterm" name="id371296"></a><a class="indexterm" name="id371304"></a><a class="indexterm" name="id371312"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2800"></a><a name="id372802"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372805"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371327"></a><a name="id371329"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id371332"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2820"></a><a class="indexterm" name="id372828"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371347"></a><a class="indexterm" name="id371355"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2858"></a><a name="id372860"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371385"></a><a name="id371387"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2871"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371398"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2890"></a><a name="id372892"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372895"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371417"></a><a name="id371419"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id371422"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id37 2910"></a><a class="indexterm" name="id372918"></a><a class="indexterm" name="id372926"></a><a class="indexterm" name="id372934"></a><a class="indexterm" name="id372942"></a><a class="indexterm" name="id372950"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id371437"></a><a class="indexterm" name="id371445"></a><a class="indexterm" name="id371453"></a><a class="indexterm" name="id371461"></a><a class="indexterm" name="id371469"></a><a class="indexterm" name="id371477"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id37 2987"></a><a name="id372989"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372992"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id371514"></a><a name="id371516"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id371519"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id37 3019"></a>1123 </p><p><a class="indexterm" name="id371546"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/nw4migration.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 10. Migrating NetWare Server to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id37 3183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id37 3052"></a>3 <a class="indexterm" name="id37 3059"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 10. Migrating NetWare Server to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id371710">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371809">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id371886">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id371958">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id372125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id372134">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id371579"></a> 3 <a class="indexterm" name="id371586"></a> 4 4 Novell is a company any seasoned IT manager has to admire. It has become increasingly 5 5 Linux-friendly and is emerging out of a deep regression that almost saw the company … … 9 9 Meanwhile, there can be no denying that Novell is a Linux company. 10 10 </p><p> 11 <a class="indexterm" name="id37 3073"></a>12 <a class="indexterm" name="id37 3080"></a>13 <a class="indexterm" name="id37 3087"></a>14 <a class="indexterm" name="id37 3093"></a>11 <a class="indexterm" name="id371600"></a> 12 <a class="indexterm" name="id371607"></a> 13 <a class="indexterm" name="id371614"></a> 14 <a class="indexterm" name="id371620"></a> 15 15 Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian, 16 16 Gentoo, Mandrake, or SUSE (Novell), the information in this chapter should be read with … … 18 18 in this chapter should provide something of value. 19 19 </p><p> 20 <a class="indexterm" name="id37 3106"></a>20 <a class="indexterm" name="id371633"></a> 21 21 Contributions to this chapter were made by Misty Stanley-Jones, a UNIX administrator of many 22 22 years who surfaced on the Samba mailing list with a barrage of questions and who 23 23 regularly helps other administrators to solve thorny Samba migration questions. 24 24 </p><p> 25 <a class="indexterm" name="id37 3118"></a>26 <a class="indexterm" name="id37 3125"></a>27 <a class="indexterm" name="id37 3132"></a>28 <a class="indexterm" name="id37 3139"></a>25 <a class="indexterm" name="id371645"></a> 26 <a class="indexterm" name="id371652"></a> 27 <a class="indexterm" name="id371659"></a> 28 <a class="indexterm" name="id371666"></a> 29 29 One wonders how many NetWare servers remain in active service. Many are being migrated 30 30 to Samba on Linux. Red Hat Linux, SUSE Linux 9.x, and SUSE Linux Enterprise Server 9 are … … 50 50 original documentation contributed by Misty, the Courier-IMAP package had been built 51 51 directly from the original source tarball. 52 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 3183"></a>Introduction</h2></div></div></div><p>53 <a class="indexterm" name="id37 3190"></a>52 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id371710"></a>Introduction</h2></div></div></div><p> 53 <a class="indexterm" name="id371717"></a> 54 54 Misty Stanley-Jones was recruited by Abmas to administer a network that had 55 55 not received much attention for some years and was much in need of a makeover. … … 65 65 drives, causing backup integrity problems 66 66 </p></li></ul></div></li></ul></div><p> 67 <a class="indexterm" name="id37 3272"></a>67 <a class="indexterm" name="id371799"></a> 68 68 At one point disk space had filled up to 100 percent, causing the payroll database 69 69 to become corrupt. This caused the accounting department to be down for over … … 71 71 server was created with very poor security and design considerations from 72 72 a discarded desktop PC. 73 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id37 3282"></a>Assignment Tasks</h3></div></div></div><p>73 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id371809"></a>Assignment Tasks</h3></div></div></div><p> 74 74 Misty has provided this summary of her migration experience in the hope 75 75 that it will help someone to avoid the challenges she faced. Perhaps her … … 90 90 the overall information more useful to you. 91 91 </p><p> 92 <a class="indexterm" name="id37 3311"></a>92 <a class="indexterm" name="id371838"></a> 93 93 After management reviewed a cost-benefit report as well as an estimated 94 94 time-to-completion, approval was given proceed with the solution proposed. … … 112 112 The new system has operated for 6 months without problems. Over the past months 113 113 much attention has been focused on cleaning up desktops and user profiles. 114 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 3359"></a>Dissection and Discussion</h2></div></div></div><p>115 <a class="indexterm" name="id37 3367"></a>116 <a class="indexterm" name="id37 3374"></a>117 <a class="indexterm" name="id37 3381"></a>118 <a class="indexterm" name="id37 3388"></a>114 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id371886"></a>Dissection and Discussion</h2></div></div></div><p> 115 <a class="indexterm" name="id371894"></a> 116 <a class="indexterm" name="id371901"></a> 117 <a class="indexterm" name="id371908"></a> 118 <a class="indexterm" name="id371915"></a> 119 119 A decision to use LDAP was made even though I knew nothing about LDAP except that 120 120 I had been reading the book <span class="quote">“<span class="quote">LDAP System Administration,</span>”</span> by Gerald Carter. … … 122 122 and would provide centralized authentication and identity management. 123 123 </p><p> 124 <a class="indexterm" name="id37 3404"></a>125 <a class="indexterm" name="id37 3411"></a>126 <a class="indexterm" name="id37 3417"></a>124 <a class="indexterm" name="id371931"></a> 125 <a class="indexterm" name="id371938"></a> 126 <a class="indexterm" name="id371944"></a> 127 127 Building the LDAP database took a while and a lot of trial and error. Following 128 128 the guidance I obtained from <span class="quote">“<span class="quote">LDAP System 129 129 Administration,</span>”</span> I installed OpenLDAP (from RPM; later I compiled 130 130 a more current version from source) and built my initial LDAP tree. 131 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id37 3431"></a>Technical Issues</h3></div></div></div><p>132 <a class="indexterm" name="id37 3439"></a>133 <a class="indexterm" name="id37 3446"></a>134 <a class="indexterm" name="id37 3452"></a>135 <a class="indexterm" name="id37 3459"></a>136 <a class="indexterm" name="id37 3466"></a>137 <a class="indexterm" name="id37 3473"></a>138 <a class="indexterm" name="id37 3480"></a>139 <a class="indexterm" name="id37 3486"></a>140 <a class="indexterm" name="id37 3493"></a>131 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id371958"></a>Technical Issues</h3></div></div></div><p> 132 <a class="indexterm" name="id371966"></a> 133 <a class="indexterm" name="id371972"></a> 134 <a class="indexterm" name="id371979"></a> 135 <a class="indexterm" name="id371986"></a> 136 <a class="indexterm" name="id371993"></a> 137 <a class="indexterm" name="id372000"></a> 138 <a class="indexterm" name="id372006"></a> 139 <a class="indexterm" name="id372013"></a> 140 <a class="indexterm" name="id372020"></a> 141 141 The first challenge was to create a company white pages, followed by manually 142 142 entering everything from the printed company directory. This used only the inetOrgPerson … … 190 190 aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text 191 191 files (or from a name service such as NIS). This too set can be obtained from the <a class="ulink" href="http://www.padl.com" target="_top">PADL Web site</a>. 192 </p></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id37 3599"></a>Implementation</h2></div></div></div><p>193 </p><div class="sect2" title="NetWare Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id37 3608"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p>192 </p></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id372125"></a>Implementation</h2></div></div></div><p> 193 </p><div class="sect2" title="NetWare Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id372134"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p> 194 194 The following software must be installed on the SUSE Linux Enterprise Server to perform 195 195 this migration: … … 198 198 The configuration files used at Abmas are provided as a guide and should be modified 199 199 to meet needs at your site. 200 </p><div class="sect3" title="LDAP Server Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id37 3667"></a>LDAP Server Configuration</h4></div></div></div><p>200 </p><div class="sect3" title="LDAP Server Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id372194"></a>LDAP Server Configuration</h4></div></div></div><p> 201 201 The <code class="filename">/etc/openldap/slapd.conf</code> file Misty used is shown here: 202 202 </p><pre class="programlisting"> … … 363 363 </pre><p> 364 364 </p><p> 365 <a class="indexterm" name="id37 3778"></a>365 <a class="indexterm" name="id372304"></a> 366 366 The <code class="filename">/etc/ldap.conf</code> file used is listed in <a class="link" href="nw4migration.html#ch8ldap" title="Example 10.2. NSS LDAP Control File /etc/ldap.conf">“NSS LDAP Control File /etc/ldap.conf”</a>. 367 367 </p><div class="example"><a name="ch8ldap"></a><p class="title"><b>Example 10.2. NSS LDAP Control File /etc/ldap.conf</b></p><div class="example-contents"><pre class="screen"> … … 417 417 </pre><p> 418 418 </p><p> 419 <a class="indexterm" name="id37 3848"></a>420 <a class="indexterm" name="id37 3854"></a>419 <a class="indexterm" name="id372373"></a> 420 <a class="indexterm" name="id372379"></a> 421 421 In my setup, users authenticate via PAM and NSS using LDAP-based accounts. 422 422 The configuration file that controls the behavior of the PAM <code class="literal">pam_unix2</code> … … 459 459 password: use_ldap 460 460 session: none 461 </pre></div></div><br class="example-break"><a class="indexterm" name="id37 3906"></a><a class="indexterm" name="id373913"></a><a class="indexterm" name="id373920"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>461 </pre></div></div><br class="example-break"><a class="indexterm" name="id372432"></a><a class="indexterm" name="id372439"></a><a class="indexterm" name="id372446"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 462 462 If your LDAP database goes down, nobody can authenticate except for root. 463 463 </p></li><li class="listitem"><p> … … 469 469 </p><p> 470 470 The following services authenticate using LDAP: 471 </p><a class="indexterm" name="id37 3952"></a><a class="indexterm" name="id373959"></a><a class="indexterm" name="id373966"></a><table border="0" summary="Simple list" class="simplelist"><tr><td>UNIX login/ssh</td></tr><tr><td>Postfix (SMTP)</td></tr><tr><td>Courier-IMAP/IMAPS/POP3/POP3S</td></tr></table><p>472 <a class="indexterm" name="id37 3991"></a>473 <a class="indexterm" name="id37 3998"></a>471 </p><a class="indexterm" name="id372478"></a><a class="indexterm" name="id372485"></a><a class="indexterm" name="id372492"></a><table border="0" summary="Simple list" class="simplelist"><tr><td>UNIX login/ssh</td></tr><tr><td>Postfix (SMTP)</td></tr><tr><td>Courier-IMAP/IMAPS/POP3/POP3S</td></tr></table><p> 472 <a class="indexterm" name="id372517"></a> 473 <a class="indexterm" name="id372524"></a> 474 474 Companywide white pages can be searched using an LDAP client 475 475 such as the one in the Windows Address Book. 476 476 </p><p> 477 <a class="indexterm" name="id37 4009"></a>478 <a class="indexterm" name="id37 4016"></a>477 <a class="indexterm" name="id372535"></a> 478 <a class="indexterm" name="id372542"></a> 479 479 Having gained a solid understanding of LDAP and a relatively workable LDAP tree 480 480 thus far, it was time to configure Samba. I compiled the latest stable Samba and … … 483 483 </p><p> 484 484 The Samba <code class="filename">smb.conf</code> file was configured as shown in <a class="link" href="nw4migration.html#ch8smbconf" title="Example 10.4. Samba Configuration File smb.conf Part A">“Samba Configuration File smb.conf Part A”</a>. 485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id37 4082"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id374094"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id374105"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id374117"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id374128"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374140"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id374152"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id374163"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id374175"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id374186"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374198"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id374209"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id374221"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id374232"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id374244"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374256"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374268"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374280"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id374292"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id374304"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id374316"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id374328"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id374339"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id374350"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374362"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374373"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id374385"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id374397"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374408"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374420"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374431"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id374443"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id374455"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374466"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374478"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374489"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id374528"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id374540"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id374551"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374563"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id374583"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id374595"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id374607"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374618"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374630"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374641"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id374662"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id374673"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id374685"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374696"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id374708"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374719"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374731"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id374751"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id374763"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id374774"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id374795"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id374806"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id374818"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374829"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id374850"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id374862"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id374873"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id374912"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id374923"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id374934"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id374966"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id374978"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id374990"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id375010"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id375022"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id375033"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id375045"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id375065"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id375076"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id375088"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375100"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375111"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id375131"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id375143"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id375155"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id375167"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375178"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375190"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id375210"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id375222"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id375233"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375245"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375256"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375268"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id375307"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id375318"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id375330"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id375350"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id375362"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id375373"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id375385"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375396"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id375408"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id375428"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id375440"></a><em class="parameter"><code>valid users = @"acct_admin"</code></em></td></tr><tr><td><a class="indexterm" name="id375451"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id375472"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id375484"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id375495"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id375516"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id375527"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id375539"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375550"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375562"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id375582"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id375594"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id375606"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375617"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375629"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375640"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id375679"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id375690"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id375702"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375713"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375725"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375736"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id375757"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id375768"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id375780"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375791"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375803"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id375823"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id375835"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id375855"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id375867"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id375878"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375890"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>486 <a class="indexterm" name="id37 5905"></a>487 <a class="indexterm" name="id37 5911"></a>488 <a class="indexterm" name="id37 5918"></a>485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id372609"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id372620"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id372632"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id372643"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id372655"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372667"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id372678"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id372690"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id372701"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id372713"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372724"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id372736"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id372747"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id372759"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id372771"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id372783"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id372795"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id372807"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id372819"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id372831"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id372842"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id372854"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id372866"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id372877"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372888"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372900"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id372912"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id372923"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id372935"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id372946"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372958"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id372970"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id372981"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id372993"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id373004"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id373016"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id373055"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id373067"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id373078"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id373090"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id373110"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id373122"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id373134"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373145"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373157"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id373168"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id373189"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id373200"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id373212"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373223"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id373235"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id373246"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id373258"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id373278"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id373290"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id373301"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id373322"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id373333"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id373345"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373356"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id373377"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id373389"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id373400"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id373440"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id373451"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id373462"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id373474"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id373494"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id373506"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id373518"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id373538"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id373550"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id373561"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id373573"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id373593"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id373604"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id373616"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id373628"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373639"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id373659"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id373671"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id373683"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id373695"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id373706"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373718"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id373738"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id373750"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id373761"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id373773"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373784"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373796"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id373835"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id373846"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id373858"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id373878"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id373890"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id373901"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id373913"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373924"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id373936"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id373956"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id373968"></a><em class="parameter"><code>valid users = @"acct_admin"</code></em></td></tr><tr><td><a class="indexterm" name="id373979"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id374000"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id374012"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id374023"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id374044"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id374055"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id374067"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id374078"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374090"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id374110"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id374122"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id374134"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id374145"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374157"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id374168"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id374207"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id374219"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id374230"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id374242"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374253"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id374265"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id374285"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id374297"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id374308"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374320"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id374331"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id374352"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id374363"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id374384"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id374396"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id374407"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374418"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p> 486 <a class="indexterm" name="id374433"></a> 487 <a class="indexterm" name="id374440"></a> 488 <a class="indexterm" name="id374447"></a> 489 489 Most of these shares are only used by one company group, but they are required 490 490 because of some ancient Qbasic and Rbase applications were that written expecting 491 491 their own drive letters. 492 492 </p><p> 493 <a class="indexterm" name="id37 5930"></a>494 <a class="indexterm" name="id37 5937"></a>495 <a class="indexterm" name="id37 5944"></a>493 <a class="indexterm" name="id374458"></a> 494 <a class="indexterm" name="id374465"></a> 495 <a class="indexterm" name="id374472"></a> 496 496 Note: During the process of building the new server, I kept data files 497 497 up to date with the Novell server via use of <code class="literal">rsync</code>. … … 740 740 smbpasswd="/usr/bin/smbpasswd" 741 741 </pre></div></div><br class="example-break"><p> 742 <a class="indexterm" name="id37 6262"></a>742 <a class="indexterm" name="id374790"></a> 743 743 Note: I chose not to take advantage of the TLS capability of this. 744 744 Eventually I may go back and tweak it. Also, I chose not to take advantage … … 814 814 </pre><p> 815 815 </p><p> 816 <a class="indexterm" name="id37 6336"></a>817 <a class="indexterm" name="id37 6343"></a>818 <a class="indexterm" name="id37 6350"></a>819 <a class="indexterm" name="id37 6357"></a>820 <a class="indexterm" name="id37 6363"></a>816 <a class="indexterm" name="id374864"></a> 817 <a class="indexterm" name="id374871"></a> 818 <a class="indexterm" name="id374878"></a> 819 <a class="indexterm" name="id374885"></a> 820 <a class="indexterm" name="id374891"></a> 821 821 With the LDAP directory now initialized, it was time to create the Windows and POSIX 822 822 (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups. … … 826 826 try to do this by hand. 827 827 </p><p> 828 <a class="indexterm" name="id37 6383"></a>829 <a class="indexterm" name="id37 6389"></a>830 <a class="indexterm" name="id37 6396"></a>828 <a class="indexterm" name="id374911"></a> 829 <a class="indexterm" name="id374918"></a> 830 <a class="indexterm" name="id374924"></a> 831 831 After I had my group mappings in place, I added users to the groups (the users 832 832 don't really have to exist yet). I used the <code class="literal">smbldap-groupmod</code> … … 834 834 attributes to the group entries in LDAP. 835 835 </p><p> 836 <a class="indexterm" name="id37 6414"></a>837 <a class="indexterm" name="id37 6421"></a>838 <a class="indexterm" name="id37 6428"></a>836 <a class="indexterm" name="id374942"></a> 837 <a class="indexterm" name="id374949"></a> 838 <a class="indexterm" name="id374956"></a> 839 839 The most monumental task of all was adding the sambaSamAccount information to each 840 840 already existent posixAccount entry. I did it one at a time as I moved people onto … … 843 843 <code class="prompt">root# </code> smbldap-usermod -a -P username 844 844 </pre><p> 845 <a class="indexterm" name="id37 6448"></a>846 <a class="indexterm" name="id37 6455"></a>847 <a class="indexterm" name="id37 6462"></a>845 <a class="indexterm" name="id374976"></a> 846 <a class="indexterm" name="id374983"></a> 847 <a class="indexterm" name="id374990"></a> 848 848 I completed that step for every user after asking the person what his or her current 849 849 NetWare password was. The wiser way to have done it would probably have been to dump the … … 852 852 <code class="prompt">root# </code> slapcat > somefile.ldif 853 853 </pre><p> 854 <a class="indexterm" name="id37 6483"></a>855 <a class="indexterm" name="id37 6490"></a>854 <a class="indexterm" name="id375011"></a> 855 <a class="indexterm" name="id375018"></a> 856 856 Then update the LDIF file created by using a Perl script to parse and add the 857 857 appropriate attributes and objectClasses to each entry, followed by re-importing … … 934 934 </pre><p> 935 935 </p><p> 936 <a class="indexterm" name="id37 6575"></a>936 <a class="indexterm" name="id375103"></a> 937 937 So now I could log on with a test user from the machine w2kengrspare. It was all well and 938 938 good, but that user was in no groups yet and so had pretty boring access. I fixed that … … 943 943 I also did not have to do a logon script per user or per group. 944 944 </p><p> 945 <a class="indexterm" name="id37 6595"></a>945 <a class="indexterm" name="id375123"></a> 946 946 I downloaded Kixtart and put the following files in my netlogon share: 947 947 </p><pre class="screen"> … … 955 955 </pre><p> 956 956 </p><p> 957 <a class="indexterm" name="id37 6618"></a>957 <a class="indexterm" name="id375146"></a> 958 958 I then wrote the <code class="filename">logon.kix</code> file that is shown in 959 959 <a class="link" href="nw4migration.html#ch8kix" title="Example 10.15. Kixtart Control File File: logon.kix">“Kixtart Control File File: logon.kix”</a>. I chose to keep it all in one file, but it … … 1138 1138 so it was easier to do it by hand. 1139 1139 </p><p> 1140 <a class="indexterm" name="id37 6842"></a>1140 <a class="indexterm" name="id375372"></a> 1141 1141 At this point I was able to add the users. This is the part that really falls 1142 1142 into upgrade. I moved the users over one group at a time, starting with the -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/pr01.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="About the Cover Artwork"><div class="titlepage"><div><div><h2 class="title"><a name="id 281291"></a>About the Cover Artwork</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="About the Cover Artwork"><div class="titlepage"><div><div><h2 class="title"><a name="id316097"></a>About the Cover Artwork</h2></div></div></div><p> 2 2 The cover artwork of this book continues the freedom theme of the first 3 3 edition of <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>. The history of civilization -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/pr02.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Acknowledgments"><div class="titlepage"><div><div><h2 class="title"><a name="id28 1791"></a>Acknowledgments</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Acknowledgments"><div class="titlepage"><div><div><h2 class="title"><a name="id282688"></a>Acknowledgments</h2></div></div></div><p> 2 2 <span class="emphasis"><em>Samba-3 by Example</em></span> would not have been written except 3 3 as a result of feedback provided by reviewers and readers of the book <span class="emphasis"><em>The -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/pr03.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Foreword"><div class="titlepage"><div><div><h2 class="title"><a name="id 280651"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id280658">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" title="By John M. Weathersby, Executive Director, OSSI"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280658"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Foreword"><div class="titlepage"><div><div><h2 class="title"><a name="id314098"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id314105">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" title="By John M. Weathersby, Executive Director, OSSI"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id314105"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> 2 2 The Open Source Software Institute (OSSI) is comprised of representatives from a broad spectrum of business and 3 3 non-business organizations that share a common interest in the promotion of development and implementation -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/preface.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" title="Preface"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id28 0788">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id280825">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280643">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id322292">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id322341">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id322920">Conventions Used</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" title="Preface"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id281184">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id281221">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280852">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id320789">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id320838">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id321418">Conventions Used</a></span></dt></dl></div><p> 2 2 Network administrators live busy lives. We face distractions and pressures 3 3 that drive us to seek proven, working case scenarios that can be easily … … 34 34 services and applications such as OpenLDAP, DNS and DHCP, the need for which 35 35 can be met from other resources that are dedicated to the subject. 36 </p><div class="sect1" title="Why Is This Book Necessary?"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id28 0788"></a>Why Is This Book Necessary?</h2></div></div></div><p>36 </p><div class="sect1" title="Why Is This Book Necessary?"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id281184"></a>Why Is This Book Necessary?</h2></div></div></div><p> 37 37 This book is the result of observations and feedback. The feedback from 38 38 the Samba-HOWTO-Collection has been positive and complimentary. There … … 54 54 on the CD-ROM. This book is descriptive, provides detailed diagrams, and 55 55 makes deployment of Samba-3 a breeze. 56 </p><div class="sect2" title="Samba 3.0.20 Update Edition"><div class="titlepage"><div><div><h3 class="title"><a name="id28 0825"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p>56 </p><div class="sect2" title="Samba 3.0.20 Update Edition"><div class="titlepage"><div><div><h3 class="title"><a name="id281221"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p> 57 57 The Samba 3.0.x series has been remarkably popular. At the time this book first 58 58 went to print samba-3.0.2 was being released. There have been significant modifications … … 127 127 be delegated to normal user accounts or to groups of users. 128 128 </p> 129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" title="Prerequisites"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280 643"></a>Prerequisites</h2></div></div></div><p>129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" title="Prerequisites"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280852"></a>Prerequisites</h2></div></div></div><p> 130 130 This book is not a tutorial on UNIX or Linux administration. UNIX and Linux 131 131 training is best obtained from books dedicated to the subject. This book … … 140 140 may need to refer to administrative guides or manuals for your operating system 141 141 platform to find what is the best method to achieve what the text of this book describes. 142 </p></div><div class="sect1" title="Approach"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 2292"></a>Approach</h2></div></div></div><p>142 </p></div><div class="sect1" title="Approach"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320789"></a>Approach</h2></div></div></div><p> 143 143 The first chapter deals with some rather thorny network analysis issues. Do not be 144 144 put off by this. The information you glean, even without a detailed understanding … … 168 168 Each chapter has a set of questions and answers to help you to 169 169 to understand and digest key attributes of the solutions presented. 