Ignore:
Timestamp:
Nov 14, 2012, 12:59:34 PM (13 years ago)
Author:
Silvan Scherrer
Message:

Samba Server: update vendor to 3.6.0

Location:
vendor/current/docs-xml/smbdotconf
Files:
15 added
3 deleted
18 edited

Legend:

Unmodified
Added
Removed

  • vendor/current/docs-xml/smbdotconf/locking/posixlocking.xml

    r414 r740  
    99        to map this internal database to POSIX locks. This means that file locks obtained by SMB clients are
    1010        consistent with those seen by POSIX compliant applications accessing the files via a non-SMB
    11         method (e.g. NFS or local file access). You should never need to disable this parameter.
     11        method (e.g. NFS or local file access). It is very unlikely that you need to set this parameter
     12        to "no", unless you are sharing from an NFS mount, which is not a good idea in the first place.
    1213        </para>
    1314</description>

  • vendor/current/docs-xml/smbdotconf/logon/enableprivileges.xml

    r414 r740  
    66<description>
    77        <para>
    8         This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
     8        This deprecated parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
    99         <command>net rpc rights</command> or one of the Windows user and group manager tools.  This parameter is
    1010        enabled by default. It can be disabled to prevent members of the Domain Admins group from being able to

  • vendor/current/docs-xml/smbdotconf/misc/timeoffset.xml

    r414 r740  
    55                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    7         <para>This parameter is a setting in minutes to add
     7        <para>This deprecated parameter is a setting in minutes to add
    88        to the normal GMT to local time conversion. This is useful if
    99        you are serving a lot of PCs that have incorrect daylight
    1010        saving time handling.</para>
     11
     12        <note><para>This option is deprecated, and will be removed in the next major release</para></note>
    1113</description>
    1214

  • vendor/current/docs-xml/smbdotconf/printing/addportcommand.xml

    r414 r740  
    1616    </itemizedlist>
    1717               
    18     <para>The deviceURI is in the for of socket://&lt;hostname&gt;[:&lt;portnumber&gt;]
     18    <para>The deviceURI is in the format of socket://&lt;hostname&gt;[:&lt;portnumber&gt;]
    1919        or lpd://&lt;hostname&gt;/&lt;queuename&gt;.</para>
    2020</description>

  • vendor/current/docs-xml/smbdotconf/printing/printcapcachetime.xml

    r414 r740  
    66<description>
    77    <para>This option specifies the number of seconds before the printing
    8     subsystem is again asked for the known printers.  If the value
    9     is greater than 60 the initial waiting time is set to 60 seconds
    10     to allow an earlier first rescan of the printing subsystem.
     8    subsystem is again asked for the known printers.
    119    </para>
    1210

  • vendor/current/docs-xml/smbdotconf/protocol/usespnego.xml

    r414 r740  
    55                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    7     <para>This variable controls controls whether samba will try
     7    <para>This deprecated variable controls controls whether samba will try
    88    to use Simple and Protected NEGOciation (as specified by rfc2478) with
    99    WindowsXP and Windows2000 clients to agree upon an authentication mechanism.

  • vendor/current/docs-xml/smbdotconf/security/clientntlmv2auth.xml

    r414 r740  
    1111
    1212    <para>If enabled, only an NTLMv2 and LMv2 response (both much more
    13     secure than earlier versions) will be sent.  Many servers
     13    secure than earlier versions) will be sent.  Older servers
    1414    (including NT4 &lt; SP4, Win9x and Samba 2.2) are not compatible with
    15     NTLMv2.  </para>
     15    NTLMv2 when not in an NTLMv2 supporting domain</para>
    1616
    1717    <para>Similarly, if enabled, NTLMv1, <command
    … …  
    2525    moreinfo="none">client lanman auth</command>.  </para>
    2626
    27     <para>Note that some sites (particularly
    28     those following 'best practice' security polices) only allow NTLMv2
    29         responses, and not the weaker LM or NTLM.</para>
     27    <para>Note that Windows Vista and later versions already use
     28    NTLMv2 by default, and some sites (particularly those following
     29    'best practice' security polices) only allow NTLMv2 responses, and
     30    not the weaker LM or NTLM.</para>
    3031</description>
    31 <value type="default">no</value>
     32<value type="default">yes</value>
    3233</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/guestok.xml

    r414 r740  
    1010    Privileges will be those of the <smbconfoption name="guest account"/>.</para>
    1111
    12     <para>This paramater nullifies the benifits of setting
     12    <para>This parameter nullifies the benefits of setting
    1313    <smbconfoption name="restrict anonymous">2</smbconfoption>
    1414        </para>

  • vendor/current/docs-xml/smbdotconf/security/passwordlevel.xml

    r414 r740  
    1414    negotiation request/response.</para>
    1515
    16     <para>This parameter defines the maximum number of characters
     16    <para>This deprecated parameter defines the maximum number of characters
    1717    that may be upper case in passwords.</para>
    1818

  • vendor/current/docs-xml/smbdotconf/security/passwordserver.xml

    r414 r740  
    1111    to do all its username/password validation using a specific remote server.</para>
    1212
    13     <para>This option sets the name or IP address of the password server to use.
    14     New syntax has been added to support defining the port to use when connecting
    15     to the server the case of an ADS realm.  To define a port other than the
    16     default LDAP port of 389, add the port number using a colon after the
    17     name or IP address (e.g. 192.168.1.100:389).  If you do not specify a port,
    18     Samba will use the standard LDAP port of tcp/389.  Note that port numbers
    19     have no effect on password servers for Windows NT 4.0 domains or netbios
    20     connections.</para>
     13    <para>If the <parameter moreinfo="none">security</parameter> parameter is set to
     14    <constant>domain</constant> or <constant>ads</constant>, then this option
     15    <emphasis>should not</emphasis> be used, as the default '*' indicates to Samba
     16    to determine the best DC to contact dynamically, just as all other hosts in an
     17    AD domain do.  This allows the domain to be maintained without modification to
     18    the smb.conf file.  The cryptograpic protection on the authenticated RPC calls
     19    used to verify passwords ensures that this default is safe.</para>
    2120
    22     <para>If parameter is a name, it is looked up using the
    23     parameter <smbconfoption name="name resolve order"/> and so may resolved
    24     by any method and order described in that parameter.</para>
    25 
    26     <para>The password server must be a machine capable of using
    27     the &quot;LM1.2X002&quot; or the &quot;NT LM 0.12&quot; protocol, and it must be in
    28     user level security mode.</para>
    29 
    30     <note><para>Using a password server  means your UNIX box (running
    31     Samba) is only as secure as your  password server. <emphasis>DO NOT
    32     CHOOSE A PASSWORD SERVER THAT  YOU DON'T COMPLETELY TRUST</emphasis>.
    33     </para></note>
    34                
    35     <para>Never point a Samba server at itself for password serving.
    36     This will cause a loop and could lock up your Samba  server!</para>
    37 
    38     <para>The name of the password server takes the standard
    39     substitutions, but probably the only useful one is <parameter moreinfo="none">%m
    40     </parameter>, which means the Samba server will use the incoming
    41     client as the password server. If you use this then you better
    42     trust your clients, and you had better restrict them with hosts allow!</para>
    43 
    44     <para>If the <parameter moreinfo="none">security</parameter> parameter is set to
    45     <constant>domain</constant> or <constant>ads</constant>, then the list of machines in this
    46     option must be a list of Primary or Backup Domain controllers for the
    47     Domain or the character '*', as the Samba server is effectively
    48     in that domain, and will use cryptographically authenticated RPC calls
    49     to authenticate the user logging on. The advantage of using <command moreinfo="none">
    50     security = domain</command> is that if you list several hosts in the
    51     <parameter moreinfo="none">password server</parameter> option then <command moreinfo="none">smbd
    52     </command> will try each in turn till it finds one that responds.  This