170 </p></div><div class="sect1" title="Summary of Topics"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 2341"></a>Summary of Topics</h2></div></div></div><p>170 </p></div><div class="sect1" title="Summary of Topics"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320838"></a>Summary of Topics</h2></div></div></div><p> 171 171 The contents of this second edition of <span class="emphasis"><em>Samba-3 by Example</em></span> 172 172 have been rearranged based on feedback from purchasers of the first edition. … … 365 365 a file and print server to create a connection over which file and print 366 366 operations may take place. 367 </p></dd></dl></div></div><div class="sect1" title="Conventions Used"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 2920"></a>Conventions Used</h2></div></div></div><p>367 </p></dd></dl></div></div><div class="sect1" title="Conventions Used"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321418"></a>Conventions Used</h2></div></div></div><p> 368 368 The following notation conventions are used throughout this book: 369 369 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/primer.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 16. Networking Primer"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id3 90627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 16. Networking Primer"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id389151">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id389288">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389338">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id389445">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id389558">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id390654">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id391120">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id391645">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391746">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p> 2 2 You are about to use the equivalent of a microscope to look at the information 3 3 that runs through the veins of a Windows network. We do more to observe the information than … … 9 9 Samba can be configured with a minimum of complexity. Simplicity should be mastered 10 10 before you get too deeply into complexities. Let's get moving: we have work to do. 11 </p><div class="sect1" title="Requirements and Notes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 90627"></a>Requirements and Notes</h2></div></div></div><p>11 </p><div class="sect1" title="Requirements and Notes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389151"></a>Requirements and Notes</h2></div></div></div><p> 12 12 Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations 13 13 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet … … 17 17 on a quiet network where there is no other traffic. It is best to use a dedicated hub 18 18 with only the machines under test connected at the time of the exercises. 19 </p><p><a class="indexterm" name="id3 90642"></a>19 </p><p><a class="indexterm" name="id389166"></a> 20 20 Wireshark (formerly Ethereal) has become the network protocol analyzer of choice for many network administrators. 21 21 You may find more information regarding this tool from the … … 37 37 that is used to monitor traffic; this would not allow you to complete the projects. 38 38 </p></div><p> 39 <a class="indexterm" name="id3 90701"></a>39 <a class="indexterm" name="id389225"></a> 40 40 Do not worry too much if you do not have access to all this equipment; network captures 41 41 from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly 42 42 into the analytical part of the exercises if you so desire. 43 </p><p><a class="indexterm" name="id3 90714"></a><a class="indexterm" name="id390726"></a>43 </p><p><a class="indexterm" name="id389238"></a><a class="indexterm" name="id389250"></a> 44 44 Please do not be alarmed at the use of a high-powered analysis tool (Wireshark) in this 45 45 primer. We expose you only to a minimum of detail necessary to complete … … 55 55 <a class="link" href="primer.html#chap01qa" title="Questions and Answers">“Questions and Answers”</a> also provides useful information 56 56 that may help you to avoid significantly time-consuming networking problems. 57 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 90763"></a>Introduction</h2></div></div></div><p>57 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389288"></a>Introduction</h2></div></div></div><p> 58 58 The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows 59 59 network computing. If you want a solid technical grounding, do not gloss over these exercises. 60 60 The points covered are recurrent issues on the Samba mailing lists. 61 </p><p><a class="indexterm" name="id3 90775"></a>61 </p><p><a class="indexterm" name="id389300"></a> 62 62 You can see from these exercises that Windows networking involves quite a lot of network 63 63 broadcast traffic. You can look into the contents of some packets, but only to see … … 75 75 Edition</em></span> (TOSHARG2) Chapter 9, <span class="quote">“<span class="quote">Network Browsing,</span>”</span> and Chapter 3, 76 76 <span class="quote">“<span class="quote">Server Types and Security Modes.</span>”</span> 77 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id3 90813"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id390820"></a>77 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id389338"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id389345"></a> 78 78 You are about to witness how Microsoft Windows computer networking functions. The 79 79 exercises step through identification of how a client machine establishes a … … 81 81 each other (i.e., how browsing works) and how the two key types of user identification 82 82 (share mode security and user mode security) are affected. 83 </p><p><a class="indexterm" name="id3 90834"></a>83 </p><p><a class="indexterm" name="id389359"></a> 84 84 The networking protocols used by MS Windows networking when working with Samba 85 85 use TCP/IP as the transport protocol. The protocols that are specific to Windows 86 86 networking are encapsulated in TCP/IP. The network analyzer we use (Wireshark) 87 87 is able to show you the contents of the TCP/IP packets (or messages). 88 </p><div class="procedure" title="Procedure 16.1. Diagnostic Tasks"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id3 90864"></a><a class="indexterm" name="id390875"></a><a class="indexterm" name="id390883"></a>88 </p><div class="procedure" title="Procedure 16.1. Diagnostic Tasks"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id389389"></a><a class="indexterm" name="id389400"></a><a class="indexterm" name="id389408"></a> 89 89 Examine network traces to witness SMB broadcasts, host announcements, 90 90 and name resolution processes. … … 96 96 Review traces of network logons for a Windows 9x/Me client as well as 97 97 a domain logon for a Windows XP Professional client. 98 </p></li></ol></div></div></div><div class="sect1" title="Exercises"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 90920"></a>Exercises</h2></div></div></div><p>99 <a class="indexterm" name="id3 90928"></a>98 </p></li></ol></div></div></div><div class="sect1" title="Exercises"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389445"></a>Exercises</h2></div></div></div><p> 99 <a class="indexterm" name="id389453"></a> 100 100 You are embarking on a course of discovery. The first part of the exercise requires 101 101 two MS Windows 9x/Me systems. We called one machine <code class="constant">WINEPRESSME</code> and the … … 112 112 Choose a workgroup name (MIDEARTH) for each exercise. 113 113 </p><p> 114 <a class="indexterm" name="id3 91010"></a>114 <a class="indexterm" name="id389534"></a> 115 115 The network captures provided on the CD-ROM included with this book were captured using <code class="constant">Ethereal</code> 116 116 version <code class="literal">0.10.6</code>. A later version suffices without problems (i.e. you should be using Wireshark), but an earlier version may not … … 120 120 that can be derived from this book really does warrant your taking sufficient time to practice each exercise with 121 121 care and attention to detail. 122 </p><div class="sect2" title="Single-Machine Broadcast Activity"><div class="titlepage"><div><div><h3 class="title"><a name="id3 91033"></a>Single-Machine Broadcast Activity</h3></div></div></div><p>122 </p><div class="sect2" title="Single-Machine Broadcast Activity"><div class="titlepage"><div><div><h3 class="title"><a name="id389558"></a>Single-Machine Broadcast Activity</h3></div></div></div><p> 123 123 In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes. 124 </p><div class="procedure" title="Procedure 16.2. Monitoring Windows 9x Steps"><a name="id3 91043"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>124 </p><div class="procedure" title="Procedure 16.2. Monitoring Windows 9x Steps"><a name="id389568"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 125 125 Start the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>). 126 126 Launch <code class="literal">Wireshark</code>, click … … 139 139 Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol 140 140 was used. Identify the timing between messages of identical types. 141 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id3 91158"></a>Findings</h4></div></div></div><p>141 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id389683"></a>Findings</h4></div></div></div><p> 142 142 The summary of the first 10 minutes of the packet capture should look like <a class="link" href="primer.html#pktcap01" title="Figure 16.1. Windows Me Broadcasts The First 10 Minutes">“Windows Me Broadcasts The First 10 Minutes”</a>. 143 143 A screenshot of a later stage of the same capture is shown in <a class="link" href="primer.html#pktcap02" title="Figure 16.2. Windows Me Later Broadcast Sample">“Windows Me Later Broadcast Sample”</a>. 144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id3 91271"></a><a class="indexterm" name="id391282"></a>144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id389796"></a><a class="indexterm" name="id389807"></a> 145 145 Broadcast messages observed are shown in <a class="link" href="primer.html#capsstats01" title="Table 16.1. Windows Me Startup Broadcast Capture Statistics">“Windows Me Startup Broadcast Capture Statistics”</a>. 146 146 Actual observations vary a little, but not by much. … … 148 148 first to ensure that its name would not result in a name clash, and second to establish its 149 149 presence with the Local Master Browser (LMB). 150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id39 1620"></a><a class="indexterm" name="id391628"></a>150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id390145"></a><a class="indexterm" name="id390152"></a> 151 151 From the packet trace, it should be noted that no messages were propagated over TCP/IP; 152 152 all messages employed UDP/IP. When steady-state operation has been achieved, there is a cycle 153 153 of various announcements, re-election of a browse master, and name queries. These create 154 154 the symphony of announcements by which network browsing is made possible. 155 </p><p><a class="indexterm" name="id39 1642"></a>155 </p><p><a class="indexterm" name="id390167"></a> 156 156 For detailed information regarding the precise behavior of the CIFS/SMB protocols, 157 157 refer to the book <span class="quote">“<span class="quote">Implementing CIFS: The Common Internet File System,</span>”</span> … … 160 160 At this time, the machine you used to capture the single-system startup trace should still be running. 161 161 The objective of this task is to identify the interaction of two machines in respect to broadcast activity. 162 </p><div class="procedure" title="Procedure 16.3. Monitoring of Second Machine Activity"><a name="id39 1674"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>162 </p><div class="procedure" title="Procedure 16.3. Monitoring of Second Machine Activity"><a name="id390199"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 163 163 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 164 164 launch <code class="literal">Wireshark</code> and click … … 177 177 Analyze the capture trace, taking note of the transport protocols used, the types of messages observed, 178 178 and what interaction took place between the two machines. Leave both machines running for the next task. 179 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id39 1782"></a>Findings</h4></div></div></div><p>179 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id390308"></a>Findings</h4></div></div></div><p> 180 180 <a class="link" href="primer.html#capsstats02" title="Table 16.2. Second Machine (Windows 98) Capture Statistics">“Second Machine (Windows 98) Capture Statistics”</a> summarizes capture statistics observed. As in the previous case, 181 181 all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second … … 185 185 <span class="quote">“<span class="quote">Implementing CIFS: The Common Internet File System.</span>”</span> 186 186 </p><div class="table"><a name="capsstats02"></a><p class="title"><b>Table 16.2. Second Machine (Windows 98) Capture Statistics</b></p><div class="table-contents"><table summary="Second Machine (Windows 98) Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">MILGATE98<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">18</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">2</td><td align="left">This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement MILGATE98</td><td align="center">Ann</td><td align="center">14</td><td align="left">Every 120 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">6</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">6</td><td align="left">Insufficient detail to determine frequency</td></tr></tbody></table></div></div><br class="table-break"><p> 187 <a class="indexterm" name="id39 2055"></a>188 <a class="indexterm" name="id39 2062"></a>189 <a class="indexterm" name="id39 2069"></a>187 <a class="indexterm" name="id390580"></a> 188 <a class="indexterm" name="id390587"></a> 189 <a class="indexterm" name="id390594"></a> 190 190 Observation of the contents of Host Announcements, Domain/Workgroup Announcements, 191 191 and Local Master Announcements is instructive. These messages convey a significant 192 192 level of detail regarding the nature of each machine that is on the network. An example 193 193 dissection of a Host Announcement is given in <a class="link" href="primer.html#hostannounce" title="Figure 16.3. Typical Windows 9x/Me Host Announcement">“Typical Windows 9x/Me Host Announcement”</a>. 194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" title="Simple Windows Client Connection Characteristics"><div class="titlepage"><div><div><h3 class="title"><a name="id39 2130"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p>194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" title="Simple Windows Client Connection Characteristics"><div class="titlepage"><div><div><h3 class="title"><a name="id390654"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p> 195 195 The purpose of this exercise is to discover how Microsoft Windows clients create (establish) 196 196 connections with remote servers. The methodology involves analysis of a key aspect of how 197 197 Windows clients access remote servers: the session setup protocol. 198 </p><div class="procedure" title="Procedure 16.4. Client Connection Exploration Steps"><a name="id39 2141"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>198 </p><div class="procedure" title="Procedure 16.4. Client Connection Exploration Steps"><a name="id390665"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 199 199 Configure a Windows 9x/Me machine (MILGATE98) with a share called <code class="constant">Stuff</code>. 200 200 Create a <em class="parameter"><code>Full Access</code></em> control password on this share. … … 217 217 Save the captured data in case it is needed for later analysis. 218 218 </p></li><li class="step" title="Step 7"><p> 219 <a class="indexterm" name="id39 2265"></a>219 <a class="indexterm" name="id390789"></a> 220 220 From the top of the packets captured, scan down to locate the first packet that has 221 221 interpreted as <code class="constant">Session Setup AndX, User: anonymous; Tree Connect AndX, 222 222 Path: \\MILGATE98\IPC$</code>. 223 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id39 2283"></a><a class="indexterm" name="id392291"></a>223 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id390807"></a><a class="indexterm" name="id390815"></a> 224 224 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request, 225 225 and Tree Connect AndX Request</code>. Examine both operations. Identify the name of … … 231 231 that was targeted at the <code class="constant">\\MILGATE98\IPC$</code> service. 232 232 </p></li><li class="step" title="Step 10"><p> 233 <a class="indexterm" name="id39 2331"></a>234 <a class="indexterm" name="id39 2338"></a>233 <a class="indexterm" name="id390855"></a> 234 <a class="indexterm" name="id390862"></a> 235 235 Dissect this packet as per the previous one. This packet should have a password length 236 236 of 24 (characters) and should have a password field, the contents of which is a 237 237 long hexadecimal number. Observe the name in the Account field. This is a User Mode 238 238 session setup packet. 239 </p></li></ol></div><div class="sect3" title="Findings and Comments"><div class="titlepage"><div><div><h4 class="title"><a name="id39 2350"></a>Findings and Comments</h4></div></div></div><p>240 <a class="indexterm" name="id39 2358"></a>241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id39 2369" href="#ftn.id392369" class="footnote">15</a>]</sup>239 </p></li></ol></div><div class="sect3" title="Findings and Comments"><div class="titlepage"><div><div><h4 class="title"><a name="id390873"></a>Findings and Comments</h4></div></div></div><p> 240 <a class="indexterm" name="id390881"></a> 241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id390892" href="#ftn.id390892" class="footnote">15</a>]</sup> 242 242 in SMB/CIFS-based networking. A Windows client connects to this resource to obtain the list of 243 243 resources that are available on the server. The server responds with the shares and print queues that … … 245 245 username and a <code class="constant">NULL</code> password. 246 246 </p><p> 247 <a class="indexterm" name="id39 2386"></a>247 <a class="indexterm" name="id390910"></a> 248 248 The two packets examined are material evidence of how Windows clients may 249 249 interoperate with Samba. Samba requires every connection setup to be authenticated using … … 252 252 account. 253 253 </p><p> 254 <a class="indexterm" name="id39 2403"></a><a class="indexterm" name="id392408"></a>255 <a class="indexterm" name="id39 2417"></a>254 <a class="indexterm" name="id390926"></a><a class="indexterm" name="id390932"></a> 255 <a class="indexterm" name="id390941"></a> 256 256 Samba has a special name for the <code class="constant">NULL</code>, or empty, user account: 257 257 it calls it the <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account</a>. The … … 262 262 <a class="link" href="primer.html#nullconnect" title="Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request">“Typical Windows 9x/Me NULL SessionSetUp AndX Request”</a>. 263 263 </p><div class="figure"><a name="nullconnect"></a><p class="title"><b>Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/NullConnect.png" width="221.4" alt="Typical Windows 9x/Me NULL SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 264 <a class="indexterm" name="id39 2498"></a>265 <a class="indexterm" name="id39 2505"></a>266 <a class="indexterm" name="id39 2512"></a>264 <a class="indexterm" name="id391021"></a> 265 <a class="indexterm" name="id391028"></a> 266 <a class="indexterm" name="id391034"></a> 267 267 When a UNIX/Linux system does not have a <code class="constant">nobody</code> user account 268 268 (<code class="filename">/etc/passwd</code>), the operation of the <code class="constant">NULL</code> … … 272 272 is shown in <a class="link" href="primer.html#userconnect" title="Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request">“Typical Windows 9x/Me User SessionSetUp AndX Request”</a>. 273 273 </p><div class="figure"><a name="userconnect"></a><p class="title"><b>Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserConnect.png" width="221.4" alt="Typical Windows 9x/Me User SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 274 <a class="indexterm" name="id39 2585"></a>274 <a class="indexterm" name="id391108"></a> 275 275 The User Mode connection packet contains the account name and the domain name. 276 276 The password is provided in Microsoft encrypted form, and its length is shown 277 277 as 24 characters. This is the length of Microsoft encrypted passwords. 278 </p></div></div><div class="sect2" title="Windows 200x/XP Client Interaction with Samba-3"><div class="titlepage"><div><div><h3 class="title"><a name="id39 2597"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p>278 </p></div></div><div class="sect2" title="Windows 200x/XP Client Interaction with Samba-3"><div class="titlepage"><div><div><h3 class="title"><a name="id391120"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p> 279 279 By now you may be asking, <span class="quote">“<span class="quote">Why did you choose to work with Windows 9x/Me?</span>”</span> 280 280 </p><p> … … 291 291 a domain member of either a Samba-controlled domain or a Windows NT4 or 200x Active Directory domain. 292 292 Here we do not provide details for how to configure this, as full coverage is provided earlier in this book. 293 </p><div class="procedure" title="Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up"><a name="id39 2631"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>293 </p><div class="procedure" title="Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up"><a name="id391154"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 294 294 Start your domain controller. Also, start the Wireshark monitoring machine, launch Wireshark, 295 295 and then wait for the next step to complete. … … 320 320 in this chapter. 321 321 </p></li><li class="step" title="Step 8"><p> 322 <a class="indexterm" name="id39 2845"></a>323 <a class="indexterm" name="id39 2852"></a>322 <a class="indexterm" name="id391368"></a> 323 <a class="indexterm" name="id391375"></a> 324 324 From the top of the packets captured, scan down to locate the first packet that has 325 325 interpreted as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 326 326 </p></li><li class="step" title="Step 9"><p> 327 <a class="indexterm" name="id39 2870"></a>328 <a class="indexterm" name="id39 2877"></a>329 <a class="indexterm" name="id39 2884"></a>327 <a class="indexterm" name="id391393"></a> 328 <a class="indexterm" name="id391400"></a> 329 <a class="indexterm" name="id391407"></a> 330 330 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 331 331 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 339 339 has been decoded as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 340 340 </p></li><li class="step" title="Step 11"><p> 341 <a class="indexterm" name="id39 2941"></a>341 <a class="indexterm" name="id391464"></a> 342 342 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 343 343 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 350 350 password and then the NT (case-preserving) password hash. 351 351 </p></li><li class="step" title="Step 12"><p> 352 <a class="indexterm" name="id39 2995"></a>353 <a class="indexterm" name="id39 3002"></a>352 <a class="indexterm" name="id391519"></a> 353 <a class="indexterm" name="id391526"></a> 354 354 The passwords are 24-character hexadecimal numbers. This packet confirms that this is a User Mode 355 355 session setup packet. 356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" title="Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id39 3094"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id393101"></a>356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" title="Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id391618"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id391624"></a> 357 357 This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled 358 358 in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles … … 361 361 technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated 362 362 connection must be made before resources can be used. 363 </p></div></div><div class="sect2" title="Conclusions to Exercises"><div class="titlepage"><div><div><h3 class="title"><a name="id39 3121"></a>Conclusions to Exercises</h3></div></div></div><p>363 </p></div></div><div class="sect2" title="Conclusions to Exercises"><div class="titlepage"><div><div><h3 class="title"><a name="id391645"></a>Conclusions to Exercises</h3></div></div></div><p> 364 364 In summary, the following points have been established in this chapter: 365 365 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> … … 380 380 databases in concurrent deployment. Refer to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, <span class="quote">“<span class="quote">Account Information Databases.</span>”</span> 381 381 </p></li></ul></div></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01conc"></a>Dissection and Discussion</h2></div></div></div><p> 382 <a class="indexterm" name="id39 3199"></a>382 <a class="indexterm" name="id391723"></a> 383 383 The exercises demonstrate the use of the <code class="constant">guest</code> account, the way that 384 384 MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections … … 388 388 the Microsoft knowledgebase article 389 389 <a class="ulink" href="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp" target="_top">Q102878.</a> 390 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id39 3223"></a>Technical Issues</h3></div></div></div><p>391 <a class="indexterm" name="id39 3231"></a>390 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id391746"></a>Technical Issues</h3></div></div></div><p> 391 <a class="indexterm" name="id391754"></a> 392 392 Network browsing involves SMB broadcast announcements, SMB enumeration requests, 393 393 connections to the <code class="constant">IPC$</code> share, share enumerations, and SMB connection … … 397 397 The questions and answers given in this section are designed to highlight important aspects of Microsoft 398 398 Windows networking. 399 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id39 3266"></a><dl><dt> <a href="primer.html#id393272">399 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id391789"></a><dl><dt> <a href="primer.html#id391796"> 400 400 What is the significance of the MIDEARTH<1b> type query? 401 </a></dt><dt> <a href="primer.html#id39 3315">401 </a></dt><dt> <a href="primer.html#id391838"> 402 402 What is the significance of the MIDEARTH<1d> type name registration? 403 </a></dt><dt> <a href="primer.html#id39 3382">403 </a></dt><dt> <a href="primer.html#id391905"> 404 404 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 405 405 name registration? 406 </a></dt><dt> <a href="primer.html#id39 3410">406 </a></dt><dt> <a href="primer.html#id391933"> 407 407 What is the significance of the MIDEARTH<1e> type name registration? 408 </a></dt><dt> <a href="primer.html#id39 3437">408 </a></dt><dt> <a href="primer.html#id391960"> 409 409 410 410 What is the significance of the guest account in smb.conf? 411 </a></dt><dt> <a href="primer.html#id39 3508">411 </a></dt><dt> <a href="primer.html#id392031"> 412 412 Is it possible to reduce network broadcast activity with Samba-3? 413 </a></dt><dt> <a href="primer.html#id39 3609">413 </a></dt><dt> <a href="primer.html#id392132"> 414 414 Can I just use plain-text passwords with Samba? 415 </a></dt><dt> <a href="primer.html#id39 3684">415 </a></dt><dt> <a href="primer.html#id392207"> 416 416 What parameter in the smb.conf file is used to enable the use of encrypted passwords? 417 </a></dt><dt> <a href="primer.html#id39 3723">417 </a></dt><dt> <a href="primer.html#id392247"> 418 418 Is it necessary to specify encrypt passwords = Yes 419 419 when Samba-3 is configured as a domain member? 420 </a></dt><dt> <a href="primer.html#id39 3753">420 </a></dt><dt> <a href="primer.html#id392277"> 421 421 Is it necessary to specify a guest account when Samba-3 is configured 422 422 as a domain member server? 423 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id39 3272"></a><a name="id393275"></a></td><td align="left" valign="top"><p>423 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id391796"></a><a name="id391798"></a></td><td align="left" valign="top"><p> 424 424 What is the significance of the MIDEARTH<1b> type query? 425 425 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 426 <a class="indexterm" name="id39 3286"></a>427 <a class="indexterm" name="id39 3296"></a>426 <a class="indexterm" name="id391810"></a> 427 <a class="indexterm" name="id391819"></a> 428 428 This is a broadcast announcement by which the Windows machine is attempting to 429 429 locate a Domain Master Browser (DMB) in the event that it might exist on the network. 430 430 Refer to <span class="emphasis"><em>TOSHARG2,</em></span> Chapter 9, Section 9.7, <span class="quote">“<span class="quote">Technical Overview of Browsing,</span>”</span> 431 431 for details regarding the function of the DMB and its role in network browsing. 432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3315"></a><a name="id393317"></a></td><td align="left" valign="top"><p>432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id391838"></a><a name="id391841"></a></td><td align="left" valign="top"><p> 433 433 What is the significance of the MIDEARTH<1d> type name registration? 434 434 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 435 <a class="indexterm" name="id39 3329"></a>436 <a class="indexterm" name="id39 3338"></a>435 <a class="indexterm" name="id391852"></a> 436 <a class="indexterm" name="id391861"></a> 437 437 This name registration records the machine IP addresses of the LMBs. 438 438 Network clients can query this name type to obtain a list of browser servers from the … … 452 452 </p></li><li class="listitem"><p> 453 453 The IP address of the LMB on the local segment 454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3382"></a><a name="id393384"></a></td><td align="left" valign="top"><p>454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id391905"></a><a name="id391907"></a></td><td align="left" valign="top"><p> 455 455 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 456 456 name registration? 457 457 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 458 <a class="indexterm" name="id39 3397"></a>458 <a class="indexterm" name="id391920"></a> 459 459 This name is registered by the browse master to broadcast and receive domain announcements. 460 460 Its scope is limited to the local network segment, or subnet. By querying this name type, 461 461 master browsers on networks that have multiple domains can find the names of master browsers 462 462 for each domain. 463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3410"></a><a name="id393412"></a></td><td align="left" valign="top"><p>463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id391933"></a><a name="id391935"></a></td><td align="left" valign="top"><p> 464 464 What is the significance of the MIDEARTH<1e> type name registration? 465 465 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 466 <a class="indexterm" name="id39 3423"></a>466 <a class="indexterm" name="id391947"></a> 467 467 This name is registered by all browse masters in a domain or workgroup. The registration 468 468 name type is known as the Browser Election Service. Master browsers register themselves 469 469 with this name type so that DMBs can locate them to perform cross-subnet 470 470 browse list updates. This name type is also used to initiate elections for Master Browsers. 471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3437"></a><a name="id393439"></a></td><td align="left" valign="top"><p>472 <a class="indexterm" name="id39 3443"></a>471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id391960"></a><a name="id391962"></a></td><td align="left" valign="top"><p> 472 <a class="indexterm" name="id391966"></a> 473 473 What is the significance of the <em class="parameter"><code>guest account</code></em> in smb.conf? 474 474 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 483 483 or there must be an entry in the <code class="filename">smb.conf</code> file with a valid UNIX account, such as 484 484 <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account = ftp</a>. 485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3508"></a><a name="id393510"></a></td><td align="left" valign="top"><p>485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id392031"></a><a name="id392033"></a></td><td align="left" valign="top"><p> 486 486 Is it possible to reduce network broadcast activity with Samba-3? 487 487 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 488 <a class="indexterm" name="id39 3521"></a>489 <a class="indexterm" name="id39 3528"></a>488 <a class="indexterm" name="id392045"></a> 489 <a class="indexterm" name="id392051"></a> 490 490 Yes, there are two ways to do this. The first involves use of WINS (See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, 491 491 Section 9.5, <span class="quote">“<span class="quote">WINS The Windows Inter-networking Name Server</span>”</span>); the … … 493 493 a correctly configured DNS server (see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, Section 9.3, <span class="quote">“<span class="quote">Discussion</span>”</span>). 494 494 </p><p> 495 <a class="indexterm" name="id39 3558"></a>496 <a class="indexterm" name="id39 3564"></a>497 <a class="indexterm" name="id39 3573"></a>495 <a class="indexterm" name="id392082"></a> 496 <a class="indexterm" name="id392087"></a> 497 <a class="indexterm" name="id392097"></a> 498 498 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 499 499 clients are configured to operate in <em class="parameter"><code>Hybrid Mode</code></em>. This can be effected through … … 503 503 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as 504 504 well as with Samba-3. 505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3609"></a><a name="id393611"></a></td><td align="left" valign="top"><p>505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id392132"></a><a name="id392135"></a></td><td align="left" valign="top"><p> 506 506 Can I just use plain-text passwords with Samba? 507 507 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 526 526 PDC/BDC to provide Windows user and group accounts, the <em class="parameter"><code>idmap uid, idmap gid</code></em> ranges 527 527 set in the <code class="filename">smb.conf</code> file provide the local UID/GIDs needed for local identity management purposes. 528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3684"></a><a name="id393686"></a></td><td align="left" valign="top"><p>528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id392207"></a><a name="id392209"></a></td><td align="left" valign="top"><p> 529 529 What parameter in the <code class="filename">smb.conf</code> file is used to enable the use of encrypted passwords? 530 530 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 531 531 The parameter in the <code class="filename">smb.conf</code> file that controls this behavior is known as <em class="parameter"><code>encrypt 532 532 passwords</code></em>. The default setting for this in Samba-3 is <code class="constant">Yes (Enabled)</code>. 533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3723"></a><a name="id393725"></a></td><td align="left" valign="top"><p>533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id392247"></a><a name="id392249"></a></td><td align="left" valign="top"><p> 534 534 Is it necessary to specify <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords = Yes</a> 535 535 when Samba-3 is configured as a domain member? 536 536 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 537 537 No. This is the default behavior. 538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id39 3753"></a><a name="id393756"></a></td><td align="left" valign="top"><p>538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id392277"></a><a name="id392279"></a></td><td align="left" valign="top"><p> 539 539 Is it necessary to specify a <em class="parameter"><code>guest account</code></em> when Samba-3 is configured 540 540 as a domain member server? … … 544 544 necessary to provide a <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account = an_account</a>, 545 545 where <code class="constant">an_account</code> is a valid local UNIX user account. 546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id39 2369" href="#id392369" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A.546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id390892" href="#id390892" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A. 547 547 <acronym class="acronym">GNU</acronym> General Public License version 3 548 548 </td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/secure.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 3. Secure Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id3 30143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 3. Secure Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id328642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328676">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id328885">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id328897">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id329242">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id329275">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330030">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id334042">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id334095">Questions and Answers</a></span></dt></dl></div><p> 2 2 Congratulations, your Samba networking skills are developing nicely. You started out 3 3 with three simple networks in <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a> … … 12 12 To avoid confusion, this book is all about Samba-3. Let's get the exercises in this 13 13 chapter underway. 14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30143"></a>Introduction</h2></div></div></div><p>14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id328642"></a>Introduction</h2></div></div></div><p> 15 15 You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work 16 16 well done. It is one year since the last network upgrade. You have been quite busy. … … 41 41 about your move, she almost resigned, although she was reassured that a new manager would 42 42 be hired to run Information Technology, and she would be responsible only for operations. 43 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30177"></a>Assignment Tasks</h3></div></div></div><p>43 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id328676"></a>Assignment Tasks</h3></div></div></div><p> 44 44 You promised the staff Internet services including Web browsing, electronic mail, virus 45 45 protection, and a company Web site. Christine is eager to help turn the vision into … … 84 84 some problems with desktop computers and software installation into the new users' 85 85 desktop profiles. 86 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30386"></a>Dissection and Discussion</h2></div></div></div><p>86 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id328885"></a>Dissection and Discussion</h2></div></div></div><p> 87 87 Many of the conclusions you draw here are obvious. Some requirements are not very clear 88 88 or may simply be your means of drawing the most out of Samba-3. Much can be done more simply … … 90 90 users. This means that some functionality will be overdesigned for the current 130-user 91 91 environment. 92 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30398"></a>Technical Issues</h3></div></div></div><p>92 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id328897"></a>Technical Issues</h3></div></div></div><p> 93 93 In this exercise we use a 24-bit subnet mask for the two local networks. This, 94 94 of course, limits our network to a maximum of 253 usable IP addresses. The network … … 98 98 in the 172.16.0.0/16 range. This is done in subsequent chapters. 99 99 </p><p> 100 <a class="indexterm" name="id3 30412"></a>101 <a class="indexterm" name="id3 30419"></a>100 <a class="indexterm" name="id328912"></a> 101 <a class="indexterm" name="id328918"></a> 102 102 The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code> 103 103 passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in … … 105 105 are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database. 106 106 </p><p> 107 <a class="indexterm" name="id3 30443"></a>107 <a class="indexterm" name="id328943"></a> 108 108 The proposed network design uses a single server to act as an Internet services host for 109 109 electronic mail, Web serving, remote administrative access via SSH, … … 118 118 directly connected to the Internet. 119 119 </p><p> 120 <a class="indexterm" name="id3 30462"></a>121 <a class="indexterm" name="id3 30469"></a>122 <a class="indexterm" name="id3 30475"></a>123 <a class="indexterm" name="id3 30483"></a>120 <a class="indexterm" name="id328962"></a> 121 <a class="indexterm" name="id328968"></a> 122 <a class="indexterm" name="id328974"></a> 123 <a class="indexterm" name="id328983"></a> 124 124 You know that your ISP is providing full firewall services, but you cannot rely on that. 125 125 Always assume that human error will occur, so be prepared by using Linux firewall facilities … … 132 132 covered except insofar as this affects Samba-3. 133 133 </p><p> 134 <a class="indexterm" name="id3 30507"></a>134 <a class="indexterm" name="id329006"></a> 135 135 Notebook computers are configured to use a network login when in the office and a 136 136 local account to log in while away from the office. Users store all work done in … … 142 142 records. 143 143 </p><p> 144 <a class="indexterm" name="id3 30527"></a>144 <a class="indexterm" name="id329026"></a> 145 145 All applications are served from the central server from a share called <code class="constant">apps</code>. 146 146 Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network … … 149 149 locally installed applications on a need-to-have basis only. 150 150 </p><p> 151 <a class="indexterm" name="id3 30543"></a>151 <a class="indexterm" name="id329043"></a> 152 152 The introduction of roaming profiles support means that users can move between 153 153 desktop computer systems without constraint while retaining full access to their data. 154 154 The desktop travels with them as they move. 155 155 </p><p> 156 <a class="indexterm" name="id3 30555"></a>156 <a class="indexterm" name="id329054"></a> 157 157 The DNS server implementation must now address both internal and external 158 158 needs. You forward DNS lookups to your ISP-provided server as well as the 159 159 <code class="constant">abmas.us</code> external secondary DNS server. 160 160 </p><p> 161 <a class="indexterm" name="id3 30569"></a>162 <a class="indexterm" name="id3 30575"></a>163 <a class="indexterm" name="id3 30584"></a>161 <a class="indexterm" name="id329068"></a> 162 <a class="indexterm" name="id329075"></a> 163 <a class="indexterm" name="id329083"></a> 164 164 Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the 165 165 configuration used in this example has to deal with the presence of an Internet connection. … … 185 185 then clone that configuration, using Norton Ghost, to all workstations. Each machine is 186 186 identical, so this should pose no problem. 187 </p><div class="sect3" title="Hardware Requirements"><div class="titlepage"><div><div><h4 class="title"><a name="id3 30622"></a>Hardware Requirements</h4></div></div></div><p>188 <a class="indexterm" name="id3 30630"></a>187 </p><div class="sect3" title="Hardware Requirements"><div class="titlepage"><div><div><h4 class="title"><a name="id329122"></a>Hardware Requirements</h4></div></div></div><p> 188 <a class="indexterm" name="id329129"></a> 189 189 This server runs a considerable number of services. From similarly configured Linux 190 190 installations, the approximate calculated memory requirements are as shown in … … 214 214 compromise in this area. 215 215 </p><p> 216 <a class="indexterm" name="id3 30669"></a>216 <a class="indexterm" name="id329168"></a> 217 217 Aggregate input/output loads should be considered for sizing network configuration as 218 218 well as disk subsystems. For network bandwidth calculations, one would typically use an … … 223 223 switched ports. 224 224 </p><p> 225 <a class="indexterm" name="id3 30683"></a>226 <a class="indexterm" name="id3 30689"></a>225 <a class="indexterm" name="id329183"></a> 226 <a class="indexterm" name="id329189"></a> 227 227 Considering the choice of 1 Gb Ethernet interfaces for the two local network segments, 228 228 the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O … … 256 256 Recommended Storage: 908 GBytes 257 257 </pre></div></div><p><br class="example-break"> 258 <a class="indexterm" name="id3 30731"></a>258 <a class="indexterm" name="id329231"></a> 259 259 The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5 260 260 with two hot spare drives would require an 8-drive by 200 GB capacity per drive array. 261 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30742"></a>Political Issues</h3></div></div></div><p>261 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id329242"></a>Political Issues</h3></div></div></div><p> 262 262 Your industry is coming under increasing accountability pressures. Increased paranoia 263 263 is necessary so you can demonstrate that you have acted with due diligence. You must … … 268 268 gives you greater control over software licensing. 269 269 </p><p> 270 <a class="indexterm" name="id3 30760"></a>270 <a class="indexterm" name="id329260"></a> 271 271 You are well aware that the current configuration results in some performance issues 272 272 as the size of the desktop profile grows. Given that users use Microsoft Outlook 273 273 Express, you know that the storage implications of the <code class="constant">.PST</code> file 274 274 is something that needs to be addressed later. 275 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30776"></a>Implementation</h2></div></div></div><p>275 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id329275"></a>Implementation</h2></div></div></div><p> 276 276 <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement. 277 277 </p><p> … … 289 289 The Domain name is set to <code class="constant">PROMISES</code>. 290 290 </p></li><li class="listitem"><p> 291 <a class="indexterm" name="id3 30826"></a>292 <a class="indexterm" name="id3 30832"></a>293 <a class="indexterm" name="id3 30838"></a>291 <a class="indexterm" name="id329325"></a> 292 <a class="indexterm" name="id329331"></a> 293 <a class="indexterm" name="id329338"></a> 294 294 Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection 295 295 and is externally exposed. This interface is explicitly not available for Samba to use. … … 299 299 <em class="parameter"><code>bind interfaces only</code></em> entry. 300 300 </p></li><li class="listitem"><p> 301 <a class="indexterm" name="id3 30868"></a>302 <a class="indexterm" name="id3 30874"></a>303 <a class="indexterm" name="id3 30881"></a>301 <a class="indexterm" name="id329368"></a> 302 <a class="indexterm" name="id329374"></a> 303 <a class="indexterm" name="id329380"></a> 304 304 The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use 305 305 of the <code class="constant">tdbsam</code> password backend. This is a binary database that 306 306 has excellent scalability for a large number of user account entries. 307 307 </p></li><li class="listitem"><p> 308 <a class="indexterm" name="id3 30901"></a>309 <a class="indexterm" name="id3 30907"></a>310 <a class="indexterm" name="id3 30913"></a>308 <a class="indexterm" name="id329400"></a> 309 <a class="indexterm" name="id329407"></a> 310 <a class="indexterm" name="id329413"></a> 311 311 WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = Yes</a>, 312 312 and name resolution is set to use it by means of the 313 313 <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order = wins bcast hosts</a> entry. 314 314 </p></li><li class="listitem"><p> 315 <a class="indexterm" name="id3 30940"></a>315 <a class="indexterm" name="id329439"></a> 316 316 The Samba server is configured for use by Windows clients as a time server. 317 317 </p></li><li class="listitem"><p> 318 <a class="indexterm" name="id3 30950"></a>319 <a class="indexterm" name="id3 30957"></a>320 <a class="indexterm" name="id3 30963"></a>318 <a class="indexterm" name="id329450"></a> 319 <a class="indexterm" name="id329456"></a> 320 <a class="indexterm" name="id329462"></a> 321 321 Samba is configured to directly interface with CUPS via the direct internal interface 322 322 that is provided by CUPS libraries. This is achieved with the … … 324 324 <a class="link" href="smb.conf.5.html#PRINTCAPNAME" target="_top">printcap name = CUPS</a> entries. 325 325 </p></li><li class="listitem"><p> 326 <a class="indexterm" name="id3 30990"></a>327 <a class="indexterm" name="id3 30996"></a>328 <a class="indexterm" name="id3 31003"></a>326 <a class="indexterm" name="id329490"></a> 327 <a class="indexterm" name="id329496"></a> 328 <a class="indexterm" name="id329502"></a> 329 329 External interface scripts are provided to enable Samba to interface smoothly to 330 330 essential operating system functions for user and group management. This is important … … 335 335 <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>. 336 336 </p></li><li class="listitem"><p> 337 <a class="indexterm" name="id3 31028"></a>337 <a class="indexterm" name="id329527"></a> 338 338 The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code> 339 security = user</code></em> mode<sup>[<a name="id3 31045" href="#ftn.id331045" class="footnote">5</a>]</sup>339 security = user</code></em> mode<sup>[<a name="id329544" href="#ftn.id329544" class="footnote">5</a>]</sup> 340 340 (User Mode). 341 341 </p></li><li class="listitem"><p> 342 <a class="indexterm" name="id3 31061"></a>343 <a class="indexterm" name="id3 31067"></a>342 <a class="indexterm" name="id329560"></a> 343 <a class="indexterm" name="id329566"></a> 344 344 Domain logon services as well as a Domain logon script are specified. The logon script 345 345 will be used to add robustness to the overall network configuration. 346 346 </p></li><li class="listitem"><p> 347 <a class="indexterm" name="id3 31079"></a>348 <a class="indexterm" name="id3 31085"></a>349 <a class="indexterm" name="id3 31092"></a>347 <a class="indexterm" name="id329578"></a> 348 <a class="indexterm" name="id329585"></a> 349 <a class="indexterm" name="id329591"></a> 350 350 Roaming profiles are enabled through the specification of the parameter, 351 351 <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the … … 357 357 requirement is when a profile is created for group use. 358 358 </p></li><li class="listitem"><p> 359 <a class="indexterm" name="id3 31124"></a>360 <a class="indexterm" name="id3 31130"></a>359 <a class="indexterm" name="id329623"></a> 360 <a class="indexterm" name="id329630"></a> 361 361 Precautionary veto is effected for particular Windows file names that have been targeted by 362 362 virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking … … 386 386 The following sections cover each step in logical and defined detail. 387 387 </p><div class="sect2" title="Basic System Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> 388 <a class="indexterm" name="id3 31207"></a>388 <a class="indexterm" name="id329706"></a> 389 389 The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been 390 390 freshly installed. It prepares basic files so that the system is ready for comprehensive 391 391 operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>. 392 </p><div class="procedure" title="Procedure 3.1. Server Configuration Steps"><a name="id3 31220"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>393 <a class="indexterm" name="id3 31231"></a>392 </p><div class="procedure" title="Procedure 3.1. Server Configuration Steps"><a name="id329720"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 393 <a class="indexterm" name="id329730"></a> 394 394 Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>. 395 395 Verify that your hostname is correctly set by running: … … 404 404 </pre><p> 405 405 </p></li><li class="step" title="Step 2"><p> 406 <a class="indexterm" name="id3 31268"></a>407 <a class="indexterm" name="id3 31274"></a>406 <a class="indexterm" name="id329768"></a> 407 <a class="indexterm" name="id329774"></a> 408 408 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 409 409 of all network interfaces that are on the host server. This is necessary so that during … … 426 426 192.168.2.30 hplj6f.abmas.biz hplj6f 427 427 </pre><p> 428 <a class="indexterm" name="id3 31319"></a>429 <a class="indexterm" name="id3 31325"></a>430 <a class="indexterm" name="id3 31332"></a>428 <a class="indexterm" name="id329818"></a> 429 <a class="indexterm" name="id329825"></a> 430 <a class="indexterm" name="id329831"></a> 431 431 The printer entries are not necessary if <code class="literal">named</code> is started prior to 432 432 startup of <code class="literal">cupsd</code>, the CUPS daemon. 433 433 </p></li><li class="step" title="Step 3"><p> 434 <a class="indexterm" name="id3 31354"></a>435 <a class="indexterm" name="id3 31361"></a>436 <a class="indexterm" name="id3 31367"></a>434 <a class="indexterm" name="id329854"></a> 435 <a class="indexterm" name="id329860"></a> 436 <a class="indexterm" name="id329866"></a> 437 437 The host server is acting as a router between the two internal network segments as well 438 438 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 443 443 To ensure that your kernel is capable of IP forwarding during configuration, you may 444 444 wish to execute that command manually also. This setting permits the Linux system to 445 act as a router.<sup>[<a name="id3 31388" href="#ftn.id331388" class="footnote">6</a>]</sup>445 act as a router.<sup>[<a name="id329888" href="#ftn.id329888" class="footnote">6</a>]</sup> 446 446 </p></li><li class="step" title="Step 4"><p> 447 <a class="indexterm" name="id3 31400"></a>448 <a class="indexterm" name="id3 31406"></a>447 <a class="indexterm" name="id329899"></a> 448 <a class="indexterm" name="id329906"></a> 449 449 Installation of a basic firewall and NAT facility is necessary. 450 450 The following script can be installed in the <code class="filename">/usr/local/sbin</code> … … 525 525 </pre><p> 526 526 </p></li></ol></div><p> 527 <a class="indexterm" name="id33 1512"></a>527 <a class="indexterm" name="id330011"></a> 528 528 The server is now ready for Samba configuration. During the validation step, you remove 529 529 the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> 530 530 file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. 531 </p></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id33 1530"></a>Samba Configuration</h3></div></div></div><p>531 </p></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id330030"></a>Samba Configuration</h3></div></div></div><p> 532 532 When you have completed this section, the Samba server is ready for testing and validation; 533 533 however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have 534 534 been configured. 535 </p><div class="procedure" title="Procedure 3.2. Samba Configuration Steps"><a name="id33 1541"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>535 </p><div class="procedure" title="Procedure 3.2. Samba Configuration Steps"><a name="id330040"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 536 536 Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary 537 537 RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this … … 548 548 file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>. 549 549 550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id33 1640"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id331650"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id331661"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id331671"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331682"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id331692"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331702"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id331713"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id331724"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id331734"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331745"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id331755"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id331766"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id331776"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id331786"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id331797"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id331807"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331818"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id331828"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id331838"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331849"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331859"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id331870"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id331880"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331891"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331902"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id331912"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id331923"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id331933"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id331944"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id331954"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id331964"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331975"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331985"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331996"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332006"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332016"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id332027"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id332037"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id332048"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id33 2085"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id332096"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id332106"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id332117"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id332135"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id332146"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id332156"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332167"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332177"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332187"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332198"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id332217"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id332227"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id332237"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332248"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id332267"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id332277"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id332287"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id332298"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id332317"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id332327"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id332337"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id33 2375"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id332386"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id332396"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id332415"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id332425"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id332436"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id332454"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id332465"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id332475"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332486"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id330139"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id330150"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id330160"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id330171"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330181"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id330191"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330202"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id330212"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id330223"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id330234"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330244"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id330255"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id330265"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id330275"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id330286"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id330296"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id330307"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330317"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id330327"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id330338"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id330348"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id330359"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id330369"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id330379"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id330390"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id330402"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id330412"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id330422"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id330433"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id330443"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id330454"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id330464"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330474"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330485"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330495"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330506"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330516"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id330526"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id330537"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id330547"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> 551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id330585"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id330595"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id330606"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id330616"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id330635"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id330645"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id330656"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330666"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330676"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330687"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330697"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id330716"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id330726"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id330737"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330747"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id330766"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id330776"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id330787"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id330797"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id330816"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id330826"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id330837"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> 553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id330875"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id330885"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id330895"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id330914"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id330925"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id330935"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id330954"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id330964"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id330975"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id330985"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> 555 555 </p></li><li class="step" title="Step 3"><p> 556 <a class="indexterm" name="id33 2503"></a><a class="indexterm" name="id332508"></a>556 <a class="indexterm" name="id331003"></a><a class="indexterm" name="id331008"></a> 557 557 Add the <code class="constant">root</code> user to the password backend as follows: 558 558 </p><pre class="screen"> … … 567 567 without considerable trouble. 568 568 </p></li><li class="step" title="Step 4"><p> 569 <a class="indexterm" name="id33 2548"></a>569 <a class="indexterm" name="id331048"></a> 570 570 Create the username map file to permit the <code class="constant">root</code> account to be called 571 571 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 594 594 </pre><p> 595 595 </p></li><li class="step" title="Step 5"><p> 596 <a class="indexterm" name="id33 2583"></a>597 <a class="indexterm" name="id33 2590"></a>598 <a class="indexterm" name="id33 2600"></a>599 <a class="indexterm" name="id33 2611"></a>596 <a class="indexterm" name="id331083"></a> 597 <a class="indexterm" name="id331089"></a> 598 <a class="indexterm" name="id331100"></a> 599 <a class="indexterm" name="id331110"></a> 600 600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, 601 601 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 603 603 and then execute the script. Sample output should be as follows: 604 604 605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id33 2645"></a><pre class="screen">605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id331144"></a><pre class="screen"> 606 606 #!/bin/bash 607 607 # … … 656 656 </pre><p> 657 657 </p></li><li class="step" title="Step 6"><p> 658 <a class="indexterm" name="id33 2701"></a>659 <a class="indexterm" name="id33 2708"></a>660 <a class="indexterm" name="id33 2714"></a>661 <a class="indexterm" name="id33 2720"></a>662 <a class="indexterm" name="id33 2726"></a>663 <a class="indexterm" name="id33 2733"></a>664 <a class="indexterm" name="id33 2741"></a>658 <a class="indexterm" name="id331201"></a> 659 <a class="indexterm" name="id331207"></a> 660 <a class="indexterm" name="id331213"></a> 661 <a class="indexterm" name="id331220"></a> 662 <a class="indexterm" name="id331226"></a> 663 <a class="indexterm" name="id331232"></a> 664 <a class="indexterm" name="id331240"></a> 665 665 There is one preparatory step without which you will not have a working Samba 666 666 network environment. You must add an account for each network user. … … 687 687 You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 688 688 </p></li><li class="step" title="Step 7"><p> 689 <a class="indexterm" name="id33 2838"></a>690 <a class="indexterm" name="id33 2846"></a>691 <a class="indexterm" name="id33 2854"></a>689 <a class="indexterm" name="id331337"></a> 690 <a class="indexterm" name="id331345"></a> 691 <a class="indexterm" name="id331354"></a> 692 692 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 693 693 previously as necessary. File system access control will be based on UNIX group membership. … … 698 698 file system partition using appropriate system tools. 699 699 </p></li><li class="step" title="Step 9"><p> 700 <a class="indexterm" name="id33 2889"></a>700 <a class="indexterm" name="id331388"></a> 701 701 Create the top-level file storage directories for data and applications as follows: 702 702 </p><pre class="screen"> … … 739 739 </pre><p> 740 740 </p></li><li class="step" title="Step 11"><p> 741 <a class="indexterm" name="id33 3063"></a>742 <a class="indexterm" name="id33 3069"></a>743 <a class="indexterm" name="id33 3075"></a>741 <a class="indexterm" name="id331562"></a> 742 <a class="indexterm" name="id331568"></a> 743 <a class="indexterm" name="id331575"></a> 744 744 Create a logon script. It is important that each line is correctly terminated with 745 745 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 761 761 foundational to Internet access as well as to trouble-free operation of local networking. When 762 762 you have completed this section, the server should be ready for solid duty operation. 763 </p><div class="procedure" title="Procedure 3.3. DHCP and DNS Server Configuration Steps"><a name="id33 3134"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>764 <a class="indexterm" name="id33 3145"></a>763 </p><div class="procedure" title="Procedure 3.3. DHCP and DNS Server Configuration Steps"><a name="id331634"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 764 <a class="indexterm" name="id331644"></a> 765 765 Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as 766 766 shown in <a class="link" href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>. … … 813 813 </pre></div></div><p><br class="example-break"> 814 814 </p></li><li class="step" title="Step 2"><p> 815 <a class="indexterm" name="id33 3199"></a>815 <a class="indexterm" name="id331698"></a> 816 816 Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents 817 817 of the <a class="link" href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and … … 824 824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break"> 825 825 826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id33 3369"></a><pre class="screen">826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id331893"></a><pre class="screen"> 827 827 ### 828 828 # Abmas Biz DNS Control File … … 1009 1009 1010 1010 </p></li><li class="step" title="Step 4"><p> 1011 <a class="indexterm" name="id33 3533"></a><a class="indexterm" name="id333539"></a>1011 <a class="indexterm" name="id332064"></a><a class="indexterm" name="id332069"></a> 1012 1012 All DNS name resolution should be handled locally. To ensure that the server is configured 1013 1013 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following … … 1018 1018 nameserver 123.45.54.23 1019 1019 </pre><p> 1020 <a class="indexterm" name="id33 3561"></a>1020 <a class="indexterm" name="id332092"></a> 1021 1021 This instructs the name resolver function (when configured correctly) to ask the DNS server 1022 1022 that is running locally to resolve names to addresses. In the event that the local name server … … 1024 1024 purely local names to IP addresses. 1025 1025 </p></li><li class="step" title="Step 5"><p> 1026 <a class="indexterm" name="id33 3580"></a>1026 <a class="indexterm" name="id332110"></a> 1027 1027 The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 1028 1028 This file controls the operation of the various resolver libraries that are part of the Linux … … 1043 1043 submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that 1044 1044 the correct printer driver must be installed on all clients. 1045 </p><div class="procedure" title="Procedure 3.4. Printer Configuration Steps"><a name="id33 3627"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1045 </p><div class="procedure" title="Procedure 3.4. Printer Configuration Steps"><a name="id332157"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1046 1046 Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines. 1047 1047 </p></li><li class="step" title="Step 2"><p> … … 1050 1050 port as necessary in the following example commands. 1051 1051 This allows the CUPS spooler to print using raw mode protocols. 1052 <a class="indexterm" name="id33 3649"></a>1053 <a class="indexterm" name="id33 3656"></a>1052 <a class="indexterm" name="id332179"></a> 1053 <a class="indexterm" name="id332186"></a> 1054 1054 </p></li><li class="step" title="Step 3"><p> 1055 <a class="indexterm" name="id33 3669"></a><a class="indexterm" name="id333677"></a>1055 <a class="indexterm" name="id332199"></a><a class="indexterm" name="id332207"></a> 1056 1056 Configure the CUPS Print Queues as follows: 1057 1057 </p><pre class="screen"> … … 1061 1061 <code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E 1062 1062 </pre><p> 1063 <a class="indexterm" name="id33 3717"></a>1063 <a class="indexterm" name="id332248"></a> 1064 1064 This creates the necessary print queues with no assigned print filter. 1065 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id33 3731"></a>1065 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id332261"></a> 1066 1066 Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check 1067 1067 the status of the print queues and, if necessary, make certain that the queues you have … … 1073 1073 <code class="prompt">root# </code> /usr/bin/enable hplj6f 1074 1074 </pre><p> 1075 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id33 3783"></a>1075 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id332313"></a> 1076 1076 Even though your print queues may be enabled, it is still possible that they 1077 1077 are not accepting print jobs. A print queue services incoming printing … … 1085 1085 </pre><p> 1086 1086 </p></li><li class="step" title="Step 6"><p> 1087 <a class="indexterm" name="id33 3831"></a>1088 <a class="indexterm" name="id33 3838"></a>1089 <a class="indexterm" name="id33 3844"></a>1087 <a class="indexterm" name="id332361"></a> 1088 <a class="indexterm" name="id332367"></a> 1089 <a class="indexterm" name="id332374"></a> 1090 1090 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 1091 1091 </p><pre class="screen"> … … 1093 1093 </pre><p> 1094 1094 </p></li><li class="step" title="Step 7"><p> 1095 <a class="indexterm" name="id33 3871"></a>1095 <a class="indexterm" name="id332400"></a> 1096 1096 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 1097 1097 </p><pre class="screen"> … … 1106 1106 The UNIX system print queues have been configured and are ready for validation testing. 1107 1107 </p></div><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> 1108 <a class="indexterm" name="id33 3932"></a>1108 <a class="indexterm" name="id332462"></a> 1109 1109 There are two essential steps to process startup configuration. First, the process 1110 1110 must be configured so that it automatically restarts each time the server … … 1115 1115 necessary start or kill script is run. 1116 1116 </p><p> 1117 <a class="indexterm" name="id33 3964"></a>1118 <a class="indexterm" name="id33 3970"></a>1119 <a class="indexterm" name="id33 3977"></a>1120 <a class="indexterm" name="id33 3984"></a>1121 <a class="indexterm" name="id33 3991"></a>1117 <a class="indexterm" name="id332493"></a> 1118 <a class="indexterm" name="id332500"></a> 1119 <a class="indexterm" name="id332507"></a> 1120 <a class="indexterm" name="id332514"></a> 1121 <a class="indexterm" name="id332520"></a> 1122 1122 In the event that a service is not run as a daemon, but via the internetworking 1123 1123 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 1130 1130 Use the standard system tool to configure each service to restart 1131 1131 automatically at every system reboot. For example, 1132 <a class="indexterm" name="id33 4038"></a>1132 <a class="indexterm" name="id332567"></a> 1133 1133 </p><pre class="screen"> 1134 1134 <code class="prompt">root# </code> chkconfig dhpcd on … … 1138 1138 </pre><p> 1139 1139 </p></li><li class="step" title="Step 2"><p> 1140 <a class="indexterm" name="id33 4080"></a>1141 <a class="indexterm" name="id33 4087"></a>1142 <a class="indexterm" name="id33 4094"></a>1140 <a class="indexterm" name="id332610"></a> 1141 <a class="indexterm" name="id332617"></a> 1142 <a class="indexterm" name="id332624"></a> 1143 1143 Now start each service to permit the system to be validated. 1144 1144 Execute each of the following in the sequence shown: … … 1151 1151 </pre><p> 1152 1152 </p></li></ol></div></div><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> 1153 <a class="indexterm" name="id33 4146"></a>1153 <a class="indexterm" name="id332676"></a> 1154 1154 Complex networking problems are most often caused by simple things that are poorly or incorrectly 1155 1155 configured. The validation process adopted here should be followed carefully; it is the result of the … … 1161 1161 Later in this book you learn how to make users happier. For now, it is enough to learn to 1162 1162 validate. Let's get on with it. 1163 </p><div class="procedure" title="Procedure 3.5. Server Validation Steps"><a name="id33 4161"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>1164 <a class="indexterm" name="id33 4172"></a>1163 </p><div class="procedure" title="Procedure 3.5. Server Validation Steps"><a name="id332691"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1164 <a class="indexterm" name="id332702"></a> 1165 1165 One of the most important facets of Samba configuration is to ensure that 1166 1166 name resolution functions correctly. You can check name resolution … … 1188 1188 is working. 1189 1189 </p></li><li class="step" title="Step 2"><p> 1190 <a class="indexterm" name="id33 4233"></a>1190 <a class="indexterm" name="id332763"></a> 1191 1191 So far, your installation is going particularly well. In this step we validate 1192 1192 DNS server and name resolution operation. Using your favorite UNIX system editor, … … 1197 1197 </pre><p> 1198 1198 </p></li><li class="step" title="Step 3"><p> 1199 <a class="indexterm" name="id33 4263"></a>1199 <a class="indexterm" name="id332793"></a> 1200 1200 Before you test DNS operation, it is a good idea to verify that the DNS server 1201 1201 is running by executing the following: … … 1211 1211 </pre><p> 1212 1212 This means that we are ready to check DNS operation. Do so by executing: 1213 <a class="indexterm" name="id33 4287"></a>1213 <a class="indexterm" name="id332818"></a> 1214 1214 </p><pre class="screen"> 1215 1215 <code class="prompt">root# </code> ping diamond … … 1227 1227 sleeth1.abmas.biz has address 192.168.1.1 1228 1228 </pre><p> 1229 <a class="indexterm" name="id33 4321"></a>1229 <a class="indexterm" name="id332851"></a> 1230 1230 You may now remove the entry called <code class="constant">diamond</code> from the 1231 1231 <code class="filename">/etc/hosts</code> file. It does not hurt to leave it there, 1232 1232 but its removal reduces the number of administrative steps for this name. 1233 1233 </p></li><li class="step" title="Step 4"><p> 1234 <a class="indexterm" name="id33 4346"></a>1234 <a class="indexterm" name="id332876"></a> 1235 1235 WINS is a great way to resolve NetBIOS names to their IP address. You can test 1236 1236 the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way … … 1251 1251 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms 1252 1252 </pre><p> 1253 <a class="indexterm" name="id33 4432"></a>1253 <a class="indexterm" name="id332962"></a> 1254 1254 Now that you can relax with the knowledge that all three major forms of name 1255 1255 resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code> … … 1272 1272 comes when you try to add the first DHCP client to the network. 1273 1273 </p></li><li class="step" title="Step 6"><p> 1274 <a class="indexterm" name="id33 4485"></a>1274 <a class="indexterm" name="id333015"></a> 1275 1275 This is a good point at which to start validating Samba operation. You are 1276 1276 content that name resolution is working for basic TCP/IP needs. Let's move on. … … 1344 1344 Clear away all errors before proceeding. 1345 1345 </p></li><li class="step" title="Step 7"><p> 1346 <a class="indexterm" name="id33 4550"></a>1347 <a class="indexterm" name="id33 4557"></a>1348 <a class="indexterm" name="id33 4564"></a>1349 <a class="indexterm" name="id33 4571"></a>1346 <a class="indexterm" name="id333080"></a> 1347 <a class="indexterm" name="id333087"></a> 1348 <a class="indexterm" name="id333094"></a> 1349 <a class="indexterm" name="id333101"></a> 1350 1350 Check that the Samba server is running: 1351 1351 </p><pre class="screen"> … … 1360 1360 </pre><p> 1361 1361 The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also 1362 two instances<sup>[<a name="id33 4598" href="#ftn.id334598" class="footnote">7</a>]</sup> of it.1362 two instances<sup>[<a name="id333129" href="#ftn.id333129" class="footnote">7</a>]</sup> of it. 1363 1363 </p></li><li class="step" title="Step 8"><p> 1364 <a class="indexterm" name="id33 4627"></a>1365 <a class="indexterm" name="id33 4634"></a>1364 <a class="indexterm" name="id333157"></a> 1365 <a class="indexterm" name="id333164"></a> 1366 1366 Check that an anonymous connection can be made to the Samba server: 1367 1367 </p><pre class="screen"> … … 1395 1395 a <code class="constant">NULL</code> password. 1396 1396 </p></li><li class="step" title="Step 9"><p> 1397 <a class="indexterm" name="id33 4682"></a>1398 <a class="indexterm" name="id33 4688"></a>1399 <a class="indexterm" name="id33 4695"></a>1397 <a class="indexterm" name="id333211"></a> 1398 <a class="indexterm" name="id333218"></a> 1399 <a class="indexterm" name="id333225"></a> 1400 1400 Verify that each printer has the IP address assigned in the DHCP server configuration file. 1401 1401 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 1412 1412 hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0 1413 1413 </pre><p> 1414 <a class="indexterm" name="id33 4736"></a>1414 <a class="indexterm" name="id333266"></a> 1415 1415 The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the 1416 1416 IP address from which the printer has responded and with the entry for it in the 1417 1417 <code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured. 1418 1418 </p></li><li class="step" title="Step 10"><p> 1419 <a class="indexterm" name="id33 4763"></a>1419 <a class="indexterm" name="id333292"></a> 1420 1420 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 1421 1421 </p><pre class="screen"> … … 1436 1436 </pre><p> 1437 1437 </p></li><li class="step" title="Step 11"><p> 1438 <a class="indexterm" name="id33 4807"></a>1438 <a class="indexterm" name="id333336"></a> 1439 1439 Your new server is connected to an Internet-accessible connection. Before you start 1440 1440 your firewall, you should run a port scanner against your system. You should repeat that … … 1511 1511 </pre><p> 1512 1512 </p></li></ol></div></div><div class="sect2" title="Application Share Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> 1513 <a class="indexterm" name="id33 4886"></a>1514 <a class="indexterm" name="id33 4893"></a>1513 <a class="indexterm" name="id333416"></a> 1514 <a class="indexterm" name="id333422"></a> 1515 1515 The use of an application server is a key mechanism by which desktop administration overheads 1516 1516 can be reduced. Check the application manual for your software to identify how best to … … 1533 1533 of work files on the local workstation. 1534 1534 </p></li></ul></div><p> 1535 <a class="indexterm" name="id33 4936"></a>1535 <a class="indexterm" name="id333465"></a> 1536 1536 A common application deployed in this environment is an office suite. 1537 1537 Enterprise editions of Microsoft Office XP Professional can be administratively installed … … 1550 1550 local disk space. In the latter case, when the applications are used, they load over the network. 1551 1551 </p><p> 1552 <a class="indexterm" name="id33 4963"></a>1553 <a class="indexterm" name="id33 4970"></a>1552 <a class="indexterm" name="id333493"></a> 1553 <a class="indexterm" name="id333500"></a> 1554 1554 Microsoft Office Service Packs can be unpacked to update an administrative share. This makes 1555 1555 it possible to update MS Office XP Professional for all users from a single installation … … 1560 1560 editing or by way of configuration options inside each Office XP Professional application. 1561 1561 </p><p> 1562 <a class="indexterm" name="id33 4988"></a>1562 <a class="indexterm" name="id333517"></a> 1563 1563 OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also 1564 1564 be installed to run off a network share. The latter is a most desirable solution for office-bound … … 1573 1573 share point. The full administrative OpenOffice share takes approximately 150 MB of disk 1574 1574 space. 1575 </p><div class="sect3" title="Comments Regarding Software Terms of Use"><div class="titlepage"><div><div><h4 class="title"><a name="id33 5012"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>1575 </p><div class="sect3" title="Comments Regarding Software Terms of Use"><div class="titlepage"><div><div><h4 class="title"><a name="id333541"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> 1576 1576 Many single-user products can be installed into an administrative share, but 1577 1577 personal versions of products such as Microsoft Office XP Professional do not permit this. … … 1597 1597 please do not use the software. 