    53     is useful in case your primary server goes down.</para>
    54 
    55     <para>If the <parameter moreinfo="none">password server</parameter> option is set
    56     to the character '*', then Samba will attempt to auto-locate the
    57     Primary or Backup Domain controllers to authenticate against by
    58     doing a query for the name <constant>WORKGROUP&lt;1C&gt;</constant>
    59     and then contacting each server returned in the list of IP
    60     addresses from the name resolution source. </para>
     21    <para><emphasis>It is strongly recommended that you use the
     22    default of '*'</emphasis>, however if in your particular
     23    environment you have reason to specify a particular DC list, then
     24    the list of machines in this option must be a list of names or IP
     25    addresses of Domain controllers for the Domain. If you use the
     26    default of '*', or list several hosts in the <parameter
     27    moreinfo="none">password server</parameter> option then <command
     28    moreinfo="none">smbd </command> will try each in turn till it
     29    finds one that responds.  This is useful in case your primary
     30    server goes down.</para>
    6131
    6232    <para>If the list of servers contains both names/IP's and the '*'
    … …  
    6636    this list by locating the closest DC.</para>
    6737               
     38    <para>If parameter is a name, it is looked up using the
     39    parameter <smbconfoption name="name resolve order"/> and so may resolved
     40    by any method and order described in that parameter.</para>
     41
    6842    <para>If the <parameter moreinfo="none">security</parameter> parameter is
    69     set to <constant>server</constant>, then there are different
    70     restrictions that <command moreinfo="none">security = domain</command> doesn't
    71     suffer from:</para>
     43    set to <constant>server</constant>, these additional restrictions apply:</para>
    7244
    7345    <itemizedlist>
    … …  
    8355           
    8456        <listitem>
    85             <para>If you are using a Windows NT server as your
    86             password server then you will have to ensure that your users
     57            <para>You will have to ensure that your users
    8758            are able to login from the Samba server, as when in <command moreinfo="none">
    8859            security = server</command>  mode the network logon will appear to
    89             come from there rather than from the users workstation.</para>
     60            come from the Samba server rather than from the users workstation.</para>
    9061        </listitem>
     62
     63        <listitem>
     64            <para>The client must not select NTLMv2 authentication.</para>
     65        </listitem>
     66
     67        <listitem>
     68          <para>The password server must be a machine capable of using
     69          the &quot;LM1.2X002&quot; or the &quot;NT LM 0.12&quot; protocol, and it must be in
     70          user level security mode.</para>
     71        </listitem>
     72
     73        <listitem>
     74          <para>Using a password server  means your UNIX box (running
     75          Samba) is only as secure as (a host masqurading as) your password server. <emphasis>DO NOT
     76          CHOOSE A PASSWORD SERVER THAT  YOU DON'T COMPLETELY TRUST</emphasis>.
     77          </para>
     78        </listitem>
     79
     80        <listitem>
     81          <para>Never point a Samba server at itself for password serving.
     82          This will cause a loop and could lock up your Samba  server!</para>
     83        </listitem>
     84
     85        <listitem>
     86          <para>The name of the password server takes the standard
     87          substitutions, but probably the only useful one is <parameter moreinfo="none">%m
     88          </parameter>, which means the Samba server will use the incoming
     89          client as the password server. If you use this then you better
     90          trust your clients, and you had better restrict them with hosts allow!</para>
     91        </listitem>
     92
    9193    </itemizedlist>
    9294</description>

  • vendor/current/docs-xml/smbdotconf/security/security.xml

    r414 r740  
    2323    Windows NT.</para>
    2424
    25     <para>The alternatives are <command moreinfo="none">security = share</command>,
    26     <command moreinfo="none">security = server</command> or <command moreinfo="none">security = domain
    27     </command>.</para>
     25    <para>The alternatives are
     26    <command moreinfo="none">security = ads</command> or <command moreinfo="none">security = domain
     27    </command>, which support joining Samba to a Windows domain, along with <command moreinfo="none">security = share</command> and <command moreinfo="none">security = server</command>, both of which are deprecated.</para>
    2828
    2929    <para>In versions of Samba prior to 2.0.0, the default was
    … …  
    3131    the only option at one stage.</para>
    3232
    33     <para>There is a bug in WfWg that has relevance to this
    34     setting. When in user or server level security a WfWg client
    35     will totally ignore the username and password you type in the &quot;connect
    36     drive&quot; dialog box. This makes it very difficult (if not impossible)
    37     to connect to a Samba service as anyone except the user that
    38     you are logged into WfWg as.</para>
    39 
    40     <para>If your PCs use usernames that are the same as their
    41     usernames on the UNIX machine then you will want to use
    42     <command moreinfo="none">security = user</command>. If you mostly use usernames
    43     that don't exist on the UNIX box then use <command moreinfo="none">security =
    44     share</command>.</para>
    45 
    46     <para>You should also use <command moreinfo="none">security = share</command> if you
     33    <para>You should use <command moreinfo="none">security = user</command> and
     34    <smbconfoption name="map to guest"/> if you
    4735    want to mainly setup shares without a password (guest shares). This
    48     is commonly used for a shared printer server. It is more difficult
    49     to setup guest shares with <command moreinfo="none">security = user</command>, see
    50     the <smbconfoption name="map to guest"/> parameter for details.</para>
     36    is commonly used for a shared printer server. </para>
    5137               
    5238    <para>It is possible to use <command moreinfo="none">smbd</command> in a <emphasis>
    … …  
    5743
    5844
     45    <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>
     46
     47    <para>This is the default security setting in Samba.
     48    With user-level security a client must first &quot;log-on&quot; with a
     49    valid username and password (which can be mapped using the <smbconfoption name="username map"/>
     50    parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also
     51    be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption
     52        name="guest only"/> if set      are then applied and
     53    may change the UNIX user to use on this connection, but only after
     54    the user has been successfully authenticated.</para>
     55
     56    <para><emphasis>Note</emphasis> that the name of the resource being
     57    requested is <emphasis>not</emphasis> sent to the server until after
     58    the server has successfully authenticated the client. This is why
     59    guest shares don't work in user level security without allowing
     60    the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
     61    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
     62
     63    <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
     64
     65    <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
     66
     67    <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
     68    <manvolnum>8</manvolnum></citerefentry> has been used to add this
     69    machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
     70        parameter to be set to <constant>yes</constant>. In this
     71    mode Samba will try to validate the username/password by passing
     72    it to a Windows NT Primary or Backup Domain Controller, in exactly
     73    the same way that a Windows NT Server would do.</para>
     74
     75    <para><emphasis>Note</emphasis> that a valid UNIX user must still
     76    exist as well as the account on the Domain Controller to allow
     77    Samba to have a valid UNIX account to map file access to.</para>
     78
     79    <para><emphasis>Note</emphasis> that from the client's point
     80    of view <command moreinfo="none">security = domain</command> is the same
     81    as <command moreinfo="none">security = user</command>. It only
     82    affects how the server deals with the authentication,
     83    it does not in any way affect what the client sees.</para>
     84
     85    <para><emphasis>Note</emphasis> that the name of the resource being
     86    requested is <emphasis>not</emphasis> sent to the server until after
     87    the server has successfully authenticated the client. This is why
     88    guest shares don't work in user level security without allowing
     89    the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
     90    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
     91
     92    <para>See also the section <link linkend="VALIDATIONSECT">
     93    NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
     94
     95    <para>See also the <smbconfoption name="password server"/> parameter and