1598 1598 </p><p> 1599 <a class="indexterm" name="id33 5047"></a>1599 <a class="indexterm" name="id333576"></a> 1600 1600 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided 1601 1601 with the source code. … … 1608 1608 be done with notebook computers as long as they are identical or sufficiently similar. 1609 1609 </p><div class="procedure" title="Procedure 3.6. Windows Client Configuration Procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1610 <a class="indexterm" name="id33 5091"></a>1611 <a class="indexterm" name="id33 5098"></a>1610 <a class="indexterm" name="id333619"></a> 1611 <a class="indexterm" name="id333626"></a> 1612 1612 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 1613 1613 TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server … … 1642 1642 preparation procedure below. 1643 1643 </p></li><li class="step" title="Step 8"><p> 1644 <a class="indexterm" name="id33 5222"></a>1644 <a class="indexterm" name="id333750"></a> 1645 1645 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1646 1646 remove the client from the domain. Reboot the system and then log on as the local administrator … … 1651 1651 machine to a network share on the server. 1652 1652 </p></li><li class="step" title="Step 10"><p> 1653 <a class="indexterm" name="id33 5246"></a>1654 <a class="indexterm" name="id33 5256"></a>1653 <a class="indexterm" name="id333774"></a> 1654 <a class="indexterm" name="id333784"></a> 1655 1655 You may now replicate the image to the target machines using the appropriate Norton Ghost 1656 1656 procedure. Make sure to use the procedure that ensures each machine has a unique … … 1687 1687 Repeat the printer installation steps above for both HP LaserJet 6 printers 1688 1688 as well as for both QMS Magicolor laser printers. 1689 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id33 5513"></a>Key Points Learned</h3></div></div></div><p>1689 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id334042"></a>Key Points Learned</h3></div></div></div><p> 1690 1690 How do you feel? You have built a capable network, a truly ambitious project. 1691 1691 Future network updates can be handled by … … 1710 1710 client in order to effect improved standardization of desktops and to reduce 1711 1711 the costs of network management. 1712 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id33 5566"></a>Questions and Answers</h2></div></div></div><p>1713 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id33 5576"></a><dl><dt>1. <a href="secure.html#id335582">1712 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id334095"></a>Questions and Answers</h2></div></div></div><p> 1713 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id334104"></a><dl><dt>1. <a href="secure.html#id334111"> 1714 1714 What is the maximum number of account entries that the tdbsam 1715 1715 passdb backend can handle? 1716 </a></dt><dt>2. <a href="secure.html#id33 5635">1716 </a></dt><dt>2. <a href="secure.html#id334164"> 1717 1717 Would Samba operate any better if the OS level is set to a value higher than 35? 1718 </a></dt><dt>3. <a href="secure.html#id33 5654">1718 </a></dt><dt>3. <a href="secure.html#id334183"> 1719 1719 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1720 </a></dt><dt>4. <a href="secure.html#id33 5674">1720 </a></dt><dt>4. <a href="secure.html#id334202"> 1721 1721 Why has a path been specified in the IPC$ share? 1722 </a></dt><dt>5. <a href="secure.html#id33 5699">1722 </a></dt><dt>5. <a href="secure.html#id334228"> 1723 1723 Why does the smb.conf file in this exercise include an entry for smb ports? 1724 </a></dt><dt>6. <a href="secure.html#id33 5740">1724 </a></dt><dt>6. <a href="secure.html#id334268"> 1725 1725 What is the difference between a print queue and a printer? 1726 </a></dt><dt>7. <a href="secure.html#id33 5768">1726 </a></dt><dt>7. <a href="secure.html#id334296"> 1727 1727 Can all MS Windows application software be installed onto an application server share? 1728 </a></dt><dt>8. <a href="secure.html#id33 5788">1728 </a></dt><dt>8. <a href="secure.html#id334316"> 1729 1729 Why use dynamic DNS (DDNS)? 1730 </a></dt><dt>9. <a href="secure.html#id33 5807">1730 </a></dt><dt>9. <a href="secure.html#id334335"> 1731 1731 Why would you use WINS as well as DNS-based name resolution? 1732 </a></dt><dt>10. <a href="secure.html#id33 5876">1732 </a></dt><dt>10. <a href="secure.html#id334404"> 1733 1733 What are the major benefits of using an application server? 1734 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id33 5582"></a><a name="id335584"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>1734 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id334111"></a><a name="id334113"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 1735 1735 What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em> 1736 1736 passdb backend can handle? … … 1758 1758 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The 1759 1759 limitation of 250 users per tdbsam is predicated only on the need for replication, 1760 not on the limits<sup>[<a name="id33 5626" href="#ftn.id335626" class="footnote">8</a>]</sup> of the tdbsam backend itself.1761 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id33 5635"></a><a name="id335637"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>1760 not on the limits<sup>[<a name="id334154" href="#ftn.id334154" class="footnote">8</a>]</sup> of the tdbsam backend itself. 1761 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id334164"></a><a name="id334166"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 1762 1762 Would Samba operate any better if the OS level is set to a value higher than 35? 1763 1763 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1765 1765 of 35 already assures Samba of precedence over MS Windows products in browser elections. There is 1766 1766 no gain to be had from setting this higher. 1767 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id33 5654"></a><a name="id335656"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>1767 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id334183"></a><a name="id334185"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 1768 1768 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1769 1769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1771 1771 a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special 1772 1772 Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. 1773 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id33 5674"></a><a name="id335676"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>1773 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id334202"></a><a name="id334205"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 1774 1774 Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share? 1775 1775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1777 1777 obtain access to the file system, it does so at a location that presents least risk. Under normal operation 1778 1778 this type of paranoid step should not be necessary. The use of this parameter should not be necessary. 1779 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id33 5699"></a><a name="id335701"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>1779 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id334228"></a><a name="id334230"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 1780 1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS" target="_top">smb ports</a>? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1786 1786 The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain 1787 1787 member, the default behavior is highly beneficial and should not be changed. 1788 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id33 5740"></a><a name="id335742"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>1788 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id334268"></a><a name="id334270"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 1789 1789 What is the difference between a print queue and a printer? 1790 1790 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1800 1800 and the job is then submitted to a sequential print queue where the job is stored until 1801 1801 the printer is ready to receive the job. 1802 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id33 5768"></a><a name="id335770"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>1802 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id334296"></a><a name="id334298"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 1803 1803 Can all MS Windows application software be installed onto an application server share? 1804 1804 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1808 1808 Professional do not permit installation to an application server share and can be installed 1809 1809 and used only to/from a local workstation hard disk. 1810 </p></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id33 5788"></a><a name="id335791"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>1810 </p></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id334316"></a><a name="id334319"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 1811 1811 Why use dynamic DNS (DDNS)? 1812 1812 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1814 1814 network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate 1815 1815 Windows clients via DNS. 1816 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id33 5807"></a><a name="id335809"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>1816 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id334335"></a><a name="id334337"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 1817 1817 Why would you use WINS as well as DNS-based name resolution? 1818 1818 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1822 1822 expression that may be up to 1024 characters in length and that represents an IP address. 1823 1823 A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character 1824 is a name type indicator. A specific name type is registered<sup>[<a name="id33 5840" href="#ftn.id335840" class="footnote">9</a>]</sup> for each1824 is a name type indicator. A specific name type is registered<sup>[<a name="id334368" href="#ftn.id334368" class="footnote">9</a>]</sup> for each 1825 1825 type of service that is provided by the Windows server or client and that may be registered 1826 1826 where a WINS server is in use. … … 1837 1837 </p><p> 1838 1838 Windows 200x Active Directory requires the registration in the DNS zone for the domain it 1839 controls of service locator<sup>[<a name="id33 5866" href="#ftn.id335866" class="footnote">10</a>]</sup> records1839 controls of service locator<sup>[<a name="id334394" href="#ftn.id334394" class="footnote">10</a>]</sup> records 1840 1840 that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also 1841 1841 requires the registration of special records that are called global catalog (GC) entries 1842 1842 and site entries by which domain controllers and other essential ADS servers may be located. 1843 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id33 5876"></a><a name="id335879"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>1843 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id334404"></a><a name="id334406"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 1844 1844 What are the major benefits of using an application server? 1845 1845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1848 1848 one location for all major applications used. This results in faster update roll-outs and 1849 1849 significantly better application usage control. 1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 31045" href="#id331045" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id329544" href="#id329544" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. 1851 1851 This is necessary so that Samba can act as a Domain Controller (PDC); see 1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 31388" href="#id331388" class="para">6</a>] </sup>You may want to do the echo command last and include1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id33 4598" href="#id334598" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id329888" href="#id329888" class="para">6</a>] </sup>You may want to do the echo command last and include 1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id333129" href="#id333129" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, 1854 1854 Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional 1855 1855 <code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client 1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id33 5626" href="#id335626" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334154" href="#id334154" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very 1857 1857 effective database technology. There is surprisingly little performance loss even 1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id33 5840" href="#id335840" class="para">9</a>] </sup>1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id33 5866" href="#id335866" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html>1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334368" href="#id334368" class="para">9</a>] </sup> 1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334394" href="#id334394" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/simple.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 1. No-Frills Samba Servers"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id32 3089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 1. No-Frills Samba Servers"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id321589">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id321619">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id321657">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id322302">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id325424">Questions and Answers</a></span></dt></dl></div><p> 2 2 This is the start of the real journey toward the successful deployment of Samba. For some this chapter 3 3 is the end of the road because their needs will have been adequately met. For others, this chapter is … … 5 5 example configurations of, for the greater part, complete networking solutions. The intent of this book 6 6 is to help you to get your Samba installation working with the least amount of pain and aggravation. 7 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 3089"></a>Introduction</h2></div></div></div><p>7 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321589"></a>Introduction</h2></div></div></div><p> 8 8 This chapter lays the groundwork for understanding the basics of Samba operation. 9 9 Instead of a bland technical discussion, each principle is demonstrated by way of a 10 real-world scenario for which a working solution<sup>[<a name="id32 3099" href="#ftn.id323099" class="footnote">1</a>]</sup> is fully described.10 real-world scenario for which a working solution<sup>[<a name="id321598" href="#ftn.id321598" class="footnote">1</a>]</sup> is fully described. 11 11 </p><p> 12 12 The practical exercises take you on a journey through a drafting office, a charity administration … … 18 18 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your 19 19 way through the examples. 20 </p></div><div class="sect1" title="Assignment Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 3120"></a>Assignment Tasks</h2></div></div></div><p>20 </p></div><div class="sect1" title="Assignment Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321619"></a>Assignment Tasks</h2></div></div></div><p> 21 21 Each case presented highlights different aspects of Windows networking for which a simple 22 22 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases. … … 29 29 </p><p> 30 30 Let's get started. 31 </p><div class="sect2" title="Drafting Office"><div class="titlepage"><div><div><h3 class="title"><a name="id32 3158"></a>Drafting Office</h3></div></div></div><p>31 </p><div class="sect2" title="Drafting Office"><div class="titlepage"><div><div><h3 class="title"><a name="id321657"></a>Drafting Office</h3></div></div></div><p> 32 32 Our fictitious company is called <span class="emphasis"><em>Abmas Design, Inc.</em></span> This is a three-person 33 33 computer-aided design (CAD) business that often has more work than can be handled. The … … 39 39 plans from each machine. The files available from the server must remain read-only. 40 40 Anyone should be able to access the plans at any time and without barriers or difficulty. 41 </p><p><a class="indexterm" name="id32 3177"></a>42 <a class="indexterm" name="id32 3183"></a>41 </p><p><a class="indexterm" name="id321676"></a> 42 <a class="indexterm" name="id321682"></a> 43 43 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central 44 44 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk … … 47 47 <a class="ulink" href="http://www.samba.org" target="_top">FTP</a> sites. (Note: Fedora CoreX indicates your favorite 48 48 version.) 49 </p><p><a class="indexterm" name="id32 3204"></a>49 </p><p><a class="indexterm" name="id321703"></a> 50 50 The four permanent drafting machines (Microsoft Windows workstations) have attached printers 51 51 and plotters that are shared on a peer-to-peer basis by any and all network users. The intent … … 56 56 machine. The office works best with this arrangement and does not want to change anything. 57 57 Old habits are too ingrained. 58 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id32 3219"></a>Dissection and Discussion</h4></div></div></div><p>59 <a class="indexterm" name="id32 3227"></a>58 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id321719"></a>Dissection and Discussion</h4></div></div></div><p> 59 <a class="indexterm" name="id321726"></a> 60 60 The requirements for this server installation demand simplicity. An anonymous read-only 61 61 file server adequately meets all needs. The network consultant determines how … … 64 64 </p><p> 65 65 It is not necessary to have specific users on the server. The site has a method for storing 66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id32 3243" href="#ftn.id323243" class="footnote">2</a>]</sup> where66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id321742" href="#ftn.id321742" class="footnote">2</a>]</sup> where 67 67 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored 68 68 by week of year to preserve the filing technique the site is familiar with. … … 74 74 demanding the disk space that would be needed if a duplicate file copy were to be stored. 75 75 The share containing the plans is called <span class="emphasis"><em>Plans</em></span>. 76 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id32 3262"></a>Implementation</h4></div></div></div><p>76 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id321762"></a>Implementation</h4></div></div></div><p> 77 77 It is assumed that the server is fully installed and ready for installation and 78 78 configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses … … 80 80 <code class="constant">192.168.1.1</code> and the netmask is <code class="constant">255.255.255.0</code>. 81 81 The hostname of the server used is <code class="constant">server</code>. 82 </p><div class="procedure" title="Procedure 1.1. Samba Server Configuration"><a name="id32 3282"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>82 </p><div class="procedure" title="Procedure 1.1. Samba Server Configuration"><a name="id321782"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 83 83 Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba 84 84 <a class="ulink" href="http://www.samba.org" target="_top">FTP servers.</a> 85 85 </p></li><li class="step" title="Step 2"><p> 86 <a class="indexterm" name="id32 3305"></a>87 <a class="indexterm" name="id32 3314"></a>86 <a class="indexterm" name="id321805"></a> 87 <a class="indexterm" name="id321813"></a> 88 88 Install the RPM package using either the Red Hat Linux preferred GUI 89 89 tool or the <code class="literal">rpm</code>: … … 101 101 and execute, and the group and everyone else to read and execute only. 102 102 </p><p> 103 <a class="indexterm" name="id32 3369"></a>103 <a class="indexterm" name="id321869"></a> 104 104 Use Red Hat Linux system tools (refer to Red Hat instructions) 105 105 to format the 160GB hard drive with a suitable file system. An Ext3 file system … … 110 110 <code class="filename">/etc/samba</code> directory. 111 111 112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id32 3435"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id323446"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id323464"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id323475"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323485"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break">112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id321935"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id321945"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id321964"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id321974"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321985"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break"> 113 113 </p></li><li class="step" title="Step 5"><p> 114 <a class="indexterm" name="id32 3503"></a>114 <a class="indexterm" name="id322002"></a> 115 115 Verify that the <code class="filename">/etc/hosts</code> file contains the following entry: 116 116 </p><pre class="screen"> … … 119 119 120 120 </p></li><li class="step" title="Step 6"><p> 121 <a class="indexterm" name="id32 3526"></a>122 <a class="indexterm" name="id32 3534"></a>123 <a class="indexterm" name="id32 3540"></a>121 <a class="indexterm" name="id322025"></a> 122 <a class="indexterm" name="id322034"></a> 123 <a class="indexterm" name="id322040"></a> 124 124 Use the standard system tool to start Samba and to configure it to restart 125 125 automatically at every system reboot. For example, … … 128 128 <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 129 129 </pre><p> 130 </p></li></ol></div><div class="procedure" title="Procedure 1.2. Windows Client Configuration"><a name="id32 3566"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>130 </p></li></ol></div><div class="procedure" title="Procedure 1.2. Windows Client Configuration"><a name="id322065"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 131 131 Make certain that all clients are set to the same network address range as 132 132 used for the Samba server. For example, one client might have an IP 133 133 address 192.168.1.10. 134 134 </p></li><li class="step" title="Step 2"><p> 135 <a class="indexterm" name="id32 3584"></a>135 <a class="indexterm" name="id322084"></a> 136 136 Ensure that the netmask used on the Windows clients matches that used 137 137 for the Samba server. All clients must have the same netmask, such as 138 138 255.255.255.0. 139 139 </p></li><li class="step" title="Step 3"><p> 140 <a class="indexterm" name="id32 3598"></a>140 <a class="indexterm" name="id322098"></a> 141 141 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 142 142 </p></li><li class="step" title="Step 4"><p> … … 146 146 and that it is possible to open that share to reveal its contents. 147 147 </p></li></ol></div></div><div class="sect3" title="Validation"><div class="titlepage"><div><div><h4 class="title"><a name="validate1"></a>Validation</h4></div></div></div><p> 148 <a class="indexterm" name="id32 3642"></a>148 <a class="indexterm" name="id322141"></a> 149 149 The first priority in validating the new Samba configuration should be to check 150 150 that Samba answers on the loop-back interface. Then it is time to check that Samba … … 152 152 server. 153 153 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 154 <a class="indexterm" name="id32 3659"></a>155 <a class="indexterm" name="id32 3665"></a>156 <a class="indexterm" name="id32 3671"></a>154 <a class="indexterm" name="id322158"></a> 155 <a class="indexterm" name="id322164"></a> 156 <a class="indexterm" name="id322171"></a> 157 157 To check the ability to access the <code class="literal">smbd</code> daemon 158 158 services, execute the following: … … 173 173 MIDEARTH SERVER 174 174 </pre><p> 175 <a class="indexterm" name="id32 3697"></a>176 <a class="indexterm" name="id32 3703"></a>175 <a class="indexterm" name="id322197"></a> 176 <a class="indexterm" name="id322203"></a> 177 177 This indicates that Samba is able to respond on the loopback interface to 178 178 a NULL connection. The <em class="parameter"><code>-U%</code></em> means send an empty … … 189 189 <em class="parameter"><code>guest account</code></em> for all connections. 190 190 </p></li><li class="step" title="Step 3"><p> 191 <a class="indexterm" name="id32 3748"></a>192 <a class="indexterm" name="id32 3754"></a>191 <a class="indexterm" name="id322248"></a> 192 <a class="indexterm" name="id322254"></a> 193 193 From the Windows 9x/Me client, launch Windows Explorer: 194 194 <span class="guiicon">[Desktop: right-click] Network Neighborhood</span>+<span class="guimenu">Explore</span> → <span class="guimenuitem">[Left Panel] [+] Entire Network</span> → <span class="guimenuitem">[Left Panel] [+] Server</span> → <span class="guimenuitem">[Left Panel] [+] Plans</span>. In the right panel you should see the files and directories 195 195 (folders) that are in the <span class="guiicon">Plans</span> share. 196 </p></li></ol></div></div></div><div class="sect2" title="Charity Administration Office"><div class="titlepage"><div><div><h3 class="title"><a name="id32 3803"></a>Charity Administration Office</h3></div></div></div><p>196 </p></li></ol></div></div></div><div class="sect2" title="Charity Administration Office"><div class="titlepage"><div><div><h3 class="title"><a name="id322302"></a>Charity Administration Office</h3></div></div></div><p> 197 197 The fictitious charity organization is called <span class="emphasis"><em>Abmas Vision NL</em></span>. This office 198 198 has five networked computers. Staff are all volunteers, staff changes are frequent. … … 217 217 file share. 218 218 </p><p> 219 <a class="indexterm" name="id32 3847"></a>220 <a class="indexterm" name="id32 3854"></a>219 <a class="indexterm" name="id322347"></a> 220 <a class="indexterm" name="id322353"></a> 221 221 Printer handling in Samba results in a significant level of confusion. Samba presents to the 222 222 MS Windows client only a print queue. The Samba <code class="literal">smbd</code> process passes a … … 232 232 used on this network. 233 233 </p><p> 234 <a class="indexterm" name="id32 3879"></a>234 <a class="indexterm" name="id322379"></a> 235 235 The central server was donated by a local computer store. It is a dual processor Pentium-III 236 236 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a … … 243 243 to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and 244 244 have upgraded Samba to version 3.0.20. 245 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id32 3894"></a>Dissection and Discussion</h4></div></div></div><p>246 <a class="indexterm" name="id32 3902"></a>247 <a class="indexterm" name="id32 3908"></a>248 <a class="indexterm" name="id32 3914"></a>249 <a class="indexterm" name="id32 3920"></a>245 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id322394"></a>Dissection and Discussion</h4></div></div></div><p> 246 <a class="indexterm" name="id322401"></a> 247 <a class="indexterm" name="id322407"></a> 248 <a class="indexterm" name="id322414"></a> 249 <a class="indexterm" name="id322420"></a> 250 250 This installation demands simplicity. Frequent turnover of volunteer staff indicates that 251 251 a network environment that requires users to logon might be problematic. It is suggested that the … … 259 259 an inadvertent ACL from overriding actual file permissions. 260 260 </p><p> 261 <a class="indexterm" name="id32 3953"></a>262 <a class="indexterm" name="id32 3959"></a>263 <a class="indexterm" name="id32 3965"></a>261 <a class="indexterm" name="id322452"></a> 262 <a class="indexterm" name="id322458"></a> 263 <a class="indexterm" name="id322465"></a> 264 264 This organization is a prime candidate for Share Mode security. The <em class="parameter"><code>force user</code></em> 265 265 allows all files to be owned by the same user and group. In addition, it would not hurt to … … 268 268 For further information regarding the significance of the SUID/SGID settings, see <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#ch12-SUIDSGID" title="Effect of Setting File and Directory SUID/SGID Permissions Explained">“Effect of Setting File and Directory SUID/SGID Permissions Explained”</a>. 269 269 </p><p> 270 <a class="indexterm" name="id32 3994"></a>271 <a class="indexterm" name="id32 4000"></a>272 <a class="indexterm" name="id32 4009"></a>273 <a class="indexterm" name="id32 4015"></a>270 <a class="indexterm" name="id322494"></a> 271 <a class="indexterm" name="id322500"></a> 272 <a class="indexterm" name="id322508"></a> 273 <a class="indexterm" name="id322515"></a> 274 274 All client workstations print to a print queue on the server. This ensures that print jobs 275 275 continue to print in the event that a user shuts down the workstation immediately after … … 278 278 that CUPS has become the leading UNIX printing technology. 279 279 </p><p> 280 <a class="indexterm" name="id32 4028"></a>280 <a class="indexterm" name="id322528"></a> 281 281 The print queues are set up as <code class="constant">Raw</code> devices, which means that CUPS will 282 282 not do intelligent print processing, and vendor-supplied drivers must be installed locally on the … … 298 298 really is just a print queue. The name of the print queue is representative of 299 299 the device to which the print spooler delivers print jobs. 300 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id32 4064"></a>Implementation</h4></div></div></div><p>300 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id322563"></a>Implementation</h4></div></div></div><p> 301 301 It is assumed that the server is fully installed and ready for configuration of 302 302 Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded. … … 304 304 255.255.255.0. The hostname of the server used is <code class="constant">server</code>. 305 305 The office network is built as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 1.3. Samba Server Configuration"><a name="id32 4118"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>307 <a class="indexterm" name="id32 4129"></a>306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 1.3. Samba Server Configuration"><a name="id322618"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 307 <a class="indexterm" name="id322628"></a> 308 308 Create a group account for office file storage: 309 309 </p><pre class="screen"> … … 311 311 </pre><p> 312 312 </p></li><li class="step" title="Step 2"><p> 313 <a class="indexterm" name="id32 4152"></a>314 <a class="indexterm" name="id32 4158"></a>313 <a class="indexterm" name="id322651"></a> 314 <a class="indexterm" name="id322658"></a> 315 315 Create a user account for office file storage: 316 316 </p><pre class="screen"> … … 329 329 The resulting drive has a capacity of approximately 500GB of usable space. 330 330 </p></li><li class="step" title="Step 4"><p> 331 <a class="indexterm" name="id32 4197"></a>331 <a class="indexterm" name="id322696"></a> 332 332 Create a mount point for the file system that can be used to store all data files. 333 333 Create a directory called <code class="filename">/data</code>: … … 361 361 /data/officefiles/misc 362 362 </pre><p> 363 <a class="indexterm" name="id32 4296"></a>363 <a class="indexterm" name="id322795"></a> 364 364 The <code class="literal">chown</code> operation sets the owner to the user <code class="constant">abmas</code> 365 365 and the group to <code class="constant">office</code> on all directories just created. It recursively … … 369 369 created. Any new directories created still have the same owner, group, and permissions as the 370 370 directory they are in. This should eliminate all permissions-based file access problems. For 371 more information on this subject, refer to TOSHARG2<sup>[<a name="id32 4318" href="#ftn.id324318" class="footnote">3</a>]</sup> or refer371 more information on this subject, refer to TOSHARG2<sup>[<a name="id322818" href="#ftn.id322818" class="footnote">3</a>]</sup> or refer 372 372 to the UNIX man page for the <code class="literal">chmod</code> and the <code class="literal">chown</code> commands. 373 373 </p></li><li class="step" title="Step 7"><p> … … 381 381 <code class="filename">/etc/samba</code> directory. 382 382 </p></li><li class="step" title="Step 8"><p> 383 <a class="indexterm" name="id32 4382"></a>383 <a class="indexterm" name="id322881"></a> 384 384 We must ensure that the <code class="literal">smbd</code> can resolve the name of the Samba 385 385 server to its IP address. Verify that the <code class="filename">/etc/hosts</code> file … … 393 393 so that the CUPS spooler can print using raw mode protocols. 394 394 </p></li><li class="step" title="Step 10"><p> 395 <a class="indexterm" name="id32 4423"></a>395 <a class="indexterm" name="id322923"></a> 396 396 Configure the CUPS Print Queues: 397 397 </p><pre class="screen"> … … 401 401 This creates the necessary print queues with no assigned print filter. 402 402 </p></li><li class="step" title="Step 11"><p> 403 <a class="indexterm" name="id32 4452"></a>404 <a class="indexterm" name="id32 4459"></a>405 <a class="indexterm" name="id32 4465"></a>403 <a class="indexterm" name="id322952"></a> 404 <a class="indexterm" name="id322958"></a> 405 <a class="indexterm" name="id322964"></a> 406 406 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 407 407 </p><pre class="screen"> … … 409 409 </pre><p> 410 410 </p></li><li class="step" title="Step 12"><p> 411 <a class="indexterm" name="id32 4488"></a>411 <a class="indexterm" name="id322988"></a> 412 412 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 413 413 </p><pre class="screen"> … … 415 415 </pre><p> 416 416 </p></li><li class="step" title="Step 13"><p> 417 <a class="indexterm" name="id32 4511"></a>417 <a class="indexterm" name="id323011"></a> 418 418 Use the standard system tool to start Samba and CUPS to configure them to restart 419 419 automatically at every system reboot. For example, 420 420 </p><p> 421 <a class="indexterm" name="id32 4522"></a>422 <a class="indexterm" name="id32 4528"></a>423 <a class="indexterm" name="id32 4535"></a>421 <a class="indexterm" name="id323022"></a> 422 <a class="indexterm" name="id323028"></a> 423 <a class="indexterm" name="id323034"></a> 424 424 </p><pre class="screen"> 425 425 <code class="prompt">root# </code> chkconfig smb on … … 428 428 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 429 429 </pre><p> 430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id32 4598"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324609"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324619"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324630"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id324640"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id324650"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id324669"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id324680"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id324690"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id324700"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id324711"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id324721"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324732"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id324750"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id324761"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id324771"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id324782"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id324792"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id324802"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324813"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id324832"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id324842"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id324852"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324863"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324873"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324884"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id324924"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324935"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id324945"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324956"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324966"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324976"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id324987"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id325006"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id325016"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id325026"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id325037"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id325047"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id325058"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325068"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id325087"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id325097"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id325108"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id325118"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id325128"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id325139"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325149"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id325168"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id325178"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id325189"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325199"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325210"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325220"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure" title="Procedure 1.4. Windows Client Configuration"><a name="id325232"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id323098"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id323108"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id323119"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id323129"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id323140"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id323150"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id323169"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id323179"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id323190"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323200"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id323210"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id323221"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323231"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id323250"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id323260"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id323271"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323281"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id323292"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id323302"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323312"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id323331"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id323342"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id323352"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323362"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323373"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323383"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id323424"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id323434"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id323445"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id323455"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id323466"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323476"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id323486"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id323505"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id323516"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id323526"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323536"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id323547"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id323557"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323568"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id323586"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id323597"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id323607"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323618"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id323628"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id323638"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323649"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id323668"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id323678"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id323688"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323699"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323709"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323720"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure" title="Procedure 1.4. Windows Client Configuration"><a name="id323731"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 431 431 Configure clients to the network settings shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 432 432 </p></li><li class="step" title="Step 2"><p> … … 435 435 <code class="constant">255.255.255.0</code>. 436 436 </p></li><li class="step" title="Step 3"><p> 437 <a class="indexterm" name="id32 5264"></a>437 <a class="indexterm" name="id323764"></a> 438 438 On all Windows clients, set the WINS Server address to <code class="constant">192.168.1.1</code>, 439 439 the IP address of the server. … … 441 441 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 442 442 </p></li><li class="step" title="Step 5"><p> 443 <a class="indexterm" name="id32 5290"></a>443 <a class="indexterm" name="id323789"></a> 444 444 Install the <span class="quote">“<span class="quote">Client for Microsoft Networks.</span>”</span> Ensure that the only option 445 445 enabled in its properties is the option <span class="quote">“<span class="quote">Logon and restore network connections.</span>”</span> … … 448 448 system, then log on using any username and password you choose. 449 449 </p></li><li class="step" title="Step 7"><p> 450 <a class="indexterm" name="id32 5322"></a>450 <a class="indexterm" name="id323822"></a> 451 451 Verify on each client that the machine called <code class="constant">SERVER</code> 452 452 is visible in <span class="guimenu">My Network Places</span>, that it is … … 454 454 and that it is possible to open that share to reveal its contents. 