     96         the <smbconfoption name="encrypted passwords"/> parameter.</para>
     97
    5998    <para><anchor id="SECURITYEQUALSSHARE"/><emphasis>SECURITY = SHARE</emphasis></para>
     99
     100    <note><para>This option is deprecated as it is incompatible with SMB2</para></note>
    60101               
    61102    <para>When clients connect to a share level security server, they
    … …  
    136177    NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    137178
    138     <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>
    139 
    140     <para>This is the default security setting in Samba 3.0.
    141     With user-level security a client must first &quot;log-on&quot; with a
    142     valid username and password (which can be mapped using the <smbconfoption name="username map"/>
    143     parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also
    144     be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption
    145         name="guest only"/> if set      are then applied and
    146     may change the UNIX user to use on this connection, but only after
    147     the user has been successfully authenticated.</para>
    148 
    149     <para><emphasis>Note</emphasis> that the name of the resource being
    150     requested is <emphasis>not</emphasis> sent to the server until after
    151     the server has successfully authenticated the client. This is why
    152     guest shares don't work in user level security without allowing
    153     the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
    154     See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    155 
    156     <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    157 
    158     <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
    159 
    160     <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
    161     <manvolnum>8</manvolnum></citerefentry> has been used to add this
    162     machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
    163         parameter to be set to <constant>yes</constant>. In this
    164     mode Samba will try to validate the username/password by passing
    165     it to a Windows NT Primary or Backup Domain Controller, in exactly
    166     the same way that a Windows NT Server would do.</para>
    167 
    168     <para><emphasis>Note</emphasis> that a valid UNIX user must still
    169     exist as well as the account on the Domain Controller to allow
    170     Samba to have a valid UNIX account to map file access to.</para>
    171 
    172     <para><emphasis>Note</emphasis> that from the client's point
    173     of view <command moreinfo="none">security = domain</command> is the same
    174     as <command moreinfo="none">security = user</command>. It only
    175     affects how the server deals with the authentication,
    176     it does not in any way affect what the client sees.</para>
    177 
    178     <para><emphasis>Note</emphasis> that the name of the resource being
    179     requested is <emphasis>not</emphasis> sent to the server until after
    180     the server has successfully authenticated the client. This is why
    181     guest shares don't work in user level security without allowing
    182     the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
    183     See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    184 
    185     <para>See also the section <link linkend="VALIDATIONSECT">
    186     NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    187 
    188     <para>See also the <smbconfoption name="password server"/> parameter and
    189          the <smbconfoption name="encrypted passwords"/> parameter.</para>
    190 
    191179    <para><anchor id="SECURITYEQUALSSERVER"/><emphasis>SECURITY = SERVER</emphasis></para>
    192180
    193181    <para>
    194         In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an
     182        In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an
    195183        NT box. If this fails it will revert to <command moreinfo="none">security = user</command>. It expects the
    196184        <smbconfoption name="encrypted passwords"/> parameter to be set to <constant>yes</constant>, unless the remote
    … …  
    204192    significant pitfalls since it is more vulnerable to
    205193    man-in-the-middle attacks and server impersonation.  In particular,
    206     this mode of operation can cause significant resource consuption on
     194    this mode of operation can cause significant resource consumption on
    207195    the PDC, as it must maintain an active connection for the duration
    208196    of the user's session.  Furthermore, if this connection is lost,
    209     there is no way to reestablish it, and futher authentications to the
     197    there is no way to reestablish it, and further authentications to the
    210198    Samba server may fail (from a single client, till it disconnects).
     199        </para></note>
     200
     201        <note><para>If the client selects NTLMv2 authentication, then this mode of operation <emphasis>will fail</emphasis>
    211202        </para></note>
    212203
    … …  
    216207    only affects how the server deals  with the authentication, it does
    217208        not in any way affect what the  client sees.</para></note>
     209
     210    <note><para>This option is deprecated, and may be removed in future</para></note>
    218211
    219212    <para><emphasis>Note</emphasis> that the name of the resource being