455 455 </p></li><li class="step" title="Step 8"><p> 456 <a class="indexterm" name="id32 5350"></a>457 <a class="indexterm" name="id32 5356"></a>456 <a class="indexterm" name="id323849"></a> 457 <a class="indexterm" name="id323856"></a> 458 458 Disable password caching on all Windows 9x/Me machines using the registry change file 459 459 shown in <a class="link" href="simple.html#MEreg" title="Example 1.4. Windows Me Registry Edit File: Disable Password Caching">“Windows Me Registry Edit File: Disable Password Caching”</a>. Be sure to remove all files that have the … … 533 533 handing the newly configured network over to the Charity Administration Office 534 534 for production use. 535 </p></li></ol></div></li></ol></div></div><div class="sect3" title="Validation"><div class="titlepage"><div><div><h4 class="title"><a name="id32 5734"></a>Validation</h4></div></div></div><p>535 </p></li></ol></div></li></ol></div></div><div class="sect3" title="Validation"><div class="titlepage"><div><div><h4 class="title"><a name="id324234"></a>Validation</h4></div></div></div><p> 536 536 Use the same validation process as was followed in <a class="link" href="simple.html#validate1" title="Validation">“Validation”</a>. 537 537 </p></div></div><div class="sect2" title="Accounting Office"><div class="titlepage"><div><div><h3 class="title"><a name="AccountingOffice"></a>Accounting Office</h3></div></div></div><p> … … 552 552 on the server. 553 553 </p><p> 554 <a class="indexterm" name="id32 5783"></a>554 <a class="indexterm" name="id324282"></a> 555 555 The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and 556 556 copy all files from the old system to the new one. The existing Windows NT4 server has a parallel … … 562 562 He believes that Windows for Workgroups 3.11 was <span class="quote">“<span class="quote">the best server Microsoft ever sold 563 563 </span>”</span> and that Windows NT and 2000 are <span class="quote">“<span class="quote">too fang-dangled complex!</span>”</span> 564 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id32 5807"></a>Dissection and Discussion</h4></div></div></div><p>565 <a class="indexterm" name="id32 5814"></a>564 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id324306"></a>Dissection and Discussion</h4></div></div></div><p> 565 <a class="indexterm" name="id324314"></a> 566 566 The requirements of this network installation are not unusual. The staff are not interested in the 567 567 details of networking. Passwords are never changed. In this example solution, we demonstrate the use … … 583 583 <a class="link" href="simple.html#acctingnet2" title="Figure 1.2. Accounting Office Network Topology">“Accounting Office Network Topology”</a>. All machines have been configured as indicated prior to the 584 584 start of Samba configuration. The following prescriptive steps may now commence. 585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" title="Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3"><a name="id32 6171"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id326181"></a>585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" title="Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3"><a name="id324671"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id324681"></a> 586 586 Rename the old server from <code class="constant">CASHPOOL</code> to <code class="constant">STABLE</code> 587 587 by logging onto the console as the <code class="constant">Administrator</code>. Restart the machine … … 594 594 Samba FTP site. 595 595 </p></li><li class="step" title="Step 4"><p> 596 <a class="indexterm" name="id32 6223"></a>597 <a class="indexterm" name="id32 6230"></a>596 <a class="indexterm" name="id324723"></a> 597 <a class="indexterm" name="id324729"></a> 598 598 Add a group account for the office to use. Execute the following: 599 599 </p><pre class="screen"> … … 601 601 </pre><p> 602 602 </p></li><li class="step" title="Step 5"><p> 603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id32 6258" href="#ftn.id326258" class="footnote">4</a>]</sup>603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id324758" href="#ftn.id324758" class="footnote">4</a>]</sup> 604 604 in <a class="link" href="simple.html#acctconf" title="Example 1.5. Accounting Office Network smb.conf Old Style Configuration File">“Accounting Office Network smb.conf Old Style Configuration File”</a>. 605 605 </p></li><li class="step" title="Step 6"><p> 606 <a class="indexterm" name="id32 6289"></a>607 <a class="indexterm" name="id32 6296"></a>608 <a class="indexterm" name="id32 6302"></a>606 <a class="indexterm" name="id324789"></a> 607 <a class="indexterm" name="id324795"></a> 608 <a class="indexterm" name="id324801"></a> 609 609 For each user who uses this system (see <a class="link" href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">“Accounting Office Network Information”</a>), 610 610 execute the following: … … 621 621 </pre><p> 622 622 </p></li><li class="step" title="Step 7"><p> 623 <a class="indexterm" name="id32 6344"></a>623 <a class="indexterm" name="id324844"></a> 624 624 Create the directory structure for the file shares by executing the following: 625 625 </p><pre class="screen"> … … 636 636 The data storage structure is now prepared for use. 637 637 </p></li><li class="step" title="Step 8"><p> 638 <a class="indexterm" name="id32 6390"></a>638 <a class="indexterm" name="id324890"></a> 639 639 Configure the CUPS Print Queues: 640 640 </p><pre class="screen"> … … 643 643 This creates the necessary print queues with no assigned print filter. 644 644 </p></li><li class="step" title="Step 9"><p> 645 <a class="indexterm" name="id32 6414"></a>646 <a class="indexterm" name="id32 6420"></a>645 <a class="indexterm" name="id324914"></a> 646 <a class="indexterm" name="id324920"></a> 647 647 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 648 648 </p><pre class="screen"> … … 650 650 </pre><p> 651 651 </p></li><li class="step" title="Step 10"><p> 652 <a class="indexterm" name="id32 6444"></a>653 <a class="indexterm" name="id32 6450"></a>652 <a class="indexterm" name="id324944"></a> 653 <a class="indexterm" name="id324950"></a> 654 654 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 655 655 </p><pre class="screen"> … … 657 657 </pre><p> 658 658 </p></li><li class="step" title="Step 11"><p> 659 <a class="indexterm" name="id32 6473"></a>659 <a class="indexterm" name="id324973"></a> 660 660 Use the standard system tool to start Samba and CUPS to configure them to restart 661 661 automatically at every system reboot. For example, 662 662 </p><p> 663 <a class="indexterm" name="id32 6484"></a>664 <a class="indexterm" name="id32 6490"></a>665 <a class="indexterm" name="id32 6497"></a>663 <a class="indexterm" name="id324984"></a> 664 <a class="indexterm" name="id324990"></a> 665 <a class="indexterm" name="id324996"></a> 666 666 </p><pre class="screen"> 667 667 <code class="prompt">root# </code> chkconfig smb on … … 708 708 For this, you should make sure all applications, including printing, work before asking the 709 709 customer to test drive the new network. 710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id32 6708"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id326718"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id326729"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326739"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id326750"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id326768"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id326779"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id326789"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id326808"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id326818"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id326829"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id326839"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id326858"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id326868"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id326879"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326889"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326900"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326910"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id326925"></a>Questions and Answers</h2></div></div></div><p>710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id325207"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id325218"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id325228"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325239"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id325249"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id325268"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id325278"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id325289"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id325307"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id325318"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id325328"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id325339"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id325357"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id325368"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id325378"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325389"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325399"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325409"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id325424"></a>Questions and Answers</h2></div></div></div><p> 711 711 The following questions and answers draw from the examples in this chapter. 712 712 Many design decisions are impacted by the configurations chosen. The intent 713 713 is to expose some of the hidden implications. 714 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id32 6935"></a><dl><dt> <a href="simple.html#id326941">714 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id325434"></a><dl><dt> <a href="simple.html#id325441"> 715 715 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 716 </a></dt><dt> <a href="simple.html#id32 6964">716 </a></dt><dt> <a href="simple.html#id325463"> 717 717 How is the operation of the parameter force user different from 718 718 setting the root directory of the share SUID? 719 </a></dt><dt> <a href="simple.html#id32 7008">719 </a></dt><dt> <a href="simple.html#id325508"> 720 720 When would you both use the per share parameter force user and set 721 721 the share root directory SUID? 722 </a></dt><dt> <a href="simple.html#id32 7031">722 </a></dt><dt> <a href="simple.html#id325531"> 723 723 What is better about CUPS printing than LPRng printing? 724 </a></dt><dt> <a href="simple.html#id32 7065">724 </a></dt><dt> <a href="simple.html#id325565"> 725 725 When should Windows client IP addresses be hard-coded? 726 </a></dt><dt> <a href="simple.html#id32 7086">726 </a></dt><dt> <a href="simple.html#id325586"> 727 727 Under what circumstances is it best to use a DHCP server? 728 </a></dt><dt> <a href="simple.html#id32 7117">728 </a></dt><dt> <a href="simple.html#id325617"> 729 729 What is the purpose of setting the parameter guest ok on a share? 730 </a></dt><dt> <a href="simple.html#id32 7140">730 </a></dt><dt> <a href="simple.html#id325639"> 731 731 When would you set the global parameter disable spoolss? 732 </a></dt><dt> <a href="simple.html#id32 7209">732 </a></dt><dt> <a href="simple.html#id325709"> 733 733 Why would you disable password caching on Windows 9x/Me clients? 734 </a></dt><dt> <a href="simple.html#id32 7230">734 </a></dt><dt> <a href="simple.html#id325729"> 735 735 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 736 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id32 6941"></a><a name="id326943"></a></td><td align="left" valign="top"><p>736 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id325441"></a><a name="id325443"></a></td><td align="left" valign="top"><p> 737 737 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 738 738 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 741 741 UNIX system and to the Samba configuration. Non-anonymous servers require additional 742 742 administration. 743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 6964"></a><a name="id326966"></a></td><td align="left" valign="top"><p>743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325463"></a><a name="id325465"></a></td><td align="left" valign="top"><p> 744 744 How is the operation of the parameter <em class="parameter"><code>force user</code></em> different from 745 745 setting the root directory of the share SUID? … … 755 755 The parameter <em class="parameter"><code>force user</code></em> has potential security implications that go 756 756 beyond the actual share root directory. Be careful and wary of using this parameter. 757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7008"></a><a name="id327010"></a></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325508"></a><a name="id325510"></a></td><td align="left" valign="top"><p> 758 758 When would you both use the per share parameter <em class="parameter"><code>force user</code></em> and set 759 759 the share root directory SUID? … … 762 762 are conducted as the forced user, while all file and directory creation are done as the SUID 763 763 directory owner. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7031"></a><a name="id327034"></a></td><td align="left" valign="top"><p>764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325531"></a><a name="id325533"></a></td><td align="left" valign="top"><p> 765 765 What is better about CUPS printing than LPRng printing? 766 766 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to 781 781 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7065"></a><a name="id327067"></a></td><td align="left" valign="top"><p>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325565"></a><a name="id325567"></a></td><td align="left" valign="top"><p> 783 783 When should Windows client IP addresses be hard-coded? 784 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 789 789 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network 790 790 failure. 791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7086"></a><a name="id327088"></a></td><td align="left" valign="top"><p>791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325586"></a><a name="id325588"></a></td><td align="left" valign="top"><p> 792 792 Under what circumstances is it best to use a DHCP server? 793 793 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 805 805 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in 806 806 a large Windows network environment. 807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7117"></a><a name="id327119"></a></td><td align="left" valign="top"><p>807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325617"></a><a name="id325619"></a></td><td align="left" valign="top"><p> 808 808 What is the purpose of setting the parameter <em class="parameter"><code>guest ok</code></em> on a share? 809 809 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 810 810 If this parameter is set to yes for a service, then no password is required to connect to the service. 811 811 Privileges are those of the guest account. 812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7140"></a><a name="id327142"></a></td><td align="left" valign="top"><p>812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325639"></a><a name="id325641"></a></td><td align="left" valign="top"><p> 813 813 When would you set the global parameter <em class="parameter"><code>disable spoolss</code></em>? 814 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 834 834 (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid 835 835 print driver installed on the Samba server. 836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7209"></a><a name="id327211"></a></td><td align="left" valign="top"><p>836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325709"></a><a name="id325711"></a></td><td align="left" valign="top"><p> 837 837 Why would you disable password caching on Windows 9x/Me clients? 838 838 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 841 841 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed. 842 842 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled. 843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id32 7230"></a><a name="id327232"></a></td><td align="left" valign="top"><p>843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id325729"></a><a name="id325731"></a></td><td align="left" valign="top"><p> 844 844 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 845 845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 849 849 password are the same as those set on the Samba server, access is transparent and does not require 850 850 separate user authentication. 851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id32 3099" href="#id323099" class="para">1</a>] </sup>The examples given mirror those documented851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id321598" href="#id321598" class="para">1</a>] </sup>The examples given mirror those documented 852 852 in The Official Samba-3 HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional 853 853 insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4. 854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id32 3243" href="#id323243" class="para">2</a>] </sup>854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id321742" href="#id321742" class="para">2</a>] </sup> 855 855 This information is given purely as an example of how data may be stored in such a way that it 856 856 will be easy to locate records at a later date. The example is not meant to imply any instructions 857 857 that may be construed as essential to the design of the solution; this is something you will almost 858 certainly want to determine for yourself.</p></div><div class="footnote"><p><sup>[<a name="ftn.id32 4318" href="#id324318" class="para">3</a>] </sup>The Official Samba-3 HOWTO and859 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</p></div><div class="footnote"><p><sup>[<a name="ftn.id32 6258" href="#id326258" class="para">4</a>] </sup>This example uses the858 certainly want to determine for yourself.</p></div><div class="footnote"><p><sup>[<a name="ftn.id322818" href="#id322818" class="para">3</a>] </sup>The Official Samba-3 HOWTO and 859 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</p></div><div class="footnote"><p><sup>[<a name="ftn.id324758" href="#id324758" class="para">4</a>] </sup>This example uses the 860 860 <em class="parameter"><code>smbpasswd</code></em> file in an obtuse way, since the use of 861 861 the <em class="parameter"><code>passdb backend</code></em> has not been specified in the <code class="filename">smb.conf</code> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/small.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Small Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id32 7308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Small Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id325808">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325825">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id325871">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id325916">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id326088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id326106">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327557">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id328132">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id328152">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id328216">Questions and Answers</a></span></dt></dl></div><p> 2 2 <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective 3 3 network solutions. Network administrators who take pride in their work … … 9 9 good advice that the following two scenarios illustrate. 10 10 </p><p> 11 <a class="indexterm" name="id32 7280"></a>11 <a class="indexterm" name="id325780"></a> 12 12 In one case the network administrator of a mid-sized company spent three 13 13 months building a new network to replace an old Netware server. What he … … 37 37 sleeves for when you need them.</span>”</span> Was he smart? You decide. Let's 38 38 get on with our next exercise. 39 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 7308"></a>Introduction</h2></div></div></div><p>39 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id325808"></a>Introduction</h2></div></div></div><p> 40 40 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 41 41 were the right person for the job. That's why he asked you to install the … … 48 48 some of the workstations that came with the acquired business and found some machines in need of both 49 49 hardware and software maintenance. 50 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id32 7326"></a>Assignment Tasks</h3></div></div></div><p>51 <a class="indexterm" name="id32 7333"></a>50 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id325825"></a>Assignment Tasks</h3></div></div></div><p> 51 <a class="indexterm" name="id325833"></a> 52 52 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 53 53 that the business is running efficiently. Many of the new staff want notebook … … 81 81 user accounts from the Windows desktop. That person will be responsible for 82 82 basic operations. 83 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 7371"></a>Dissection and Discussion</h2></div></div></div><p>83 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id325871"></a>Dissection and Discussion</h2></div></div></div><p> 84 84 What are the key requirements in this business example? A quick review indicates 85 85 a need for … … 88 88 </p></li><li class="listitem"><p> 89 89 Mobile computing capability 90 <a class="indexterm" name="id32 7391"></a>90 <a class="indexterm" name="id325890"></a> 91 91 </p></li><li class="listitem"><p> 92 92 Improved reliability and usability … … 97 97 (as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>). 98 98 99 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id32 7416"></a>Technical Issues</h3></div></div></div><p>100 <a class="indexterm" name="id32 7424"></a>101 <a class="indexterm" name="id32 7430"></a>102 <a class="indexterm" name="id32 7436"></a>103 <a class="indexterm" name="id32 7443"></a>104 <a class="indexterm" name="id32 7449"></a>99 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id325916"></a>Technical Issues</h3></div></div></div><p> 100 <a class="indexterm" name="id325923"></a> 101 <a class="indexterm" name="id325930"></a> 102 <a class="indexterm" name="id325936"></a> 103 <a class="indexterm" name="id325942"></a> 104 <a class="indexterm" name="id325948"></a> 105 105 It is time to implement a domain security environment. You will use the <code class="constant"> 106 106 smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to … … 123 123 other enhancements. It is important that you plan accordingly. 124 124 </p><p> 125 <a class="indexterm" name="id32 7498"></a>125 <a class="indexterm" name="id325997"></a> 126 126 You have split the network into two separate areas. Each has its own Ethernet switch. 127 127 There are 20 users on the accounting network and 32 users on the financial services … … 138 138 hostname name resolution. 139 139 </p><p> 140 <a class="indexterm" name="id32 7521"></a>141 <a class="indexterm" name="id32 7530"></a>140 <a class="indexterm" name="id326021"></a> 141 <a class="indexterm" name="id326029"></a> 142 142 It is necessary to map Windows Domain Groups to UNIX groups. It is 143 143 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two … … 156 156 more information. 157 157 </p><p> 158 <a class="indexterm" name="id32 7576"></a>158 <a class="indexterm" name="id326075"></a> 159 159 Vendor-supplied printer drivers will be installed on each client. The CUPS print 160 160 spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. 161 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id32 7588"></a>Political Issues</h3></div></div></div><p>161 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id326088"></a>Political Issues</h3></div></div></div><p> 162 162 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 163 163 He is willing to spend money on things he believes are of value. You need more … … 167 167 supplied with antivirus software? Above all, demonstrate good purchase value and remember 168 168 to make your users happy. 169 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 7606"></a>Implementation</h2></div></div></div><p>170 <a class="indexterm" name="id32 7614"></a>169 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id326106"></a>Implementation</h2></div></div></div><p> 170 <a class="indexterm" name="id326113"></a> 171 171 In this example, the assumption is made that this server is being configured from a clean start. 172 172 The alternate approach could be to demonstrate the migration of the system that is documented … … 176 176 Additionally, a fresh installation makes the example easier to follow. 177 177 </p><p> 178 <a class="indexterm" name="id32 7636"></a>178 <a class="indexterm" name="id326135"></a> 179 179 Each user will be given a home directory on the UNIX system, which will be available as a private 180 180 share. Two additional shares will be created, one for the accounting department and the other for … … 182 182 of group membership. 183 183 </p><p> 184 <a class="indexterm" name="id32 7648"></a>184 <a class="indexterm" name="id326147"></a> 185 185 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 186 186 rights and privileges within the Windows environment. 187 187 </p><p> 188 <a class="indexterm" name="id32 7661"></a>188 <a class="indexterm" name="id326160"></a> 189 189 The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved 190 190 by setting the sticky bit (set UID/GID) on the top-level directories. 191 191 </p><p> 192 192 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><p><br class="figure-break"> 193 </p><div class="procedure" title="Procedure 2.1. Server Installation Steps"><a name="id32 7717"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>193 </p><div class="procedure" title="Procedure 2.1. Server Installation Steps"><a name="id326216"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 194 194 Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. 195 195 </p></li><li class="step" title="Step 2"><p> 196 <a class="indexterm" name="id32 7737"></a>196 <a class="indexterm" name="id326236"></a> 197 197 Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. 198 198 The printers are network attached, so there should be entries for the … … 210 210 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 211 211 </p></li><li class="step" title="Step 5"><p> 212 <a class="indexterm" name="id32 7784"></a>213 <a class="indexterm" name="id32 7791"></a>214 <a class="indexterm" name="id32 7797"></a>215 <a class="indexterm" name="id32 7803"></a>212 <a class="indexterm" name="id326284"></a> 213 <a class="indexterm" name="id326290"></a> 214 <a class="indexterm" name="id326296"></a> 215 <a class="indexterm" name="id326303"></a> 216 216 Because Samba will be operating over two network interfaces and clients on each side 217 217 may want to be able to reach clients on the other side, it is imperative that IP forwarding … … 228 228 <code class="filename">/etc/samba/smb.conf</code> file. 229 229 </p></li><li class="step" title="Step 7"><p> 230 <a class="indexterm" name="id32 7856"></a>230 <a class="indexterm" name="id326355"></a> 231 231 Add the user <code class="literal">root</code> to the Samba password backend: 232 232 </p><pre class="screen"> … … 236 236 <code class="prompt">root# </code> 237 237 </pre><p> 238 <a class="indexterm" name="id32 7884"></a>238 <a class="indexterm" name="id326383"></a> 239 239 This is the Windows Domain Administrator password. Never delete this account from 240 240 the password backend after Windows Domain Groups have been initialized. If you delete … … 242 242 and your Samba server can no longer be administered. 243 243 </p></li><li class="step" title="Step 8"><p> 244 <a class="indexterm" name="id32 7899"></a>244 <a class="indexterm" name="id326398"></a> 245 245 Create the username map file to permit the <code class="constant">root</code> account to be called 246 246 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 269 269 </pre><p> 270 270 </p></li><li class="step" title="Step 9"><p> 271 <a class="indexterm" name="id32 7933"></a>271 <a class="indexterm" name="id326432"></a> 272 272 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 273 273 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 275 275 and then execute the script. Sample output should be as follows: 276 276 277 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id32 7958"></a><pre class="screen">277 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id326458"></a><pre class="screen"> 278 278 #!/bin/bash 279 279 # … … 325 325 </pre><p> 326 326 </p></li><li class="step" title="Step 10"><p> 327 <a class="indexterm" name="id32 8022"></a>328 <a class="indexterm" name="id32 8029"></a>329 <a class="indexterm" name="id32 8037"></a>327 <a class="indexterm" name="id326522"></a> 328 <a class="indexterm" name="id326528"></a> 329 <a class="indexterm" name="id326537"></a> 330 330 For each user who needs to be given a Windows Domain account, make an entry in the 331 331 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 333 333 <code class="literal">smbpasswd</code> program to create the Domain user accounts. 334 334 </p><p> 335 <a class="indexterm" name="id32 8059"></a>336 <a class="indexterm" name="id32 8066"></a>337 <a class="indexterm" name="id32 8072"></a>335 <a class="indexterm" name="id326559"></a> 336 <a class="indexterm" name="id326565"></a> 337 <a class="indexterm" name="id326571"></a> 338 338 There are a number of tools for user management under UNIX, such as 339 339 <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom … … 364 364 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 365 365 This allows the CUPS spooler to print using raw mode protocols. 366 <a class="indexterm" name="id32 8203"></a>367 <a class="indexterm" name="id32 8209"></a>366 <a class="indexterm" name="id326702"></a> 367 <a class="indexterm" name="id326708"></a> 368 368 </p></li><li class="step" title="Step 15"><p> 369 <a class="indexterm" name="id32 8222"></a>370 <a class="indexterm" name="id32 8230"></a>369 <a class="indexterm" name="id326721"></a> 370 <a class="indexterm" name="id326729"></a> 371 371 Configure the CUPS Print Queues as follows: 372 372 </p><pre class="screen"> … … 375 375 <code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E 376 376 </pre><p> 377 <a class="indexterm" name="id32 8257"></a>377 <a class="indexterm" name="id326756"></a> 378 378 This creates the necessary print queues with no assigned print filter. 379 379 </p></li><li class="step" title="Step 16"><p> 380 <a class="indexterm" name="id32 8270"></a>381 <a class="indexterm" name="id32 8277"></a>382 <a class="indexterm" name="id32 8283"></a>380 <a class="indexterm" name="id326770"></a> 381 <a class="indexterm" name="id326776"></a> 382 <a class="indexterm" name="id326782"></a> 383 383 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 384 384 </p><pre class="screen"> … … 386 386 </pre><p> 387 387 </p></li><li class="step" title="Step 17"><p> 388 <a class="indexterm" name="id32 8306"></a>388 <a class="indexterm" name="id326806"></a> 389 389 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 390 390 </p><pre class="screen"> … … 392 392 </pre><p> 393 393 </p></li><li class="step" title="Step 18"><p> 394 <a class="indexterm" name="id32 8329"></a>394 <a class="indexterm" name="id326829"></a> 395 395 Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the 396 396 contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 397 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id32 8359"></a><pre class="screen">397 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id326858"></a><pre class="screen"> 398 398 default-lease-time 86400; 399 399 max-lease-time 172800; … … 443 443 automatically at every system reboot. For example, 444 444 </p><p> 445 <a class="indexterm" name="id32 8392"></a>446 <a class="indexterm" name="id32 8398"></a>447 <a class="indexterm" name="id32 8404"></a>448 <a class="indexterm" name="id32 8411"></a>449 <a class="indexterm" name="id32 8417"></a>445 <a class="indexterm" name="id326891"></a> 446 <a class="indexterm" name="id326898"></a> 447 <a class="indexterm" name="id326904"></a> 448 <a class="indexterm" name="id326910"></a> 449 <a class="indexterm" name="id326916"></a> 450 450 </p><pre class="screen"> 451 451 <code class="prompt">root# </code> chkconfig dhcp on … … 457 457 </pre><p> 458 458 </p></li><li class="step" title="Step 20"><p> 459 <a class="indexterm" name="id32 8466"></a>460 <a class="indexterm" name="id32 8472"></a>461 <a class="indexterm" name="id32 8480"></a>462 <a class="indexterm" name="id32 8487"></a>463 <a class="indexterm" name="id32 8493"></a>464 <a class="indexterm" name="id32 8499"></a>459 <a class="indexterm" name="id326965"></a> 460 <a class="indexterm" name="id326972"></a> 461 <a class="indexterm" name="id326980"></a> 462 <a class="indexterm" name="id326986"></a> 463 <a class="indexterm" name="id326992"></a> 464 <a class="indexterm" name="id326999"></a> 465 465 Configure the name service switch (NSS) to handle WINS-based name resolution. 466 466 Since this system does not use a DNS server, it is safe to remove this option from … … 470 470 hosts: files wins 471 471 </pre><p> 472 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id32 8555"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id328565"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id328576"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id328587"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id328597"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id328607"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id328618"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id328628"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328639"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328649"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328659"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328670"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328681"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328692"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id328702"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id328713"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id328723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328744"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328754"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id328794"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id328805"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328815"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id328825"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id328844"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id328855"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id328865"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328875"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328886"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328896"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id328915"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id328925"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id328936"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id328965"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id328975"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id328986"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id328996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id329015"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id329025"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id329036"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id329046"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id329058"></a>Validation</h3></div></div></div><p>472 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id327054"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id327064"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id327076"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id327086"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id327096"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id327107"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id327117"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id327128"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id327138"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id327148"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id327159"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id327169"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id327180"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id327192"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id327202"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id327212"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id327223"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327233"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327244"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327254"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id327294"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id327304"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id327314"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id327325"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id327344"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id327354"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id327364"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327375"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327385"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327396"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id327414"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id327425"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id327435"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id327446"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id327464"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id327475"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id327485"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id327496"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id327514"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id327525"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id327535"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id327546"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id327557"></a>Validation</h3></div></div></div><p> 473 473 Does everything function as it ought? That is the key question at this point. 474 474 Here are some simple steps to validate your Samba server configuration. 475 </p><div class="procedure" title="Procedure 2.2. Validation Steps"><a name="id32 9068"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>476 <a class="indexterm" name="id32 9078"></a>475 </p><div class="procedure" title="Procedure 2.2. Validation Steps"><a name="id327567"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 476 <a class="indexterm" name="id327578"></a> 477 477 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba 478 478 to refuse to start. The first step should always be to validate the contents … … 521 521 Clear away all errors before proceeding, and start or restart samba as necessary. 522 522 </p></li><li class="step" title="Step 2"><p> 523 <a class="indexterm" name="id32 9135"></a>524 <a class="indexterm" name="id32 9141"></a>525 <a class="indexterm" name="id32 9148"></a>526 <a class="indexterm" name="id32 9154"></a>523 <a class="indexterm" name="id327635"></a> 524 <a class="indexterm" name="id327641"></a> 525 <a class="indexterm" name="id327647"></a> 526 <a class="indexterm" name="id327653"></a> 527 527 Check that the Samba server is running: 528 528 </p><pre class="screen"> … … 541 541 <code class="literal">smbd</code> is normal. 542 542 </p></li><li class="step" title="Step 3"><p> 543 <a class="indexterm" name="id32 9199"></a>543 <a class="indexterm" name="id327699"></a> 544 544 Check that an anonymous connection can be made to the Samba server: 545 545 </p><pre class="screen"> … … 570 570 a <code class="constant">NULL</code> password. 571 571 </p></li><li class="step" title="Step 4"><p> 572 <a class="indexterm" name="id32 9241"></a>573 <a class="indexterm" name="id32 9247"></a>574 <a class="indexterm" name="id32 9254"></a>572 <a class="indexterm" name="id327741"></a> 573 <a class="indexterm" name="id327747"></a> 574 <a class="indexterm" name="id327753"></a> 575 575 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 576 576 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 591 591 <code class="filename">/etc/dhcpd.conf</code> file. 592 592 </p></li><li class="step" title="Step 5"><p> 593 <a class="indexterm" name="id32 9307"></a>593 <a class="indexterm" name="id327807"></a> 594 594 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 595 595 </p><pre class="screen"> … … 608 608 smb: \> q 609 609 </pre><p> 610 </p></li></ol></div></div><div class="procedure" title="Procedure 2.3. Windows XP Professional Client Configuration"><a name="id32 9344"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>610 </p></li></ol></div></div><div class="procedure" title="Procedure 2.3. Windows XP Professional Client Configuration"><a name="id327844"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 611 611 Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 612 612 All clients use DHCP for TCP/IP protocol stack configuration. 613 <a class="indexterm" name="id32 9359"></a>614 <a class="indexterm" name="id32 9366"></a>613 <a class="indexterm" name="id327859"></a> 614 <a class="indexterm" name="id327865"></a> 615 615 DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. 616 616 </p></li><li class="step" title="Step 2"><p> … … 654 654 Repeat the printer installation steps above for the HP LaserJet 6 printer 655 655 as well as for the QMS Magicolor XXXX laser printer. 656 </p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id32 9633"></a>Notebook Computers: A Special Case</h3></div></div></div><p>656 </p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id328132"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 657 657 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 658 658 Professional systems. This is the preferred solution to provide continuity of work for notebook users … … 664 664 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 665 665 configuration somewhat. 666 </p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id32 9652"></a>Key Points Learned</h3></div></div></div><p>666 </p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id328152"></a>Key Points Learned</h3></div></div></div><p> 667 667 In this network design and implementation exercise, you created a Windows NT4-style Domain 668 668 Controller using Samba-3.0.20. Following these guidelines, you experienced … … 670 670 you build on the experience. These are the highlights from this chapter: 671 671 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 672 <a class="indexterm" name="id32 9669"></a>672 <a class="indexterm" name="id328168"></a> 673 673 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 674 674 network configuration settings from this server. 675 675 </p></li><li class="listitem"><p> 676 <a class="indexterm" name="id32 9681"></a>676 <a class="indexterm" name="id328180"></a> 677 677 You created a Windows Domain Controller. You were able to use the network logon service 678 678 and successfully joined Windows 200x/XP Professional clients to the Domain. 679 679 </p></li><li class="listitem"><p> 680 <a class="indexterm" name="id32 9693"></a>680 <a class="indexterm" name="id328193"></a> 681 681 You created raw print queues in the CUPS printing system. You maintained a simple 682 682 printing system so that all users can share centrally managed printers. You installed … … 687 687 You offered Mobile notebook users a solution that allows them to continue to work 688 688 while away from the office and not connected to the corporate network. 689 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id32 9716"></a>Questions and Answers</h2></div></div></div><p>689 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id328216"></a>Questions and Answers</h2></div></div></div><p> 690 690 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 691 691 may help. 692 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id32 9726"></a><dl><dt>1. <a href="small.html#id329728">692 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id328226"></a><dl><dt>1. <a href="small.html#id328228"> 693 693 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 694 </a></dt><dt>2. <a href="small.html#id32 9750">694 </a></dt><dt>2. <a href="small.html#id328249"> 695 695 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 696 696 that should be noted in particular? 697 </a></dt><dt>3. <a href="small.html#id32 9776">697 </a></dt><dt>3. <a href="small.html#id328275"> 698 698 Is it possible to create a Windows Domain account that is specifically called Administrator? 699 </a></dt><dt>4. <a href="small.html#id32 9810">699 </a></dt><dt>4. <a href="small.html#id328309"> 700 700 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 701 </a></dt><dt>5. <a href="small.html#id32 9843">701 </a></dt><dt>5. <a href="small.html#id328342"> 702 702 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 703 703 root access. How can we do this? 704 </a></dt><dt>6. <a href="small.html#id32 9878">704 </a></dt><dt>6. <a href="small.html#id328378"> 705 705 Why must I map Windows Domain Groups to UNIX groups? 706 </a></dt><dt>7. <a href="small.html#id32 9912">706 </a></dt><dt>7. <a href="small.html#id328412"> 707 707 I deleted my root account and now I cannot add it back! What can I do? 708 </a></dt><dt>8. <a href="small.html#id32 9978">708 </a></dt><dt>8. <a href="small.html#id328477"> 709 709 When I run net groupmap list, it reports a group called Administrators 710 710 as well as Domain Admins. What is the difference between them? 711 </a></dt><dt>9. <a href="small.html#id3 30018">711 </a></dt><dt>9. <a href="small.html#id328517"> 712 712 What is the effect of changing the name of a Samba server or of changing the Domain name? 713 </a></dt><dt>10. <a href="small.html#id3 30060">713 </a></dt><dt>10. <a href="small.html#id328559"> 714 714 How can I manage user accounts from my Windows XP Professional workstation? 715 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id32 9728"></a><a name="id329730"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>715 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id328228"></a><a name="id328230"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 716 716 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 717 717 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 722 722 default routes and DNS server addresses that apply only to the Abmas office environment do 723 723 not interfere with remote operations. This is an extremely important feature of DHCP. 724 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id32 9750"></a><a name="id329752"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>724 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id328249"></a><a name="id328251"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 725 725 Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> 726 726 that should be noted in particular? … … 731 731 NetBIOS machine name needs to be resolved to an IP Address. This configuration 732 732 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 733 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id32 9776"></a><a name="id329778"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>733 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id328275"></a><a name="id328277"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 734 734 Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? 735 735 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 738 738 necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX 739 739 account called <code class="constant">root</code>. 740 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id32 9810"></a><a name="id329812"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>740 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id328309"></a><a name="id328311"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 741 741 Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? 742 742 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 748 748 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 749 749 achieved with the <code class="constant">root</code> UID equal to 0. 750 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id32 9843"></a><a name="id329845"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>750 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id328342"></a><a name="id328345"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 751 751 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 752 752 <code class="constant">root</code> access. How can we do this? … … 757 757 This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> 758 758 Domain Admins</code> account. 759 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id32 9878"></a><a name="id329880"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>759 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id328378"></a><a name="id328380"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 760 760 Why must I map Windows Domain Groups to UNIX groups? 761 761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 763 763 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 764 764 <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. 765 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id32 9912"></a><a name="id329914"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>765 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id328412"></a><a name="id328414"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 766 766 I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? 767 767 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 775 775 </p></li><li class="step" title="Step 4"><p> 776 776 Restore the <code class="filename">group_mapping.tdb</code> file. 777 </p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id32 9978"></a><a name="id329980"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>777 </p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id328477"></a><a name="id328479"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 778 778 When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> 779 779 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? … … 783 783 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 784 784 may change at some later date. These accounts are provided only so that security objects are correctly shown. 785 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id3 30018"></a><a name="id330020"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>785 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id328517"></a><a name="id328519"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 786 786 What is the effect of changing the name of a Samba server or of changing the Domain name? 787 787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 795 795 or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 796 796 to check the man page for this command for detailed instructions regarding the steps involved. 797 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id3 30060"></a><a name="id330062"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>797 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id328559"></a><a name="id328561"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 798 798 How can I manage user accounts from my Windows XP Professional workstation? 799 799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/unixclients.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 7. Adding Domain Member Servers and Clients"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id35 7946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id357857"></a><a class="indexterm" name="id357864"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 7. Adding Domain Member Servers and Clients"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id356470">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356518">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id356547">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id356570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id357171">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id357255">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363033">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id363529">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id363573">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id356381"></a><a class="indexterm" name="id356389"></a> 2 2 The most frequently discussed Samba subjects over the past 2 years have focused around domain control and printing. 3 3 It is well known that Samba is a file and print server. A recent survey conducted by <span class="emphasis"><em>Open Magazine</em></span> found … … 12 12 the addition of Samba servers into your present Windows network whatever the controlling technology 13 13 may be. So let's get back to our good friends at Abmas. 14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 7946"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id357952"></a><a class="indexterm" name="id357960"></a>14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id356470"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id356476"></a><a class="indexterm" name="id356484"></a> 15 15 Looking back over the achievements of the past year or two, daily events at Abmas are rather straightforward 16 16 with not too many distractions or problems. Your team is doing well, but a number of employees 17 17 are asking for Linux desktop systems. Your network has grown and demands additional domain member servers. Let's 18 18 get on with this; Christine and Stan are ready to go. 19 </p><p><a class="indexterm" name="id35 7978"></a>19 </p><p><a class="indexterm" name="id356502"></a> 20 20 Stan is firmly in control of the department of the future, while Christine is enjoying a stable and 21 21 predictable network environment. It is time to add more servers and to add Linux desktops. It is 22 22 time to meet the demands of future growth and endure trial by fire. 23 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id35 7994"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id358000"></a>23 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id356518"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id356525"></a> 24 24 You must now add UNIX/Linux domain member servers to your network. You have a friend who has a Windows 2003 25 25 Active Directory domain network who wants to add a Samba/Linux server and has asked Christine to help him … … 31 31 do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make 32 32 the right decision, don't you? 33 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 8022"></a>Dissection and Discussion</h2></div></div></div><p>34 <a class="indexterm" name="id35 8030"></a>33 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id356547"></a>Dissection and Discussion</h2></div></div></div><p> 34 <a class="indexterm" name="id356554"></a> 35 35 Recent Samba mailing-list activity is witness to how many sites are using winbind. Some have no trouble 36 36 at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning … … 40 40 resolution. You also provide working examples of solutions for integrated authentication for 41 41 both UNIX/Linux and Windows environments. 42 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id35 8046"></a>Technical Issues</h3></div></div></div><p>42 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id356570"></a>Technical Issues</h3></div></div></div><p> 43 43 One of the great challenges we face when people ask us, <span class="quote">“<span class="quote">What is the best way to solve 44 44 this problem?</span>”</span> is to get beyond the facts so we not only can clearly comprehend 45 45 the immediate technical problem, but also can understand how needs may change. 46 46 </p><p> 47 <a class="indexterm" name="id35 8063"></a>47 <a class="indexterm" name="id356587"></a> 48 48 There are a few facts we should note when dealing with the question of how best to 49 49 integrate UNIX/Linux clients and servers into a Windows networking environment: 50 50 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 51 <a class="indexterm" name="id35 8078"></a>52 <a class="indexterm" name="id35 8084"></a>53 <a class="indexterm" name="id35 8091"></a>54 <a class="indexterm" name="id35 8100"></a>55 <a class="indexterm" name="id35 8107"></a>51 <a class="indexterm" name="id356602"></a> 52 <a class="indexterm" name="id356609"></a> 53 <a class="indexterm" name="id356615"></a> 54 <a class="indexterm" name="id356625"></a> 55 <a class="indexterm" name="id356631"></a> 56 56 A domain controller (PDC or BDC) is always authoritative for all accounts in its domain. 57 57 This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs 58 58 to the same values that the PDC resolved them to. 59 59 </p></li><li class="listitem"><p> 60 <a class="indexterm" name="id35 8120"></a>61 <a class="indexterm" name="id35 8127"></a>62 <a class="indexterm" name="id35 8138"></a>63 <a class="indexterm" name="id35 8145"></a>60 <a class="indexterm" name="id356644"></a> 61 <a class="indexterm" name="id356651"></a> 62 <a class="indexterm" name="id356662"></a> 63 <a class="indexterm" name="id356669"></a> 64 64 A domain member can be authoritative for local accounts, but is never authoritative for 65 65 domain accounts. If a user is accessing a domain member server and that user's account … … 71 71 number of sources: 72 72 </p><div class="itemizedlist"><ul class="itemizedlist" type="circle"><li class="listitem"><p> 73 <a class="indexterm" name="id35 8173"></a>74 <a class="indexterm" name="id35 8180"></a>75 <a class="indexterm" name="id35 8187"></a>76 <a class="indexterm" name="id35 8193"></a>77 <a class="indexterm" name="id35 8200"></a>73 <a class="indexterm" name="id356697"></a> 74 <a class="indexterm" name="id356704"></a> 75 <a class="indexterm" name="id356711"></a> 76 <a class="indexterm" name="id356718"></a> 77 <a class="indexterm" name="id356724"></a> 78 78 By executing a system <code class="literal">getpwnam()</code> or <code class="literal">getgrnam()</code> call. 79 79 On systems that support it, this utilizes the name service switch (NSS) facility to … … 81 81 file. NSS can be configured to use LDAP, winbind, NIS, or local files. 82 82 </p></li><li class="listitem"><p> 83 <a class="indexterm" name="id35 8231"></a>84 <a class="indexterm" name="id35 8238"></a>85 <a class="indexterm" name="id35 8245"></a>83 <a class="indexterm" name="id356755"></a> 84 <a class="indexterm" name="id356762"></a> 85 <a class="indexterm" name="id356769"></a> 86 86 Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). 87 87 This requires the use of the PADL nss_ldap tool (or equivalent). 88 88 </p></li><li class="listitem"><p> 89 <a class="indexterm" name="id35 8257"></a>90 <a class="indexterm" name="id35 8264"></a>91 <a class="indexterm" name="id35 8271"></a>92 <a class="indexterm" name="id35 8277"></a>89 <a class="indexterm" name="id356782"></a> 90 <a class="indexterm" name="id356788"></a> 91 <a class="indexterm" name="id356795"></a> 92 <a class="indexterm" name="id356802"></a> 93 93 Directly by querying <code class="literal">winbindd</code>. The <code class="literal">winbindd</code> 94 94 contacts a domain controller to attempt to resolve the identity of the user or group. It … … 98 98 <code class="filename">winbindd_cache.tdb</code> files. 99 99 </p><p> 100 <a class="indexterm" name="id35 8314"></a>101 <a class="indexterm" name="id35 8321"></a>100 <a class="indexterm" name="id356838"></a> 101 <a class="indexterm" name="id356845"></a> 102 102 If the parameter <a class="link" href="smb.conf.5.html#IDMAPBACKEND" target="_top">idmap backend = ldap:ldap://myserver.domain</a> 103 103 was specified and the LDAP server has been configured with a container in which it may … … 112 112 casual user. 113 113 </p></li><li class="listitem"><p> 114 <a class="indexterm" name="id35 8380"></a>115 <a class="indexterm" name="id35 8387"></a>116 <a class="indexterm" name="id35 8397"></a>114 <a class="indexterm" name="id356904"></a> 115 <a class="indexterm" name="id356911"></a> 116 <a class="indexterm" name="id356920"></a> 117 117 If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable 118 118 of being resolved using) the NSS facility, it is possible to use the … … 121 121 and to domain member servers. 122 122 </p></li></ul></div><p> 123 <a class="indexterm" name="id35 8428"></a>124 <a class="indexterm" name="id35 8434"></a>125 <a class="indexterm" name="id35 8441"></a>123 <a class="indexterm" name="id356952"></a> 124 <a class="indexterm" name="id356959"></a> 125 <a class="indexterm" name="id356966"></a> 126 126 For many administrators, it should be plain that the use of an LDAP-based repository for all network 127 127 accounts (both for POSIX accounts and for Samba accounts) provides the most elegant and 128 128 controllable facility. You eventually appreciate the decision to use LDAP. 129 129 </p><p> 130 <a class="indexterm" name="id35 8454"></a>131 <a class="indexterm" name="id35 8460"></a>132 <a class="indexterm" name="id35 8467"></a>130 <a class="indexterm" name="id356978"></a> 131 <a class="indexterm" name="id356985"></a> 132 <a class="indexterm" name="id356992"></a> 133 133 If your network account information resides in an LDAP repository, you should use it ahead of any 134 134 alternative method. This means that if it is humanly possible to use the <code class="literal">nss_ldap</code> … … 137 137 throughout the network. 138 138 </p><p> 139 <a class="indexterm" name="id35 8486"></a>140 <a class="indexterm" name="id35 8495"></a>141 <a class="indexterm" name="id35 8502"></a>142 <a class="indexterm" name="id35 8509"></a>143 <a class="indexterm" name="id35 8515"></a>144 <a class="indexterm" name="id35 8522"></a>139 <a class="indexterm" name="id357011"></a> 140 <a class="indexterm" name="id357020"></a> 141 <a class="indexterm" name="id357027"></a> 142 <a class="indexterm" name="id357034"></a> 143 <a class="indexterm" name="id357041"></a> 144 <a class="indexterm" name="id357048"></a> 145 145 In the situation where UNIX accounts are held on the domain member server itself, the only effective 146 146 way to use them involves the <code class="filename">smb.conf</code> entry … … 150 150 disables the use of Samba with trusted domains (i.e., external domains). 151 151 </p><p> 152 <a class="indexterm" name="id35 8570"></a>153 <a class="indexterm" name="id35 8577"></a>154 <a class="indexterm" name="id35 8586"></a>155 <a class="indexterm" name="id35 8593"></a>152 <a class="indexterm" name="id357095"></a> 153 <a class="indexterm" name="id357102"></a> 154 <a class="indexterm" name="id357111"></a> 155 <a class="indexterm" name="id357118"></a> 156 156 Winbind can be used to create an appliance mode domain member server. In this capacity, <code class="literal">winbindd</code> 157 157 is configured to automatically allocate UIDs/GIDs from numeric ranges set in the <code class="filename">smb.conf</code> file. The allocation … … 162 162 is stored in the <code class="filename">winbindd_idmap.tdb</code> and <code class="filename">winbindd_cache.tdb</code> files. 163 163 </p><p> 164 <a class="indexterm" name="id35 8634"></a>164 <a class="indexterm" name="id357159"></a> 165 165 The use of an LDAP backend for the Winbind IDMAP facility permits Windows domain SIDs 166 166 mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all domain member 167 167 servers so configured. This solves one of the major headaches for network administrators who need to copy 168 168 files between or across network file servers. 169 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id35 8646"></a>Political Issues</h3></div></div></div><p>170 <a class="indexterm" name="id35 8654"></a>171 <a class="indexterm" name="id35 8661"></a>172 <a class="indexterm" name="id35 8667"></a>173 <a class="indexterm" name="id35 8676"></a>169 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id357171"></a>Political Issues</h3></div></div></div><p> 170 <a class="indexterm" name="id357179"></a> 171 <a class="indexterm" name="id357186"></a> 172 <a class="indexterm" name="id357192"></a> 173 <a class="indexterm" name="id357201"></a> 174 174 One of the most fierce conflicts recently being waged is resistance to the adoption of LDAP, in 175 175 particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP … … 183 183 commercial integration products. But it's not what Active Directory was designed for. 184 184 </p><p> 185 <a class="indexterm" name="id35 8707"></a>186 <a class="indexterm" name="id35 8713"></a>185 <a class="indexterm" name="id357232"></a> 186 <a class="indexterm" name="id357238"></a> 187 187 A number of long-term UNIX devotees have recently commented in various communications that the Samba Team 188 188 is the first application group to almost force network administrators to use LDAP. It should be pointed … … 190 190 finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total 191 191 organizational directory needs. 192 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id35 8731"></a>Implementation</h2></div></div></div><p>193 <a class="indexterm" name="id35 8738"></a>194 <a class="indexterm" name="id35 8748"></a>195 <a class="indexterm" name="id35 8757"></a>192 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id357255"></a>Implementation</h2></div></div></div><p> 193 <a class="indexterm" name="id357263"></a> 194 <a class="indexterm" name="id357272"></a> 195 <a class="indexterm" name="id357282"></a> 196 196 The domain member server and the domain member client are at the center of focus in this chapter. 197 197 Configuration of Samba-3 domain controller is covered in earlier chapters, so if your … … 199 199 oil that helps you to add domain member servers and clients. 200 200 </p><p> 201 <a class="indexterm" name="id35 8770"></a>201 <a class="indexterm" name="id357295"></a> 202 202 In practice, domain member servers and domain member workstations are very different entities, but in 203 203 terms of technology they share similar core infrastructure. A technologist would argue that servers … … 207 207 but a server is viewed as a core component of the business. 208 208 </p><p> 209 <a class="indexterm" name="id35 8787"></a>209 <a class="indexterm" name="id357312"></a> 210 210 We can look at this another way. If a workstation breaks down, one user is affected, but if a 211 211 server breaks down, hundreds of users may not be able to work. The services that a workstation … … 213 213 and is distribution oriented. 214 214 </p><p> 215 <a class="indexterm" name="id35 8800"></a>216 <a class="indexterm" name="id35 8807"></a>217 <a class="indexterm" name="id35 8813"></a>215 <a class="indexterm" name="id357325"></a> 216 <a class="indexterm" name="id357331"></a> 217 <a class="indexterm" name="id357338"></a> 218 218 <span class="emphasis"><em>Why is this important?</em></span> For starters, we must identify what 219 219 components of the operating system and its environment must be configured. Also, it is necessary … … 227 227 what type of service need must be fulfilled. 228 228 </p><div class="sect2" title="Samba Domain with Samba Domain Member Server Using NSS LDAP"><div class="titlepage"><div><div><h3 class="title"><a name="sdcsdmldap"></a>Samba Domain with Samba Domain Member Server Using NSS LDAP</h3></div></div></div><p> 229 <a class="indexterm" name="id35 8848"></a>230 <a class="indexterm" name="id35 8854"></a>231 <a class="indexterm" name="id35 8861"></a>232 <a class="indexterm" name="id35 8868"></a>233 <a class="indexterm" name="id35 8877"></a>234 <a class="indexterm" name="id35 8884"></a>229 <a class="indexterm" name="id357374"></a> 230 <a class="indexterm" name="id357380"></a> 231 <a class="indexterm" name="id357387"></a> 232 <a class="indexterm" name="id357394"></a> 233 <a class="indexterm" name="id357403"></a> 234 <a class="indexterm" name="id357410"></a> 235 235 In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using 236 236 an LDAP ldapsam backend. We are adding to the LDAP backend database (directory) … … 248 248 so that all domain member servers can use a consistent mapping. 249 249 </p><p> 250 <a class="indexterm" name="id35 8942"></a>251 <a class="indexterm" name="id35 8948"></a>252 <a class="indexterm" name="id35 8955"></a>250 <a class="indexterm" name="id357467"></a> 251 <a class="indexterm" name="id357474"></a> 252 <a class="indexterm" name="id357481"></a> 253 253 If your installation is accessed only from clients that are members of your own domain, and all 254 254 user accounts are present in a local passdb backend then it is not necessary to run … … 260 260 source can be provided from 261 261 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 262 <a class="indexterm" name="id35 8988"></a>263 <a class="indexterm" name="id35 8995"></a>262 <a class="indexterm" name="id357514"></a> 263 <a class="indexterm" name="id357520"></a> 264 264 Accounts in <code class="filename">/etc/passwd</code> or in <code class="filename">/etc/group</code>. 265 265 </p></li><li class="listitem"><p> 266 <a class="indexterm" name="id35 9018"></a>267 <a class="indexterm" name="id35 9025"></a>268 <a class="indexterm" name="id35 9031"></a>269 <a class="indexterm" name="id35 9038"></a>270 <a class="indexterm" name="id35 9045"></a>271 <a class="indexterm" name="id35 9052"></a>272 <a class="indexterm" name="id35 9058"></a>273 <a class="indexterm" name="id35 9065"></a>274 <a class="indexterm" name="id35 9072"></a>266 <a class="indexterm" name="id357544"></a> 267 <a class="indexterm" name="id357550"></a> 268 <a class="indexterm" name="id357557"></a> 269 <a class="indexterm" name="id357564"></a> 270 <a class="indexterm" name="id357571"></a> 271 <a class="indexterm" name="id357578"></a> 272 <a class="indexterm" name="id357584"></a> 273 <a class="indexterm" name="id357591"></a> 274 <a class="indexterm" name="id357598"></a> 275 275 Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs 276 276 via multiple methods. The methods typically include <code class="literal">files</code>, … … 284 284 used only locally on the Samba domain member server under discussion. 285 285 </p></div><p> 286 <a class="indexterm" name="id35 9146"></a>286 <a class="indexterm" name="id357673"></a> 287 287 The diagram in <a class="link" href="unixclients.html#ch9-sambadc" title="Figure 7.2. Samba Domain: Samba Member Server">“Samba Domain: Samba Member Server”</a> demonstrates the relationship of Samba and system 288 288 components that are involved in the identity resolution process where Samba is used as a domain 289 289 member server within a Samba domain control network. 290 290 </p><div class="figure"><a name="ch9-sambadc"></a><p class="title"><b>Figure 7.2. Samba Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-SambaDC.png" width="324" alt="Samba Domain: Samba Member Server"></div></div></div><br class="figure-break"><p> 291 <a class="indexterm" name="id35 9206"></a>292 <a class="indexterm" name="id35 9213"></a>291 <a class="indexterm" name="id357733"></a> 292 <a class="indexterm" name="id357739"></a> 293 293 In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam 294 294 to obtain authentication and user identity information. The IDMAP information is stored in the LDAP … … 301 301 If the network does not have an LDAP slave server (i.e., <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> configuration), 302 302 change the target LDAP server from <code class="constant">lapdc</code> to <code class="constant">massive.</code> 303 </p><div class="procedure" title="Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution"><a name="id35 9255"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>303 </p><div class="procedure" title="Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution"><a name="id357782"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 304 304 Create the <code class="filename">smb.conf</code> file as shown in <a class="link" href="unixclients.html#ch9-sdmsdc" title="Example 7.1. Samba Domain Member in Samba Domain Using LDAP smb.conf File">“Samba Domain Member in Samba Domain Using LDAP smb.conf File”</a>. Locate 305 305 this file in the directory <code class="filename">/etc/samba</code>. 306 306 </p></li><li class="step" title="Step 2"><p> 307 <a class="indexterm" name="id35 9292"></a>307 <a class="indexterm" name="id357819"></a> 308 308 Configure the file that will be used by <code class="constant">nss_ldap</code> to 309 309 locate and communicate with the LDAP server. This file is called <code class="filename">ldap.conf</code>. … … 327 327 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 328 328 </p></li><li class="step" title="Step 4"><p> 329 <a class="indexterm" name="id35 9372"></a>330 <a class="indexterm" name="id35 9379"></a>329 <a class="indexterm" name="id357899"></a> 330 <a class="indexterm" name="id357906"></a> 331 331 Before proceeding to configure Samba, validate the operation of the NSS identity 332 332 resolution via LDAP by executing: … … 363 363 sammy:x:4321: 364 364 </pre><p> 365 <a class="indexterm" name="id35 9426"></a>366 <a class="indexterm" name="id35 9433"></a>367 <a class="indexterm" name="id35 9440"></a>365 <a class="indexterm" name="id357953"></a> 366 <a class="indexterm" name="id357960"></a> 367 <a class="indexterm" name="id357966"></a> 368 368 This shows that all is working as it should be. Notice that in the LDAP database 369 369 the users' primary and secondary group memberships are identical. It is not … … 375 375 after Samba-3.0.20 has been released. 376 376 </p></li><li class="step" title="Step 5"><p> 377 <a class="indexterm" name="id35 9458"></a>377 <a class="indexterm" name="id357985"></a> 378 378 The LDAP directory must have a container object for IDMAP data. There are several ways you can 379 379 check that your LDAP database is able to receive IDMAP information. One of the simplest is to … … 384 384 ou: idmap 385 385 </pre><p> 386 <a class="indexterm" name="id35 9479"></a>386 <a class="indexterm" name="id358006"></a> 387 387 If the execution of this command does not return IDMAP entries, you need to create an LDIF 388 388 template file (see <a class="link" href="unixclients.html#ch9-ldifadd" title="Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 400 400 </pre><p> 401 401 </p></li><li class="step" title="Step 7"><p> 402 <a class="indexterm" name="id35 9538"></a>403 <a class="indexterm" name="id35 9549"></a>402 <a class="indexterm" name="id358066"></a> 403 <a class="indexterm" name="id358077"></a> 404 404 The system is ready to join the domain. Execute the following: 405 405 </p><pre class="screen"> … … 419 419 <code class="prompt">root# </code> net rpc join -S 'pdc-name' -U administrator%password -d 5 420 420 </pre><p> 421 <a class="indexterm" name="id35 9616"></a>422 <a class="indexterm" name="id35 9623"></a>423 <a class="indexterm" name="id35 9629"></a>424 <a class="indexterm" name="id35 9636"></a>421 <a class="indexterm" name="id358143"></a> 422 <a class="indexterm" name="id358150"></a> 423 <a class="indexterm" name="id358157"></a> 424 <a class="indexterm" name="id358164"></a> 425 425 Note: Use "root" for UNIX/Linux and Samba, use "Administrator" for Windows NT4/200X. If the cause of 426 426 the failure appears to be related to a rejected or failed NT_SESSION_SETUP* or an error message that … … 450 450 </pre><p> 451 451 </p></li><li class="step" title="Step 8"><p> 452 <a class="indexterm" name="id35 9688"></a>452 <a class="indexterm" name="id358216"></a> 453 453 Just joining the domain is not quite enough; you must now provide a privileged set 454 454 of credentials through which <code class="literal">winbindd</code> can interact with the … … 461 461 You may now start Samba in the usual manner, and your Samba domain member server 462 462 is ready for use. Just add shares as required. 463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id35 9761"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id359773"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id359784"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id359796"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id359807"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id359819"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359830"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id359842"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id359853"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id359865"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id359876"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id359888"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id359899"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id359911"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id359923"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id359934"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id359946"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id359957"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id359969"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id359981"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id359992"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360004"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360016"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id360027"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id360047"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id360059"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id360070"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id360082"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id360102"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id360114"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id360125"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360137"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360148"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id360169"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360180"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360192"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id360204"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id358288"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id358300"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id358311"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id358323"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id358334"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id358346"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id358357"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id358369"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id358380"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id358392"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id358403"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id358415"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id358426"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id358438"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id358450"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id358461"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id358473"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id358484"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id358496"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id358508"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id358519"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id358531"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358543"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id358554"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id358574"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id358586"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id358598"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id358609"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id358629"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id358641"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id358652"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358664"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358675"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id358696"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id358707"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id358719"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id358731"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 464 464 dn: ou=Idmap,dc=abmas,dc=biz 465 465 objectClass: organizationalUnit … … 508 508 The Samba domain member server must be part of a Windows NT4 Domain, or a Samba Domain. 509 509 </p></li></ul></div><p> 510 <a class="indexterm" name="id3 60323"></a>511 <a class="indexterm" name="id3 60329"></a>512 <a class="indexterm" name="id3 60336"></a>510 <a class="indexterm" name="id358850"></a> 511 <a class="indexterm" name="id358857"></a> 512 <a class="indexterm" name="id358864"></a> 513 513 Later in the chapter, you can see how to configure a Samba domain member server for a Windows ADS domain. 514 514 Right now your objective is to configure a Samba server that can be a member of a Windows NT4-style 515 515 domain and/or does not use LDAP. 516 516 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 517 <a class="indexterm" name="id3 60349"></a>517 <a class="indexterm" name="id358877"></a> 518 518 If you use <code class="literal">winbind</code> for identity resolution, make sure that there are no 519 519 duplicate accounts. 520 520 </p><p> 521 <a class="indexterm" name="id3 60366"></a>521 <a class="indexterm" name="id358894"></a> 522 522 For example, do not have more than one account that has UID=0 in the password database. If there 523 523 is an account called <code class="constant">root</code> in the <code class="filename">/etc/passwd</code> database, … … 527 527 <code class="constant">root</code>. 528 528 </p><p> 529 <a class="indexterm" name="id3 60400"></a>530 <a class="indexterm" name="id3 60406"></a>531 <a class="indexterm" name="id3 60413"></a>529 <a class="indexterm" name="id358927"></a> 530 <a class="indexterm" name="id358934"></a> 531 <a class="indexterm" name="id358941"></a> 532 532 Winbind will break if there is an account in <code class="filename">/etc/passwd</code> that has 533 533 the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. 534 534 </p></div><p> 535 <a class="indexterm" name="id3 60431"></a>536 <a class="indexterm" name="id3 60437"></a>537 <a class="indexterm" name="id3 60444"></a>538 <a class="indexterm" name="id3 60451"></a>539 <a class="indexterm" name="id3 60460"></a>535 <a class="indexterm" name="id358958"></a> 536 <a class="indexterm" name="id358965"></a> 537 <a class="indexterm" name="id358972"></a> 538 <a class="indexterm" name="id358979"></a> 539 <a class="indexterm" name="id358988"></a> 540 540 The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. 541 541 The winbind information is locally cached in the <code class="filename">winbindd_cache.tdb winbindd_idmap.tdb</code> … … 544 544 files using the tool <code class="literal">tdbdump</code>, though you may have to build this from the Samba 545 545 source code if it has not been supplied as part of a binary package distribution that you may be using. 546 </p><div class="procedure" title="Procedure 7.2. Configuration of Winbind-Based Identity Resolution"><a name="id3 60484"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>546 </p><div class="procedure" title="Procedure 7.2. Configuration of Winbind-Based Identity Resolution"><a name="id359012"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 547 547 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 548 548 shown in <a class="link" href="unixclients.html#ch0-NT4DSDM" title="Example 7.5. Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain">“Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain”</a>. 