  • vendor/current/docs-xml/smbdotconf/security/username.xml

    r414 r740  
    1010    each username in turn (left to right).</para>
    1111
    12     <para>The <parameter moreinfo="none">username</parameter> line is needed only when
     12    <para>The deprecated <parameter moreinfo="none">username</parameter> line is needed only when
    1313    the PC is unable to supply its own username. This is the case
    1414    for the COREPLUS protocol or where your users have different WfWg

  • vendor/current/docs-xml/smbdotconf/tuning/strictallocate.xml

    r414 r740  
    1010    of actually forcing the disk system to allocate real storage blocks
    1111    when a file is created or extended to be a given size. In UNIX
    12     terminology this means that Samba will stop creating sparse files.
    13     This can be slow on some systems. When you work with large files like
    14     >100MB or so you may even run into problems with clients running into
    15     timeouts.</para>
     12    terminology this means that Samba will stop creating sparse files.</para>
     13
     14    <para>This option is really desgined for file systems that support
     15    fast allocation of large numbers of blocks such as extent-based file systems.
     16    On file systems that don't support extents (most notably ext3) this can
     17    make Samba slower. When you work with large files over >100MB on file
     18    systems without extents you may even run into problems with clients
     19    running into timeouts.</para>
    1620
    1721    <para>When you have an extent based filesystem it's likely that we can make

  • vendor/current/docs-xml/smbdotconf/winbind/idmapbackend.xml

    r414 r740  
    1212        <para>
    1313        This option specifies the default backend that is used when no special
    14         configuration set by <smbconfoption name="idmap config"/> matches the
    15         specific request.
    16         </para>
    17 
    18         <para>
    19         This default backend also specifies the place where winbind-generated
    20         idmap entries will be stored. So it is highly recommended that you
    21         specify a writable backend like <citerefentry>
    22         <refentrytitle>idmap_tdb</refentrytitle> <manvolnum>8</manvolnum>
    23         </citerefentry> or <citerefentry>
    24         <refentrytitle>idmap_ldap</refentrytitle> <manvolnum>8</manvolnum>
    25         </citerefentry> as the idmap backend. The <citerefentry>
    26         <refentrytitle>idmap_rid</refentrytitle> <manvolnum>8</manvolnum>
    27         </citerefentry> and <citerefentry>
    28         <refentrytitle>idmap_ad</refentrytitle> <manvolnum>8</manvolnum>
    29         </citerefentry> backends are not writable and thus will generate
    30         unexpected results if set as idmap backend.
    31         </para>
    32 
    33         <para>
    34         To use the rid and ad backends, please specify them via the
    35         <smbconfoption name="idmap config"/> parameter, possibly also for the
    36         domain your machine is member of, specified by <smbconfoption
    37         name="workgroup"/>.
    38         </para>
    39 
    40         <para>Examples of SID/uid/gid backends include tdb (<citerefentry>
    41         <refentrytitle>idmap_tdb</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
    42         ldap (<citerefentry><refentrytitle>idmap_ldap</refentrytitle>
    43         <manvolnum>8</manvolnum></citerefentry>), rid (<citerefentry>
    44         <refentrytitle>idmap_rid</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
    45         and ad (<citerefentry><refentrytitle>idmap_ad</refentrytitle>
    46         <manvolnum>8</manvolnum></citerefentry>).
     14        configuration set, but it is now deprecated in favour of the new
     15        spelling <smbconfoption name="idmap config * :  backend"/>.
    4716        </para>
    4817</description>