549 549 </p></li><li class="step" title="Step 2"><p> 550 <a class="indexterm" name="id3 60515"></a>550 <a class="indexterm" name="id359044"></a> 551 551 Edit the <code class="filename">/etc/nsswitch.conf</code> so it has the entries shown in 552 552 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 553 553 </p></li><li class="step" title="Step 3"><p> 554 <a class="indexterm" name="id3 60540"></a>554 <a class="indexterm" name="id359069"></a> 555 555 The system is ready to join the domain. Execute the following: 556 556 </p><pre class="screen"> … … 561 561 562 562 </p></li><li class="step" title="Step 4"><p> 563 <a class="indexterm" name="id3 60565"></a>564 <a class="indexterm" name="id3 60572"></a>563 <a class="indexterm" name="id359094"></a> 564 <a class="indexterm" name="id359101"></a> 565 565 Validate operation of <code class="literal">winbind</code> using the <code class="literal">wbinfo</code> 566 566 tool as follows: … … 589 589 This shows that domain groups have been correctly obtained also. 590 590 </p></li><li class="step" title="Step 5"><p> 591 <a class="indexterm" name="id3 60624"></a>592 <a class="indexterm" name="id3 60631"></a>593 <a class="indexterm" name="id3 60637"></a>591 <a class="indexterm" name="id359153"></a> 592 <a class="indexterm" name="id359159"></a> 593 <a class="indexterm" name="id359166"></a> 594 594 The next step verifies that NSS is able to obtain this information 595 595 correctly from <code class="literal">winbind</code> also. … … 632 632 </p></li><li class="step" title="Step 6"><p> 633 633 The Samba member server of a Windows NT4 domain is ready for use. 634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 60734"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id360745"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id360757"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id360768"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id360780"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id360791"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id360803"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id360814"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id360826"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id360837"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id360849"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id360860"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id360872"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360883"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360895"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id360906"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id360918"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id360929"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id360941"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id360953"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id360973"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id360985"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id360996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id361008"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id361028"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id361040"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id361051"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361062"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361074"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id361094"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361106"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361118"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id361129"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="NT4/Samba Domain with Samba Domain Member Server without NSS Support"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p>634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id359263"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id359274"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id359286"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id359297"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id359309"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id359320"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359332"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id359343"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359355"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id359366"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id359378"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id359389"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id359401"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id359412"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id359424"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id359435"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id359447"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id359458"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id359470"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id359482"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id359502"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id359514"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id359525"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id359537"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id359557"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id359569"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id359580"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id359592"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id359603"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id359623"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id359635"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id359647"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id359658"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="NT4/Samba Domain with Samba Domain Member Server without NSS Support"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p> 635 635 No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating 636 636 system that does not have NSS and PAM support to be outdated, the fact is there … … 643 643 is found, it is used. If the account is not found, one will be automatically created 644 644 on the local machine so that it can then be used for all access controls. 645 </p><div class="procedure" title="Procedure 7.3. Configuration Using Local Accounts Only"><a name="id3 61165"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>645 </p><div class="procedure" title="Procedure 7.3. Configuration Using Local Accounts Only"><a name="id359695"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 646 646 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 647 647 shown in <a class="link" href="unixclients.html#ch0-NT4DSCM" title="Example 7.6. Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain">“Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain”</a>. 648 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id3 61197"></a>648 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id359726"></a> 649 649 The system is ready to join the domain. Execute the following: 650 650 </p><pre class="screen"> … … 657 657 </p></li><li class="step" title="Step 4"><p> 658 658 The Samba member server of a Windows NT4 domain is ready for use. 659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 61282"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id361294"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id361305"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id361317"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id361328"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id361340"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id361351"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id361363"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id361374"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id361386"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id361398"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id361409"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id361421"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id361432"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id361444"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id361455"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id361467"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id361478"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id361490"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id361511"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id361522"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id361534"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id361545"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id361566"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id361577"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id361589"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361600"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361612"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id361632"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361644"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361655"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id361667"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Active Directory Domain with Samba Domain Member Server"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p>660 <a class="indexterm" name="id36 1692"></a>661 <a class="indexterm" name="id36 1701"></a>662 <a class="indexterm" name="id36 1707"></a>659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id359812"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id359823"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id359835"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id359846"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id359858"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id359869"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id359881"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359892"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id359904"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id359916"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id359927"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id359939"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359950"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id359962"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id359974"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id359985"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id359997"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id360008"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id360020"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id360040"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id360052"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id360063"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id360075"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id360095"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id360107"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id360118"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360130"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360141"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id360162"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360173"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360185"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id360196"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Active Directory Domain with Samba Domain Member Server"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p> 660 <a class="indexterm" name="id360222"></a> 661 <a class="indexterm" name="id360231"></a> 662 <a class="indexterm" name="id360237"></a> 663 663 One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory 664 664 domain using Kerberos protocols. This makes it possible to operate an entire Windows network … … 668 668 in. For now, we simply focus on how a Samba-3 server can be made a domain member server. 669 669 </p><p> 670 <a class="indexterm" name="id36 1725"></a>671 <a class="indexterm" name="id36 1732"></a>672 <a class="indexterm" name="id36 1738"></a>673 <a class="indexterm" name="id36 1745"></a>670 <a class="indexterm" name="id360255"></a> 671 <a class="indexterm" name="id360262"></a> 672 <a class="indexterm" name="id360268"></a> 673 <a class="indexterm" name="id360275"></a> 674 674 The diagram in <a class="link" href="unixclients.html#ch9-adsdc" title="Figure 7.3. Active Directory Domain: Samba Member Server">“Active Directory Domain: Samba Member Server”</a> demonstrates how Samba-3 interfaces with 675 675 Microsoft Active Directory components. It should be noted that if Microsoft Windows Services … … 695 695 is known as <code class="constant">w2k3s.london.abmas.biz</code>. In NetBIOS nomenclature, the 696 696 domain name is <code class="constant">LONDON</code> and the server name is <code class="constant">W2K3S</code>. 697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 7.4. Joining a Samba Server as an ADS Domain Member"><a name="id36 1844"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>698 <a class="indexterm" name="id36 1856"></a>697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 7.4. Joining a Samba Server as an ADS Domain Member"><a name="id360374"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 698 <a class="indexterm" name="id360385"></a> 699 699 Before you try to use Samba-3, you want to know for certain that your executables have 700 700 support for Kerberos and for LDAP. Execute the following to identify whether or … … 763 763 support. You are relieved to know that it is safe to progress. 764 764 </p></li><li class="step" title="Step 2"><p> 765 <a class="indexterm" name="id36 1938"></a>766 <a class="indexterm" name="id36 1947"></a>767 <a class="indexterm" name="id36 1954"></a>768 <a class="indexterm" name="id36 1960"></a>769 <a class="indexterm" name="id36 1970"></a>770 <a class="indexterm" name="id36 1979"></a>771 <a class="indexterm" name="id36 1986"></a>772 <a class="indexterm" name="id36 1993"></a>773 <a class="indexterm" name="id36 1999"></a>765 <a class="indexterm" name="id360468"></a> 766 <a class="indexterm" name="id360477"></a> 767 <a class="indexterm" name="id360484"></a> 768 <a class="indexterm" name="id360490"></a> 769 <a class="indexterm" name="id360499"></a> 770 <a class="indexterm" name="id360508"></a> 771 <a class="indexterm" name="id360515"></a> 772 <a class="indexterm" name="id360522"></a> 773 <a class="indexterm" name="id360529"></a> 774 774 The next step is to identify which version of the Kerberos libraries have been used. 775 775 In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is … … 799 799 Edit or create the NSS control file so it has the contents shown in <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 800 800 </p></li><li class="step" title="Step 5"><p> 801 <a class="indexterm" name="id36 2091"></a>801 <a class="indexterm" name="id360621"></a> 802 802 Delete the file <code class="filename">/etc/samba/secrets.tdb</code> if it exists. Of course, you 803 803 do keep a backup, don't you? … … 810 810 </pre><p> 811 811 </p></li><li class="step" title="Step 7"><p> 812 <a class="indexterm" name="id36 2132"></a>812 <a class="indexterm" name="id360661"></a> 813 813 Validate your <code class="filename">smb.conf</code> file using <code class="literal">testparm</code> (as you have 814 814 done previously). Correct all errors reported before proceeding. The command you … … 820 820 ADS domain, let's move on. 821 821 </p></li><li class="step" title="Step 8"><p> 822 <a class="indexterm" name="id36 2171"></a>823 <a class="indexterm" name="id36 2182"></a>822 <a class="indexterm" name="id360700"></a> 823 <a class="indexterm" name="id360711"></a> 824 824 This is a good time to double-check everything and then execute the following 825 825 command when everything you have done has checked out okay: … … 832 832 using Kerberos protocols. 833 833 </p><p> 834 <a class="indexterm" name="id36 2207"></a>835 <a class="indexterm" name="id36 2214"></a>834 <a class="indexterm" name="id360736"></a> 835 <a class="indexterm" name="id360743"></a> 836 836 In the event that you receive no output messages, a silent return means that the 837 837 domain join failed. You should use <code class="literal">ethereal</code> to identify what … … 839 839 840 840 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 841 <a class="indexterm" name="id36 2233"></a>841 <a class="indexterm" name="id360762"></a> 842 842 Defective or misconfigured DNS name resolution. 843 843 </p></li><li class="listitem"><p> 844 <a class="indexterm" name="id36 2247"></a>844 <a class="indexterm" name="id360776"></a> 845 845 Restrictive security settings on the Windows 200x ADS domain controller 846 846 preventing needed communications protocols. You can check this by searching … … 854 854 </p></li></ul></div><p> 855 855 856 <a class="indexterm" name="id36 2275"></a>857 <a class="indexterm" name="id36 2286"></a>858 <a class="indexterm" name="id36 2293"></a>856 <a class="indexterm" name="id360804"></a> 857 <a class="indexterm" name="id360815"></a> 858 <a class="indexterm" name="id360821"></a> 859 859 In any case, never execute the <code class="literal">net rpc join</code> command in an attempt 860 860 to join the Samba server to the domain, unless you wish not to use the Kerberos … … 862 862 Windows Server 200x ADS has been configured appropriately for mixed mode operation. 863 863 </p></li><li class="step" title="Step 9"><p> 864 <a class="indexterm" name="id36 2314"></a>865 <a class="indexterm" name="id36 2321"></a>864 <a class="indexterm" name="id360843"></a> 865 <a class="indexterm" name="id360850"></a> 866 866 If the <code class="literal">tdbdump</code> is installed on your system (not essential), 867 867 you can look inside the <code class="filename">/etc/samba/secrets.tdb</code> file. If … … 894 894 in this book). 895 895 </p></li><li class="step" title="Step 11"><p> 896 <a class="indexterm" name="id36 2371"></a>896 <a class="indexterm" name="id360900"></a> 897 897 This is a good time to verify that everything is working. First, check that 898 898 winbind is able to obtain the list of users and groups from the ADS domain controller. … … 920 920 </pre><p> 921 921 Excellent. That worked also, as expected. 922 </p></li><li class="step" title="Step 12"><p><a class="indexterm" name="id36 2412"></a>922 </p></li><li class="step" title="Step 12"><p><a class="indexterm" name="id360941"></a> 923 923 Now repeat this via NSS to validate that full identity resolution is 924 924 functional as required. Execute: … … 953 953 This is very pleasing. Everything works as expected. 954 954 </p></li><li class="step" title="Step 13"><p> 955 <a class="indexterm" name="id36 2460"></a>956 <a class="indexterm" name="id36 2471"></a>957 <a class="indexterm" name="id36 2480"></a>955 <a class="indexterm" name="id360989"></a> 956 <a class="indexterm" name="id361000"></a> 957 <a class="indexterm" name="id361009"></a> 958 958 You may now perform final verification that communications between Samba-3 winbind and 959 959 the Active Directory server is using Kerberos protocols. Execute the following: … … 973 973 In any case, the output we obtained confirms that all systems are operational. 974 974 </p></li><li class="step" title="Step 14"><p> 975 <a class="indexterm" name="id36 2511"></a>975 <a class="indexterm" name="id361039"></a> 976 976 There is one more action you elect to take, just because you are paranoid and disbelieving, 977 977 so you execute the following command: … … 1143 1143 Now all is revealed. Your curiosity, as well as that of your team, has been put at ease. 1144 1144 May this server serve well all who happen upon it. 1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id36 2682"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id362694"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id362705"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id362717"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id362729"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id362740"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id362752"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id362763"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id362775"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id362786"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id362798"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id362809"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id362821"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362832"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362844"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id362855"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id362867"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id362878"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id362899"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id362910"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id362922"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id362933"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id362954"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id362965"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id362977"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362988"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363000"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id363020"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id363032"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id363043"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id363055"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" title="IDMAP_RID with Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id363067"></a>IDMAP_RID with Winbind</h4></div></div></div><p>1146 <a class="indexterm" name="id36 3075"></a>1147 <a class="indexterm" name="id36 3082"></a>1148 <a class="indexterm" name="id36 3088"></a>1149 <a class="indexterm" name="id36 3095"></a>1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id361212"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id361223"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id361235"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id361246"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id361258"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id361269"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id361281"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id361292"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id361304"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id361315"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id361327"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id361338"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id361350"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id361361"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id361373"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id361384"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id361396"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id361407"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id361428"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id361439"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id361451"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id361462"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id361483"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id361494"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id361506"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361517"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361529"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id361549"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361561"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361572"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id361584"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" title="IDMAP_RID with Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id361596"></a>IDMAP_RID with Winbind</h4></div></div></div><p> 1146 <a class="indexterm" name="id361604"></a> 1147 <a class="indexterm" name="id361611"></a> 1148 <a class="indexterm" name="id361618"></a> 1149 <a class="indexterm" name="id361624"></a> 1150 1150 The <code class="literal">idmap_rid</code> facility is a new tool that, unlike native winbind, creates a 1151 1151 predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method … … 1154 1154 is not compatible with trusted domain implementations. 1155 1155 </p><p> 1156 <a class="indexterm" name="id36 3115"></a>1157 <a class="indexterm" name="id36 3122"></a>1158 <a class="indexterm" name="id36 3128"></a>1159 <a class="indexterm" name="id36 3135"></a>1156 <a class="indexterm" name="id361644"></a> 1157 <a class="indexterm" name="id361650"></a> 1158 <a class="indexterm" name="id361657"></a> 1159 <a class="indexterm" name="id361664"></a> 1160 1160 This alternate method of SID to UID/GID mapping can be achieved with the idmap_rid 1161 1161 plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the … … 1165 1165 <em class="parameter"><code>idmap gid</code></em> ranges must be specified. 1166 1166 </p><p> 1167 <a class="indexterm" name="id36 3164"></a>1168 <a class="indexterm" name="id36 3171"></a>1167 <a class="indexterm" name="id361693"></a> 1168 <a class="indexterm" name="id361700"></a> 1169 1169 The idmap_rid facility can be used both for NT4/Samba-style domains as well as with Active Directory. 1170 1170 To use this with an NT4 domain, the <em class="parameter"><code>realm</code></em> is not used. Additionally the … … 1172 1172 </p><p> 1173 1173 An example <code class="filename">smb.conf</code> file for an ADS domain environment is shown in <a class="link" href="unixclients.html#sbe-idmapridex" title="Example 7.8. Example smb.conf File Using idmap_rid">“Example smb.conf File Using idmap_rid”</a>. 1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id36 3243"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id363254"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id363266"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id363277"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id363289"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id363300"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id363312"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363324"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363335"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363347"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id363359"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363370"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id363382"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id363393"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363405"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p>1175 <a class="indexterm" name="id36 3420"></a>1176 <a class="indexterm" name="id36 3427"></a>1177 <a class="indexterm" name="id36 3433"></a>1178 <a class="indexterm" name="id36 3440"></a>1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id361770"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id361782"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id361793"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id361805"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id361816"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id361828"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id361839"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id361851"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id361863"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id361874"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id361886"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361898"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id361909"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id361921"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361932"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p> 1175 <a class="indexterm" name="id361947"></a> 1176 <a class="indexterm" name="id361954"></a> 1177 <a class="indexterm" name="id361961"></a> 1178 <a class="indexterm" name="id361968"></a> 1179 1179 In a large domain with many users, it is imperative to disable enumeration of users and groups. 1180 1180 For example, at a site that has 22,000 users in Active Directory the winbind-based user and … … 1186 1186 below. 1187 1187 </p><p> 1188 <a class="indexterm" name="id36 3473"></a>1189 <a class="indexterm" name="id36 3480"></a>1188 <a class="indexterm" name="id362001"></a> 1189 <a class="indexterm" name="id362007"></a> 1190 1190 The use of this tool requires configuration of NSS as per the native use of winbind. Edit the 1191 1191 <code class="filename">/etc/nsswitch.conf</code> so it has the following parameters: … … 1213 1213 </pre><p> 1214 1214 </p><p> 1215 <a class="indexterm" name="id36 3555"></a>1215 <a class="indexterm" name="id362082"></a> 1216 1216 An invalid or failed join can be detected by executing: 1217 1217 </p><pre class="screen"> … … 1229 1229 </p></li><li class="step" title="Step 5"><p> 1230 1230 Validate the operation of this configuration by executing: 1231 <a class="indexterm" name="id36 3616"></a>1231 <a class="indexterm" name="id362144"></a> 1232 1232 </p><pre class="screen"> 1233 1233 <code class="prompt">root# </code> getent passwd administrator 1234 1234 administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash 1235 1235 </pre><p> 1236 </p></li></ol></div></div><div class="sect3" title="IDMAP Storage in LDAP using Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id36 3637"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p>1237 <a class="indexterm" name="id36 3645"></a>1238 <a class="indexterm" name="id36 3652"></a>1236 </p></li></ol></div></div><div class="sect3" title="IDMAP Storage in LDAP using Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id362164"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p> 1237 <a class="indexterm" name="id362172"></a> 1238 <a class="indexterm" name="id362179"></a> 1239 1239 The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as 1240 1240 with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant … … 1243 1243 </p><p> 1244 1244 The example in <a class="link" href="unixclients.html#sbeunxa" title="Example 7.9. Typical ADS Style Domain smb.conf File">“Typical ADS Style Domain smb.conf File”</a> is for an ADS-style domain. 1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id36 3706"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id363718"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id363729"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id363741"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id363752"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id363764"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id363776"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id363787"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id363799"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id363811"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id363822"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id363834"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id363846"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id363857"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1246 <a class="indexterm" name="id36 3872"></a>1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id362234"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id362245"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id362257"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id362268"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id362280"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id362291"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id362303"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id362315"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id362326"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id362338"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id362350"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id362361"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id362373"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id362384"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1246 <a class="indexterm" name="id362399"></a> 1247 1247 In the case of an NT4 or Samba-3-style domain the <em class="parameter"><code>realm</code></em> is not used, and the 1248 1248 command used to join the domain is <code class="literal">net rpc join</code>. The above example also demonstrates … … 1250 1250 <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second Edition</span>”</span> (TOSHARG2). 1251 1251 </p><p> 1252 <a class="indexterm" name="id36 3900"></a>1253 <a class="indexterm" name="id36 3907"></a>1254 <a class="indexterm" name="id36 3914"></a>1252 <a class="indexterm" name="id362428"></a> 1253 <a class="indexterm" name="id362434"></a> 1254 <a class="indexterm" name="id362441"></a> 1255 1255 Where MIT kerberos is installed (version 1.3.4 or later), edit the <code class="filename">/etc/krb5.conf</code> 1256 1256 file so it has the following contents: … … 1307 1307 </pre><p> 1308 1308 </p><p> 1309 <a class="indexterm" name="id36 3986"></a>1310 <a class="indexterm" name="id36 3993"></a>1309 <a class="indexterm" name="id362514"></a> 1310 <a class="indexterm" name="id362520"></a> 1311 1311 You will need the <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> <code class="literal">nss_ldap</code> 1312 1312 tool set for this solution. Configure the <code class="filename">/etc/ldap.conf</code> file so it has … … 1371 1371 Start the <code class="literal">nmbd</code>, <code class="literal">winbind</code>, and <code class="literal">smbd</code> daemons in the order shown. 1372 1372 </p></li></ol></div><p> 1373 <a class="indexterm" name="id36 4177"></a>1373 <a class="indexterm" name="id362704"></a> 1374 1374 Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join. 1375 1375 In many cases a failure is indicated by a silent return to the command prompt with no indication of the 1376 1376 reason for failure. 1377 </p></div><div class="sect3" title="IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension"><div class="titlepage"><div><div><h4 class="title"><a name="id36 4188"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p>1378 <a class="indexterm" name="id36 4196"></a>1379 <a class="indexterm" name="id36 4203"></a>1377 </p></div><div class="sect3" title="IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension"><div class="titlepage"><div><div><h4 class="title"><a name="id362716"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p> 1378 <a class="indexterm" name="id362724"></a> 1379 <a class="indexterm" name="id362731"></a> 1380 1380 The use of this method is messy. The information provided in this section is for guidance only 1381 1381 and is very definitely not complete. This method does work; it is used in a number of large sites … … 1383 1383 </p><p> 1384 1384 An example <code class="filename">smb.conf</code> file is shown in <a class="link" href="unixclients.html#sbewinbindex" title="Example 7.10. ADS Membership Using RFC2307bis Identity Resolution smb.conf File">“ADS Membership Using RFC2307bis Identity Resolution smb.conf File”</a>. 1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id36 4262"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id364274"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id364285"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id364297"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id364308"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id364320"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id364331"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id364343"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id364355"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id364366"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id364378"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1386 <a class="indexterm" name="id36 4393"></a>1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id362790"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id362801"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id362813"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id362824"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id362836"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id362847"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id362859"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id362870"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id362882"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362894"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362906"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1386 <a class="indexterm" name="id362920"></a> 1387 1387 The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary 1388 1388 to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the … … 1393 1393 </pre><p> 1394 1394 </p><p> 1395 <a class="indexterm" name="id36 4411"></a>1395 <a class="indexterm" name="id362938"></a> 1396 1396 The following <code class="filename">/etc/nsswitch.conf</code> file contents are required: 1397 1397 </p><pre class="screen"> … … 1405 1405 </pre><p> 1406 1406 </p><p> 1407 <a class="indexterm" name="id36 4434"></a>1408 <a class="indexterm" name="id36 4441"></a>1407 <a class="indexterm" name="id362961"></a> 1408 <a class="indexterm" name="id362968"></a> 1409 1409 The <code class="filename">/etc/ldap.conf</code> file must be configured also. Refer to the PADL documentation 1410 1410 and source code for nss_ldap instructions. … … 1412 1412 The next step involves preparation on the ADS schema. This is briefly discussed in the remaining 1413 1413 part of this chapter. 1414 </p><div class="sect4" title="IDMAP, Active Directory, and MS Services for UNIX 3.5"><div class="titlepage"><div><div><h5 class="title"><a name="id36 4460"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p>1415 <a class="indexterm" name="id36 4468"></a>1414 </p><div class="sect4" title="IDMAP, Active Directory, and MS Services for UNIX 3.5"><div class="titlepage"><div><div><h5 class="title"><a name="id362988"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p> 1415 <a class="indexterm" name="id362996"></a> 1416 1416 The Microsoft Windows Service for UNIX version 3.5 is available for free 1417 1417 <a class="ulink" href="http://www.microsoft.com/windows/sfu/" target="_top">download</a> 1418 1418 from the Microsoft Web site. You will need to download this tool and install it following 1419 1419 Microsoft instructions. 1420 </p></div><div class="sect4" title="IDMAP, Active Directory, and AD4UNIX"><div class="titlepage"><div><div><h5 class="title"><a name="id36 4486"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p>1420 </p></div><div class="sect4" title="IDMAP, Active Directory, and AD4UNIX"><div class="titlepage"><div><div><h5 class="title"><a name="id363013"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p> 1421 1421 Instructions for obtaining and installing the AD4UNIX tool set can be found from the 1422 1422 <a class="ulink" href="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach" target="_top"> 1423 1423 Geekcomix</a> Web site. 1424 </p></div></div></div><div class="sect2" title="UNIX/Linux Client Domain Member"><div class="titlepage"><div><div><h3 class="title"><a name="id36 4506"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id364512"></a>1424 </p></div></div></div><div class="sect2" title="UNIX/Linux Client Domain Member"><div class="titlepage"><div><div><h3 class="title"><a name="id363033"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id363040"></a> 1425 1425 So far this chapter has been mainly concerned with the provision of file and print 1426 1426 services for domain member servers. However, an increasing number of UNIX/Linux … … 1428 1428 other than a single desktop user. The key demand for desktop systems is to be able 1429 1429 to log onto any UNIX/Linux or Windows desktop using the same network user credentials. 1430 </p><p><a class="indexterm" name="id36 4527"></a>1430 </p><p><a class="indexterm" name="id363054"></a> 1431 1431 The ability to use a common set of user credential across a variety of network systems 1432 1432 is generally regarded as a single sign-on (SSO) solution. SSO systems are sold by a … … 1440 1440 </p></li><li class="listitem"><p> 1441 1441 Replacement authentication systems 1442 </p></li></ul></div><p><a class="indexterm" name="id36 4566"></a>1442 </p></li></ul></div><p><a class="indexterm" name="id363093"></a> 1443 1443 There are really four solutions that provide integrated authentication and 1444 1444 user identity management facilities: … … 1465 1465 support via Samba-3. 1466 1466 </p><p> 1467 <a class="indexterm" name="id36 4633"></a>1467 <a class="indexterm" name="id363160"></a> 1468 1468 On the other hand, if the authentication and identity resolution backend must be provided by 1469 1469 a Windows NT4-style domain or from an Active Directory Domain that does not have the Microsoft … … 1471 1471 situations now follows. 1472 1472 </p><p> 1473 <a class="indexterm" name="id36 4648"></a>1474 <a class="indexterm" name="id36 4655"></a>1475 <a class="indexterm" name="id36 4662"></a>1473 <a class="indexterm" name="id363176"></a> 1474 <a class="indexterm" name="id363182"></a> 1475 <a class="indexterm" name="id363189"></a> 1476 1476 To permit users to log on to a Linux system using Windows network credentials, you need to 1477 1477 configure identity resolution (NSS) and PAM. This means that the basic steps include those … … 1480 1480 of shares and printers is generally less important. Often this allows the share specifications 1481 1481 to be entirely removed from the <code class="filename">smb.conf</code> file. That is obviously an administrator decision. 1482 </p><div class="sect3" title="NT4 Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id36 4680"></a>NT4 Domain Member</h4></div></div></div><p>1482 </p><div class="sect3" title="NT4 Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id363208"></a>NT4 Domain Member</h4></div></div></div><p> 1483 1483 The following steps provide a Linux system that users can log onto using 1484 1484 Windows NT4 (or Samba-3) domain network credentials: … … 1508 1508 Edit only one file at a time. Carefully validate its operation before attempting 1509 1509 to reboot the machine. 1510 </p></li></ol></div></div><div class="sect3" title="ADS Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id36 4792"></a>ADS Domain Member</h4></div></div></div><p>1510 </p></li></ol></div></div><div class="sect3" title="ADS Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id363318"></a>ADS Domain Member</h4></div></div></div><p> 1511 1511 This procedure should be followed to permit a Linux network client (workstation/desktop) 1512 1512 to permit users to log on using Microsoft Active Directory-based user credentials. … … 1588 1588 session sufficient /lib/security/$ISA/pam_unix.so 1589 1589 session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass 1590 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id36 5002"></a>Key Points Learned</h3></div></div></div><p>1590 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id363529"></a>Key Points Learned</h3></div></div></div><p> 1591 1591 The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you 1592 1592 learned how to integrate such servers so that the UID/GID mappings they use can be consistent … … 1608 1608 On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for identity management 1609 1609 and PAM is responsible for authentication of logon credentials (username and password). 