  • vendor/current/docs-xml/smbdotconf/winbind/idmapconfig.xml

    r414 r740  
    77
    88        <para>
    9         The idmap config prefix provides a means of managing each trusted
    10         domain separately. The idmap config prefix should be followed by the
    11         name of the domain, a colon, and a setting specific to the chosen
    12         backend. There are three options available for all domains:
     9        ID mapping in Samba is the mapping between Windows SIDs and Unix user
     10        and group IDs. This is performed by Winbindd with a configurable plugin
     11        interface. Samba's ID mapping is configured by options starting with the
     12        <smbconfoption name="idmap config"/> prefix.
     13        An idmap option consists of the <smbconfoption name="idmap config"/>
     14        prefix, followed by a domain name or the asterisk character (*),
     15        a colon, and the name of an idmap setting for the chosen domain.
    1316        </para>
    1417
    15         <variablelist> 
     18        <para>
     19        The idmap configuration is hence divided into groups, one group
     20        for each domain to be configured, and one group with the the
     21        asterisk instead of a proper domain name, which speifies the
     22        default configuration that is used to catch all domains that do
     23        not have an explicit idmap configuration of their own.
     24        </para>
     25
     26        <para>
     27        There are three general options available:
     28        </para>
     29
     30        <variablelist>
    1631                <varlistentry>
    1732                <term>backend = backend_name</term>
    1833                <listitem><para>
    19                         Specifies the name of the idmap plugin to use as the
    20                         SID/uid/gid backend for this domain.
     34                This specifies the name of the idmap plugin to use as the
     35                SID/uid/gid backend for this domain. The standard backends are
     36                tdb
     37                (<citerefentry><refentrytitle>idmap_tdb</refentrytitle> <manvolnum>8</manvolnum> </citerefentry>),
     38                tdb2
     39                (<citerefentry><refentrytitle>idmap_tdb2</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     40                ldap
     41                (<citerefentry><refentrytitle>idmap_ldap</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     42                ,
     43                rid
     44                (<citerefentry><refentrytitle>idmap_rid</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     45                ,
     46                hash
     47                (<citerefentry><refentrytitle>idmap_hash</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     48                ,
     49                autorid
     50                (<citerefentry><refentrytitle>idmap_autorid</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     51                ,
     52                ad
     53                (<citerefentry><refentrytitle>idmap_ad</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     54                ,
     55                adex
     56                (<citerefentry><refentrytitle>idmap_adex</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     57                ,
     58                and nss.
     59                (<citerefentry><refentrytitle>idmap_nss</refentrytitle> <manvolnum>8</manvolnum></citerefentry>),
     60                The corresponding manual pages contain the details, but
     61                here is a summary.
     62                </para>
     63                <para>
     64                The first three of these create mappings of their own using
     65                internal unixid counters and store the mappings in a database.
     66                These are suitable for use in the default idmap configuration.
     67                The rid and hash backends use a pure algorithmic calculation
     68                to determine the unixid for a SID. The autorid module is a
     69                mixture of the tdb and rid backend. It creates ranges for
     70                each domain encountered and then uses the rid algorithm for each
     71                of these automatically configured domains individually.
     72                The ad and adex
     73                backends both use unix IDs stored in Active Directory via
     74                the standard schema extensions. The nss backend reverses
     75                the standard winbindd setup and gets the unixids via names
     76                from nsswitch which can be useful in an ldap setup.
    2177                </para></listitem>
    2278                </varlistentry>
    … …  
    2480                <varlistentry>
    2581                <term>range = low - high</term>
    26                 <listitem><para>
     82                <listitem><para>
    2783                Defines the available matching uid and gid range for which the
    28                 backend is authoritative.  Note that the range commonly
    29                 matches the allocation range due to the fact that the same
    30                 backend will store and retrieve SID/uid/gid mapping entries.
    31                 </para>
     84                backend is authoritative. For allocating backends, this also
     85                defines the start and the end of the range for allocating
     86                new unid IDs.
     87                </para>
    3288                <para>
    3389                winbind uses this parameter to find the backend that is
    34                 authoritative for a unix ID to SID mapping, so it must be set
    35                 for each individually configured domain, and it must be
    36                 disjoint from the ranges set via <smbconfoption name="idmap
    37                 uid"/> and <smbconfoption name="idmap gid"/>.
     90                authoritative for a unix ID to SID mapping, so it must be set
     91                for each individually configured domain and for the default
     92                configuration. The configured ranges must be mutually disjoint.
    3893                </para></listitem>
     94                </varlistentry>
    3995
     96                <varlistentry>
     97                <term>read only = yes|no</term>
     98                <listitem><para>
     99                This option can be used to turn the writing backends
     100                tdb, tdb2, and ldap into read only mode. This can be useful
     101                e.g. in cases where a pre-filled database exists that should
     102                not be extended automatically.
     103                </para></listitem>
    40104                </varlistentry>
    41105        </variablelist>
    … …  
    44108        The following example illustrates how to configure the <citerefentry>
    45109        <refentrytitle>idmap_ad</refentrytitle> <manvolnum>8</manvolnum>
    46         </citerefentry> for the CORP domain and the
     110        </citerefentry> backend for the CORP domain and the
    47111        <citerefentry><refentrytitle>idmap_tdb</refentrytitle>
    48112        <manvolnum>8</manvolnum></citerefentry> backend for all other
    … …  
    54118
    55119        <programlisting>
    56         idmap backend = tdb
    57         idmap uid = 1000000-1999999
    58         idmap gid = 1000000-1999999
     120        idmap config * : backend = tdb
     121        idmap config * : range = 1000000-1999999
    59122
    60123        idmap config CORP : backend  = ad

  • vendor/current/docs-xml/smbdotconf/winbind/idmapgid.xml

    r414 r740  
    66                <synonym>winbind gid</synonym>
    77<description>
    8         <para>The idmap gid parameter specifies the range of group ids
    9         that are allocated for the purpose of mapping UNX groups to NT group
    10         SIDs. This range of group ids should have no
    11         existing local or NIS groups within it as strange conflicts can
    12         occur otherwise.</para>
    13 
    14         <para>See also the <smbconfoption name="idmap backend"/>, and
    15         <smbconfoption name="idmap config"/> options.
     8        <para>
     9        The idmap gid parameter specifies the range of group ids
     10        for the default idmap configuration. It is now deprecated
     11        in favour of <smbconfoption name="idmap config * : range"/>.
    1612        </para>
    1713
     14        <para>See the <smbconfoption name="idmap config"/> option.</para>
    1815</description>
    1916

  • vendor/current/docs-xml/smbdotconf/winbind/idmapuid.xml

    r414 r740  
    77<description>
    88        <para>
    9         The idmap uid parameter specifies the range of user ids that are
    10         allocated for use in mapping UNIX users to NT user SIDs. This
    11         range of ids should have no existing local
    12         or NIS users within it as strange conflicts can occur otherwise.</para>
     9        The idmap uid parameter specifies the range of user ids for
     10        the default idmap configuration. It is now deprecated in favour
     11        of <smbconfoption name="idmap config * : range"/>.
     12        </para>
    1313
    14         <para>See also the <smbconfoption name="idmap backend"/> and
    15         <smbconfoption name="idmap config"/> options.
    16         </para>
     14        <para>See the <smbconfoption name="idmap config"/> option.</para>
    1715</description>
    1816

  • vendor/current/docs-xml/smbdotconf/winbind/winbindusedefaultdomain.xml

    r414 r740  
    1010        without domain component in their username. Users without a domain
    1111        component are treated as is part of the winbindd server's own
    12         domain. While this does not benifit Windows users, it makes SSH, FTP and
     12        domain. While this does not benefit Windows users, it makes SSH, FTP and
    1313        e-mail function in a way much closer to the way they
    1414        would in a native unix system.</para>
     15        <para>This option should be avoided if possible. It can cause confusion
     16        about responsibilities for a user or group. In many situations it is
     17        not clear whether winbind or /etc/passwd should be seen as authoritative
     18        for a user, likewise for groups.</para>
    1519</description>
    1620
Note: See TracChangeset for help on using the changeset viewer.