1610 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 5047"></a>Questions and Answers</h2></div></div></div><p>1610 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id363573"></a>Questions and Answers</h2></div></div></div><p> 1611 1611 The following questions were obtained from the mailing list and also from private discussions 1612 1612 with Windows network administrators. 1613 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id36 5057"></a><dl><dt> <a href="unixclients.html#id365063">1613 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id363583"></a><dl><dt> <a href="unixclients.html#id363590"> 1614 1614 We use NIS for all UNIX accounts. Why do we need winbind? 1615 </a></dt><dt> <a href="unixclients.html#id36 5171">1615 </a></dt><dt> <a href="unixclients.html#id363697"> 1616 1616 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1617 1617 Which is better? 1618 </a></dt><dt> <a href="unixclients.html#id36 5244">1618 </a></dt><dt> <a href="unixclients.html#id363771"> 1619 1619 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1620 1620 to use NIS in place of LDAP? 1621 </a></dt><dt> <a href="unixclients.html#id36 5348">1621 </a></dt><dt> <a href="unixclients.html#id363875"> 1622 1622 Are you suggesting that users should not log on to a domain member server? If so, why? 1623 </a></dt><dt> <a href="unixclients.html#id36 5457">1623 </a></dt><dt> <a href="unixclients.html#id363984"> 1624 1624 We want to ensure that only users from our own domain plus from trusted domains can use our 1625 1625 Samba servers. In the smb.conf file on all servers, we have enabled the winbind … … 1627 1627 cannot access our servers, and users from Windows clients that are not domain members 1628 1628 can also access our servers. Is this a Samba bug? 1629 </a></dt><dt> <a href="unixclients.html#id36 5622">1629 </a></dt><dt> <a href="unixclients.html#id364148"> 1630 1630 What are the benefits of using LDAP for my domain member servers? 1631 </a></dt><dt> <a href="unixclients.html#id36 5797">1631 </a></dt><dt> <a href="unixclients.html#id364323"> 1632 1632 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1633 1633 my DNS configuration? 1634 </a></dt><dt> <a href="unixclients.html#id36 5944">1634 </a></dt><dt> <a href="unixclients.html#id364471"> 1635 1635 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1636 1636 use Samba-3 with that configuration? 1637 </a></dt><dt> <a href="unixclients.html#id36 5962">1637 </a></dt><dt> <a href="unixclients.html#id364488"> 1638 1638 When I tried to execute net ads join, I got no output. It did not work, so 1639 1639 I think that it failed. I then executed net rpc join and that worked fine. 1640 1640 That is okay, isn't it? 1641 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id36 5063"></a><a name="id365066"></a></td><td align="left" valign="top"><p>1641 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id363590"></a><a name="id363592"></a></td><td align="left" valign="top"><p> 1642 1642 We use NIS for all UNIX accounts. Why do we need winbind? 1643 1643 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1644 <a class="indexterm" name="id36 5077"></a>1645 <a class="indexterm" name="id36 5083"></a>1646 <a class="indexterm" name="id36 5090"></a>1647 <a class="indexterm" name="id36 5097"></a>1648 <a class="indexterm" name="id36 5104"></a>1649 <a class="indexterm" name="id36 5111"></a>1644 <a class="indexterm" name="id363603"></a> 1645 <a class="indexterm" name="id363610"></a> 1646 <a class="indexterm" name="id363617"></a> 1647 <a class="indexterm" name="id363624"></a> 1648 <a class="indexterm" name="id363630"></a> 1649 <a class="indexterm" name="id363637"></a> 1650 1650 You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted 1651 1651 passwords that need to be stored in one of the acceptable passdb backends. … … 1654 1654 SIDs from trusted domains to local UID/GID values. 1655 1655 </p><p> 1656 <a class="indexterm" name="id36 5135"></a>1657 <a class="indexterm" name="id36 5142"></a>1656 <a class="indexterm" name="id363662"></a> 1657 <a class="indexterm" name="id363669"></a> 1658 1658 On a domain member server, you effectively map Windows domain users to local users 1659 1659 that are in your NIS database by specifying the <em class="parameter"><code>winbind trusted domains … … 1663 1663 </p><p> 1664 1664 As a general rule, it is always a good idea to run winbind on all Samba servers. 1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5171"></a><a name="id365173"></a></td><td align="left" valign="top"><p>1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id363697"></a><a name="id363700"></a></td><td align="left" valign="top"><p> 1666 1666 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1667 Which is better?<a class="indexterm" name="id36 5178"></a>1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5193"></a><a class="indexterm" name="id365204"></a><a class="indexterm" name="id365212"></a>1667 Which is better?<a class="indexterm" name="id363705"></a> 1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id363719"></a><a class="indexterm" name="id363730"></a><a class="indexterm" name="id363738"></a> 1669 1669 Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos 1670 1670 infrastructure. Most IT managers who object to LDAP do so because … … 1673 1673 devise the backup and recovery facilities in a site-dependent manner. LDAP servers 1674 1674 in general are seen as a high-energy, high-risk facility. 1675 </p><p><a class="indexterm" name="id36 5227"></a>1675 </p><p><a class="indexterm" name="id363754"></a> 1676 1676 Microsoft Active Directory by comparison is easy to install and configure and 1677 1677 is supplied with all tools necessary to implement and manage the directory. For sites … … 1682 1682 consider the options. On the other hand, if management just wants a solution that works, 1683 1683 Microsoft Active Directory is a good solution. 1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5244"></a><a name="id365247"></a></td><td align="left" valign="top"><p>1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id363771"></a><a name="id363773"></a></td><td align="left" valign="top"><p> 1685 1685 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1686 1686 to use NIS in place of LDAP? 1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5257"></a><a class="indexterm" name="id365265"></a><a class="indexterm" name="id365273"></a><a class="indexterm" name="id365281"></a><a class="indexterm" name="id365289"></a><a class="indexterm" name="id365296"></a><a class="indexterm" name="id365304"></a>1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id363784"></a><a class="indexterm" name="id363792"></a><a class="indexterm" name="id363799"></a><a class="indexterm" name="id363807"></a><a class="indexterm" name="id363815"></a><a class="indexterm" name="id363823"></a><a class="indexterm" name="id363831"></a> 1688 1688 Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping 1689 1689 the Windows (SMB) encrypted passwords database correctly synchronized across the entire … … 1691 1691 membership secure account password. How can you keep changes that are on remote BDCs 1692 1692 synchronized on the PDC? 1693 </p><p><a class="indexterm" name="id36 5318"></a><a class="indexterm" name="id365326"></a><a class="indexterm" name="id365334"></a>1693 </p><p><a class="indexterm" name="id363845"></a><a class="indexterm" name="id363853"></a><a class="indexterm" name="id363860"></a> 1694 1694 LDAP is a more elegant solution because it permits centralized storage and management 1695 1695 of all network identities (user, group, and machine accounts) together with all information 1696 1696 Samba needs to provide to network clients and their users. 1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5348"></a><a name="id365350"></a></td><td align="left" valign="top"><p>1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id363875"></a><a name="id363877"></a></td><td align="left" valign="top"><p> 1698 1698 Are you suggesting that users should not log on to a domain member server? If so, why? 1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5361"></a><a class="indexterm" name="id365369"></a><a class="indexterm" name="id365380"></a>1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id363887"></a><a class="indexterm" name="id363895"></a><a class="indexterm" name="id363907"></a> 1700 1700 Many UNIX administrators mock the model that the personal computer industry has adopted 1701 1701 as normative since the early days of Novell NetWare. The old … … 1703 1703 fears concerning the security and integrity of data. It was a simple and generally 1704 1704 effective measure to keep users away from servers, except through mapped drives. 1705 </p><p><a class="indexterm" name="id36 5395"></a><a class="indexterm" name="id365403"></a><a class="indexterm" name="id365410"></a><a class="indexterm" name="id365418"></a><a class="indexterm" name="id365426"></a>1705 </p><p><a class="indexterm" name="id363921"></a><a class="indexterm" name="id363929"></a><a class="indexterm" name="id363937"></a><a class="indexterm" name="id363945"></a><a class="indexterm" name="id363953"></a> 1706 1706 UNIX administrators are fully correct in asserting that UNIX servers and workstations 1707 1707 are identical in terms of the software that is installed. They correctly assert that … … 1712 1712 Only then can one begin to appraise the best strategy and adopt a site-specific 1713 1713 policy that best protects the needs of users and of the organization alike. 1714 </p><p><a class="indexterm" name="id36 5443"></a>1714 </p><p><a class="indexterm" name="id363969"></a> 1715 1715 From experience, it is my recommendation to keep general system-level logins to a 1716 1716 practical minimum and to eliminate them if possible. This should not be taken as a 1717 1717 hard rule, though. The better question is, what works best for the site? 1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5457"></a><a name="id365459"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id365462"></a><a class="indexterm" name="id365470"></a><a class="indexterm" name="id365482"></a><a class="indexterm" name="id365490"></a>1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id363984"></a><a name="id363986"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id363989"></a><a class="indexterm" name="id363997"></a><a class="indexterm" name="id364008"></a><a class="indexterm" name="id364016"></a> 1719 1719 We want to ensure that only users from our own domain plus from trusted domains can use our 1720 1720 Samba servers. In the <code class="filename">smb.conf</code> file on all servers, we have enabled the <em class="parameter"><code>winbind … … 1722 1722 cannot access our servers, and users from Windows clients that are not domain members 1723 1723 can also access our servers. Is this a Samba bug? 1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5519"></a><a class="indexterm" name="id365527"></a><a class="indexterm" name="id365534"></a><a class="indexterm" name="id365542"></a><a class="indexterm" name="id365550"></a><a class="indexterm" name="id365558"></a>1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364045"></a><a class="indexterm" name="id364053"></a><a class="indexterm" name="id364061"></a><a class="indexterm" name="id364069"></a><a class="indexterm" name="id364077"></a><a class="indexterm" name="id364084"></a> 1725 1725 The manual page for this <em class="parameter"><code>winbind trusted domains only</code></em> parameter says, 1726 1726 <span class="quote">“<span class="quote">This parameter is designed to allow Samba servers that are members of a Samba-controlled … … 1730 1730 of allocating a new UID for him or her.</span>”</span> This clearly suggests that you are trying 1731 1731 to use this parameter inappropriately. 1732 </p><p><a class="indexterm" name="id36 5596"></a>1732 </p><p><a class="indexterm" name="id364122"></a> 1733 1733 A far better solution is to use the <em class="parameter"><code>valid users</code></em> by specifying 1734 1734 precisely the domain users and groups that should be permitted access to the shares. You could, … … 1739 1739 valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users" 1740 1740 </pre><p> 1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5622"></a><a name="id365624"></a></td><td align="left" valign="top"><p>1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364148"></a><a name="id364150"></a></td><td align="left" valign="top"><p> 1742 1742 What are the benefits of using LDAP for my domain member servers? 1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5634"></a><a class="indexterm" name="id365642"></a><a class="indexterm" name="id365650"></a><a class="indexterm" name="id365657"></a><a class="indexterm" name="id365665"></a><a class="indexterm" name="id365673"></a><a class="indexterm" name="id365681"></a><a class="indexterm" name="id365689"></a><a class="indexterm" name="id365696"></a>1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364161"></a><a class="indexterm" name="id364168"></a><a class="indexterm" name="id364176"></a><a class="indexterm" name="id364184"></a><a class="indexterm" name="id364192"></a><a class="indexterm" name="id364199"></a><a class="indexterm" name="id364207"></a><a class="indexterm" name="id364215"></a><a class="indexterm" name="id364223"></a> 1744 1744 The key benefit of using LDAP is that the UID of all users and the GID of all groups 1745 1745 are globally consistent on domain controllers as well as on domain member servers. 1746 1746 This means that it is possible to copy/replicate files across servers without 1747 1747 loss of identity. 1748 </p><p><a class="indexterm" name="id36 5710"></a><a class="indexterm" name="id365718"></a><a class="indexterm" name="id365726"></a><a class="indexterm" name="id365734"></a><a class="indexterm" name="id365741"></a><a class="indexterm" name="id365749"></a><a class="indexterm" name="id365761"></a><a class="indexterm" name="id365768"></a>1748 </p><p><a class="indexterm" name="id364236"></a><a class="indexterm" name="id364244"></a><a class="indexterm" name="id364252"></a><a class="indexterm" name="id364260"></a><a class="indexterm" name="id364268"></a><a class="indexterm" name="id364276"></a><a class="indexterm" name="id364287"></a><a class="indexterm" name="id364295"></a> 1749 1749 When use is made of account identity resolution via winbind, even when an IDMAP backend 1750 1750 is stored in LDAP, the UID/GID on domain member servers is consistent, but differs … … 1753 1753 idmap uid/gid</code></em> in the <code class="filename">smb.conf</code> file. On domain controllers, the UID/GID is 1754 1754 that of the POSIX value assigned in the LDAP directory as part of the POSIX account information. 1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5797"></a><a name="id365799"></a></td><td align="left" valign="top"><p>1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364323"></a><a name="id364325"></a></td><td align="left" valign="top"><p> 1756 1756 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1757 1757 my DNS configuration? 1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 5810"></a><a class="indexterm" name="id365821"></a><a class="indexterm" name="id365832"></a><a class="indexterm" name="id365840"></a><a class="indexterm" name="id365847"></a><a class="indexterm" name="id365855"></a><a class="indexterm" name="id365863"></a>1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364336"></a><a class="indexterm" name="id364347"></a><a class="indexterm" name="id364358"></a><a class="indexterm" name="id364366"></a><a class="indexterm" name="id364374"></a><a class="indexterm" name="id364382"></a><a class="indexterm" name="id364389"></a> 1759 1759 Samba depends on correctly functioning resolution of hostnames to their IP address. Samba 1760 1760 makes no direct DNS lookup calls, but rather redirects all name-to-address calls via the … … 1769 1769 If this fails to resolve, it attempts a DNS lookup, and if that fails, it tries a 1770 1770 WINS lookup. 1771 </p><p><a class="indexterm" name="id36 5913"></a><a class="indexterm" name="id365920"></a><a class="indexterm" name="id365928"></a>1771 </p><p><a class="indexterm" name="id364439"></a><a class="indexterm" name="id364447"></a><a class="indexterm" name="id364455"></a> 1772 1772 The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has 1773 1773 been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS … … 1776 1776 case, the Windows 200x autoregisters all locator records it needs with its own DNS 1777 1777 server or servers. 1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5944"></a><a name="id365947"></a></td><td align="left" valign="top"><p>1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364471"></a><a name="id364473"></a></td><td align="left" valign="top"><p> 1779 1779 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1780 1780 use Samba-3 with that configuration? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1782 1782 Yes. 1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id36 5962"></a><a name="id365964"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id365967"></a><a class="indexterm" name="id365982"></a>1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364488"></a><a name="id364491"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364494"></a><a class="indexterm" name="id364508"></a> 1784 1784 When I tried to execute net ads join, I got no output. It did not work, so 1785 1785 I think that it failed. I then executed net rpc join and that worked fine. 1786 1786 That is okay, isn't it? 1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id36 6004"></a><a class="indexterm" name="id366012"></a>1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364530"></a><a class="indexterm" name="id364538"></a> 1788 1788 No. This is not okay. It means that your Samba-3 client has joined the ADS domain as 1789 1789 a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication. -
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/upgrades.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 8. Updating Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id36 6117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id36 6043"></a>3 <a class="indexterm" name="id36 6050"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 8. Updating Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id364642">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id364726">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id365940">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366282">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366596">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id366712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366809">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id366993">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367371">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id364568"></a> 3 <a class="indexterm" name="id364575"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id36 6063"></a>11 <a class="indexterm" name="id36 6070"></a>10 <a class="indexterm" name="id364588"></a> 11 <a class="indexterm" name="id364595"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id36 6088"></a>20 <a class="indexterm" name="id364613"></a> 21 21 I like the <span class="quote">“<span class="quote">net rpc vampire</span>”</span> on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id36 6107"></a>25 <a class="indexterm" name="id364633"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 6117"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id36 6125"></a>31 <a class="indexterm" name="id36 6131"></a>32 <a class="indexterm" name="id36 6138"></a>29 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364642"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id364650"></a> 31 <a class="indexterm" name="id364657"></a> 32 <a class="indexterm" name="id364664"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 34 planning to make and followed with the question: <span class="quote">“<span class="quote">Anyone done this … … 45 45 productivity on them. 46 46 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id36 6163"></a>48 <a class="indexterm" name="id36 6170"></a>47 <a class="indexterm" name="id364688"></a> 48 <a class="indexterm" name="id364695"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id36 6182"></a>55 <a class="indexterm" name="id36 6189"></a>54 <a class="indexterm" name="id364708"></a> 55 <a class="indexterm" name="id364714"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" title="Cautions and Notes"><div class="titlepage"><div><div><h3 class="title"><a name="id36 6200"></a>Cautions and Notes</h3></div></div></div><p>62 </p><div class="sect2" title="Cautions and Notes"><div class="titlepage"><div><div><h3 class="title"><a name="id364726"></a>Cautions and Notes</h3></div></div></div><p> 63 63 Someone once said, <span class="quote">“<span class="quote">It is good to be sorry, but better never to need to be!</span>”</span> 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id36 6216"></a>67 <a class="indexterm" name="id36 6223"></a>68 <a class="indexterm" name="id36 6230"></a>66 <a class="indexterm" name="id364742"></a> 67 <a class="indexterm" name="id364749"></a> 68 <a class="indexterm" name="id364755"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id36 6254"></a>76 <a class="indexterm" name="id364779"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id36 6269"></a>81 <a class="indexterm" name="id364795"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 91 91 noone can read it!</span>”</span> While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" title="Security Identifiers (SIDs)"><div class="titlepage"><div><div><h4 class="title"><a name="id36 6291"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id36 6298"></a>95 <a class="indexterm" name="id36 6308"></a>96 <a class="indexterm" name="id36 6315"></a>97 <a class="indexterm" name="id36 6322"></a>98 <a class="indexterm" name="id36 6328"></a>99 <a class="indexterm" name="id36 6337"></a>93 </p><div class="sect3" title="Security Identifiers (SIDs)"><div class="titlepage"><div><div><h4 class="title"><a name="id364816"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id364824"></a> 95 <a class="indexterm" name="id364833"></a> 96 <a class="indexterm" name="id364840"></a> 97 <a class="indexterm" name="id364847"></a> 98 <a class="indexterm" name="id364854"></a> 99 <a class="indexterm" name="id364863"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id36 6353"></a>108 <a class="indexterm" name="id36 6360"></a>109 <a class="indexterm" name="id36 6367"></a>110 <a class="indexterm" name="id36 6374"></a>111 <a class="indexterm" name="id36 6380"></a>112 <a class="indexterm" name="id36 6387"></a>107 <a class="indexterm" name="id364879"></a> 108 <a class="indexterm" name="id364886"></a> 109 <a class="indexterm" name="id364893"></a> 110 <a class="indexterm" name="id364900"></a> 111 <a class="indexterm" name="id364906"></a> 112 <a class="indexterm" name="id364913"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id36 6402"></a>118 <a class="indexterm" name="id36 6409"></a>119 <a class="indexterm" name="id36 6415"></a>117 <a class="indexterm" name="id364927"></a> 118 <a class="indexterm" name="id364934"></a> 119 <a class="indexterm" name="id364941"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id36 6433"></a>125 <a class="indexterm" name="id36 6440"></a>126 <a class="indexterm" name="id36 6446"></a>124 <a class="indexterm" name="id364958"></a> 125 <a class="indexterm" name="id364965"></a> 126 <a class="indexterm" name="id364972"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id36 6464"></a>133 <a class="indexterm" name="id36 6474"></a>134 <a class="indexterm" name="id36 6483"></a>135 <a class="indexterm" name="id36 6489"></a>132 <a class="indexterm" name="id364990"></a> 133 <a class="indexterm" name="id364999"></a> 134 <a class="indexterm" name="id365008"></a> 135 <a class="indexterm" name="id365015"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id36 6501"></a>142 <a class="indexterm" name="id36 6508"></a>143 <a class="indexterm" name="id36 6515"></a>144 <a class="indexterm" name="id36 6522"></a>145 <a class="indexterm" name="id36 6529"></a>146 <a class="indexterm" name="id36 6535"></a>141 <a class="indexterm" name="id365027"></a> 142 <a class="indexterm" name="id365034"></a> 143 <a class="indexterm" name="id365041"></a> 144 <a class="indexterm" name="id365048"></a> 145 <a class="indexterm" name="id365055"></a> 146 <a class="indexterm" name="id365061"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id36 6580"></a>156 <a class="indexterm" name="id365106"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles … … 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id36 6598"></a>166 <a class="indexterm" name="id36 6604"></a>167 <a class="indexterm" name="id36 6611"></a>168 <a class="indexterm" name="id36 6617"></a>169 <a class="indexterm" name="id36 6624"></a>170 <a class="indexterm" name="id36 6631"></a>171 <a class="indexterm" name="id36 6638"></a>172 <a class="indexterm" name="id36 6645"></a>173 <a class="indexterm" name="id36 6651"></a>174 <a class="indexterm" name="id36 6658"></a>165 <a class="indexterm" name="id365124"></a> 166 <a class="indexterm" name="id365131"></a> 167 <a class="indexterm" name="id365137"></a> 168 <a class="indexterm" name="id365144"></a> 169 <a class="indexterm" name="id365151"></a> 170 <a class="indexterm" name="id365157"></a> 171 <a class="indexterm" name="id365164"></a> 172 <a class="indexterm" name="id365171"></a> 173 <a class="indexterm" name="id365178"></a> 174 <a class="indexterm" name="id365184"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id36 6670"></a>180 <a class="indexterm" name="id36 6679"></a>179 <a class="indexterm" name="id365196"></a> 180 <a class="indexterm" name="id365205"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id36 6761"></a>203 <a class="indexterm" name="id365287"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id36 6829"></a>221 <a class="indexterm" name="id36 6835"></a>220 <a class="indexterm" name="id365355"></a> 221 <a class="indexterm" name="id365362"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id36 6877"></a>241 <a class="indexterm" name="id36 6884"></a>242 <a class="indexterm" name="id36 6891"></a>240 <a class="indexterm" name="id365404"></a> 241 <a class="indexterm" name="id365410"></a> 242 <a class="indexterm" name="id365417"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id36 6922"></a>254 <a class="indexterm" name="id36 6929"></a>255 <a class="indexterm" name="id36 6936"></a>253 <a class="indexterm" name="id365449"></a> 254 <a class="indexterm" name="id365455"></a> 255 <a class="indexterm" name="id365462"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" title="Change of hostname"><div class="titlepage"><div><div><h4 class="title"><a name="id36 6964"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id36 6972"></a>266 <a class="indexterm" name="id36 6981"></a>264 </p></div><div class="sect3" title="Change of hostname"><div class="titlepage"><div><div><h4 class="title"><a name="id365491"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id365499"></a> 266 <a class="indexterm" name="id365508"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" title="Change of Workgroup (Domain) Name"><div class="titlepage"><div><div><h4 class="title"><a name="id36 7023"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id36 7030"></a>280 </p></div></div><div class="sect3" title="Change of Workgroup (Domain) Name"><div class="titlepage"><div><div><h4 class="title"><a name="id365549"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id365557"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id36 7054"></a>286 <a class="indexterm" name="id365580"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id36 7081"></a>295 <a class="indexterm" name="id365608"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id36 7126"></a>303 <a class="indexterm" name="id365653"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id36 7154"></a>308 <a class="indexterm" name="id365681"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id36 7209"></a>320 <a class="indexterm" name="id365736"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id36 7238"></a>351 <a class="indexterm" name="id365765"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" title="International Language Support"><div class="titlepage"><div><div><h4 class="title"><a name="id36 7266"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id36 7273"></a>359 <a class="indexterm" name="id36 7280"></a>360 <a class="indexterm" name="id36 7287"></a>361 <a class="indexterm" name="id36 7294"></a>357 </p></div><div class="sect3" title="International Language Support"><div class="titlepage"><div><div><h4 class="title"><a name="id365792"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id365800"></a> 359 <a class="indexterm" name="id365807"></a> 360 <a class="indexterm" name="id365814"></a> 361 <a class="indexterm" name="id365821"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id36 7306"></a>366 <a class="indexterm" name="id365833"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id36 7320"></a>372 <a class="indexterm" name="id365846"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id36 7332"></a>377 <a class="indexterm" name="id365859"></a> 378 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" title="Updates and Changes in Idealx smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="id36 7349"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" title="Updates and Changes in Idealx smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="id365876"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" title="Upgrading from Samba 1.x and 2.x to Samba-3"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 7413"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" title="Upgrading from Samba 1.x and 2.x to Samba-3"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id365940"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure" title="Procedure 8.1. Upgrading from a Pre-Samba-3 Version"><a name="id36 7444"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>409 <a class="indexterm" name="id36 7455"></a>410 <a class="indexterm" name="id36 7462"></a>411 <a class="indexterm" name="id36 7468"></a>408 </p><div class="procedure" title="Procedure 8.1. Upgrading from a Pre-Samba-3 Version"><a name="id365971"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 409 <a class="indexterm" name="id365982"></a> 410 <a class="indexterm" name="id365988"></a> 411 <a class="indexterm" name="id365995"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the … … 424 424 back it up to a safe location. 425 425 </p></li><li class="step" title="Step 5"><p> 426 <a class="indexterm" name="id36 7546"></a>427 <a class="indexterm" name="id36 7553"></a>428 <a class="indexterm" name="id36 7560"></a>429 <a class="indexterm" name="id36 7567"></a>426 <a class="indexterm" name="id366073"></a> 427 <a class="indexterm" name="id366080"></a> 428 <a class="indexterm" name="id366087"></a> 429 <a class="indexterm" name="id366094"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 438 438 tdb files to a safe location. 439 439 </p></li><li class="step" title="Step 6"><p> 440 <a class="indexterm" name="id36 7601"></a>440 <a class="indexterm" name="id366128"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 457 457 Do not change the workgroup name. 458 458 </p></li><li class="step" title="Step 10"><p> 459 <a class="indexterm" name="id36 7650"></a>459 <a class="indexterm" name="id366178"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id36 7704"></a>471 <a class="indexterm" name="id366232"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 474 </p></li><li class="step" title="Step 11"><p> 475 <a class="indexterm" name="id36 7725"></a>475 <a class="indexterm" name="id366252"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" title="Applicable to All Samba 2.x to Samba-3 Upgrades"><div class="titlepage"><div><div><h3 class="title"><a name="id36 7754"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id36 7762"></a>482 <a class="indexterm" name="id36 7769"></a>483 <a class="indexterm" name="id36 7776"></a>480 </p></li></ol></div></div><div class="sect2" title="Applicable to All Samba 2.x to Samba-3 Upgrades"><div class="titlepage"><div><div><h3 class="title"><a name="id366282"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id366290"></a> 482 <a class="indexterm" name="id366296"></a> 483 <a class="indexterm" name="id366303"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id36 7788"></a>489 <a class="indexterm" name="id366315"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id36 7807"></a>494 <a class="indexterm" name="id36 7814"></a>495 <a class="indexterm" name="id36 7821"></a>496 <a class="indexterm" name="id36 7828"></a>497 <a class="indexterm" name="id36 7834"></a>498 <a class="indexterm" name="id36 7841"></a>499 <a class="indexterm" name="id36 7848"></a>493 <a class="indexterm" name="id366335"></a> 494 <a class="indexterm" name="id366341"></a> 495 <a class="indexterm" name="id366348"></a> 496 <a class="indexterm" name="id366355"></a> 497 <a class="indexterm" name="id366362"></a> 498 <a class="indexterm" name="id366369"></a> 499 <a class="indexterm" name="id366376"></a> 500 500 </p><p> 501 501 </p><table border="0" summary="Simple list" class="simplelist"><tr><td>add group script</td></tr><tr><td>add machine script</td></tr><tr><td>add user to group script</td></tr><tr><td>delete group script</td></tr><tr><td>delete user from group script</td></tr><tr><td>passdb backend</td></tr><tr><td>set primary group script</td></tr></table><p> 502 502 </p><p> 503 <a class="indexterm" name="id36 7892"></a>504 <a class="indexterm" name="id36 7898"></a>503 <a class="indexterm" name="id366419"></a> 504 <a class="indexterm" name="id366426"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id36 7921"></a>510 <a class="indexterm" name="id36 7928"></a>511 <a class="indexterm" name="id36 7935"></a>512 <a class="indexterm" name="id36 7942"></a>513 <a class="indexterm" name="id36 7948"></a>514 <a class="indexterm" name="id36 7955"></a>515 <a class="indexterm" name="id36 7962"></a>516 <a class="indexterm" name="id36 7969"></a>517 <a class="indexterm" name="id36 7976"></a>509 <a class="indexterm" name="id366449"></a> 510 <a class="indexterm" name="id366456"></a> 511 <a class="indexterm" name="id366462"></a> 512 <a class="indexterm" name="id366469"></a> 513 <a class="indexterm" name="id366476"></a> 514 <a class="indexterm" name="id366483"></a> 515 <a class="indexterm" name="id366490"></a> 516 <a class="indexterm" name="id366496"></a> 517 <a class="indexterm" name="id366503"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id36 8035"></a>525 <a class="indexterm" name="id36 8042"></a>526 <a class="indexterm" name="id36 8048"></a>524 <a class="indexterm" name="id366562"></a> 525 <a class="indexterm" name="id366569"></a> 526 <a class="indexterm" name="id366576"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" title="Samba-2.x with LDAP Support"><div class="titlepage"><div><div><h3 class="title"><a name="id36 8069"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" title="Samba-2.x with LDAP Support"><div class="titlepage"><div><div><h3 class="title"><a name="id366596"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id36 8099"></a>542 <a class="indexterm" name="id36 8106"></a>541 <a class="indexterm" name="id366627"></a> 542 <a class="indexterm" name="id366634"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" title="Updating a Samba-3 Installation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id36 8184"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" title="Updating a Samba-3 Installation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id366712"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id36 8197"></a>703 <a class="indexterm" name="id366725"></a> 704 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on … … 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id36 8220"></a>709 <a class="indexterm" name="id366748"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id36 8248"></a>722 <a class="indexterm" name="id366776"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id36 8261"></a>729 <a class="indexterm" name="id36 8268"></a>728 <a class="indexterm" name="id366789"></a> 729 <a class="indexterm" name="id366796"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" title="Samba-3 to Samba-3 Updates on the Same Server"><div class="titlepage"><div><div><h3 class="title"><a name="id36 8281"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" title="Samba-3 to Samba-3 Updates on the Same Server"><div class="titlepage"><div><div><h3 class="title"><a name="id366809"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" title="Updating from Samba Versions Earlier than 3.0.5"><div class="titlepage"><div><div><h4 class="title"><a name="id36 8291"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" title="Updating from Samba Versions Earlier than 3.0.5"><div class="titlepage"><div><div><h4 class="title"><a name="id366819"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" title="Updating from Samba Versions between 3.0.6 and 3.0.10"><div class="titlepage"><div><div><h4 class="title"><a name="id36 8310"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id36 8318"></a>747 <a class="indexterm" name="id36 8324"></a>745 </p></div><div class="sect3" title="Updating from Samba Versions between 3.0.6 and 3.0.10"><div class="titlepage"><div><div><h4 class="title"><a name="id366838"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id366846"></a> 747 <a class="indexterm" name="id366852"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id36 8339"></a>754 <a class="indexterm" name="id36 8346"></a>755 <a class="indexterm" name="id36 8352"></a>753 <a class="indexterm" name="id366867"></a> 754 <a class="indexterm" name="id366874"></a> 755 <a class="indexterm" name="id366880"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" title="Updating from Samba Versions after 3.0.6 to a Current Release"><div class="titlepage"><div><div><h4 class="title"><a name="id36 8384"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id36 8392"></a>762 </p></div><div class="sect3" title="Updating from Samba Versions after 3.0.6 to a Current Release"><div class="titlepage"><div><div><h4 class="title"><a name="id366912"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id366920"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id36 8421"></a>769 <a class="indexterm" name="id366949"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" title="Migrating Samba-3 to a New Server"><div class="titlepage"><div><div><h3 class="title"><a name="id36 8465"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" title="Migrating Samba-3 to a New Server"><div class="titlepage"><div><div><h3 class="title"><a name="id366993"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" title="Replacing a Domain Member Server"><div class="titlepage"><div><div><h4 class="title"><a name="id36 8475"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id36 8483"></a>795 </p><div class="sect3" title="Replacing a Domain Member Server"><div class="titlepage"><div><div><h4 class="title"><a name="id367004"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id367012"></a> 797 797 Replacement of a domain member server should be done 798 798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id36 8506"></a>806 <a class="indexterm" name="id36 8512"></a>807 <a class="indexterm" name="id36 8519"></a>808 <a class="indexterm" name="id36 8526"></a>809 <a class="indexterm" name="id36 8532"></a>810 <a class="indexterm" name="id36 8539"></a>805 <a class="indexterm" name="id367034"></a> 806 <a class="indexterm" name="id367041"></a> 807 <a class="indexterm" name="id367047"></a> 808 <a class="indexterm" name="id367054"></a> 809 <a class="indexterm" name="id367061"></a> 810 <a class="indexterm" name="id367068"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id36 8583"></a>821 <a class="indexterm" name="id36 8589"></a>822 <a class="indexterm" name="id36 8596"></a>823 <a class="indexterm" name="id36 8603"></a>820 <a class="indexterm" name="id367111"></a> 821 <a class="indexterm" name="id367118"></a> 822 <a class="indexterm" name="id367125"></a> 823 <a class="indexterm" name="id367131"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id36 8648"></a>834 <a class="indexterm" name="id367176"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" title="Replacing a Domain Controller"><div class="titlepage"><div><div><h4 class="title"><a name="id36 8664"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id36 8672"></a>839 </p></div><div class="sect3" title="Replacing a Domain Controller"><div class="titlepage"><div><div><h4 class="title"><a name="id367193"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id367201"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" title="Migration of Samba Accounts to Active Directory"><div class="titlepage"><div><div><h3 class="title"><a name="id36 8842"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" title="Migration of Samba Accounts to Active Directory"><div class="titlepage"><div><div><h3 class="title"><a name="id367371"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure" title="Procedure 8.2. Migration to Active Directory"><a name="id36 8853"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>896 </p><div class="procedure" title="Procedure 8.2. Migration to Active Directory"><a name="id367381"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 915 915 workstations won't be migrated to the new domain. 916 916 </p></li><li class="step" title="Step 5"><p> 917 <a class="indexterm" name="id36 8911"></a>917 <a class="indexterm" name="id367439"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id36 8925"></a>925 <a class="indexterm" name="id367454"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD.
Note:
See TracChangeset
for help on using the changeset viewer.
