Changeset 988 for vendor/current/docs-xml/Samba3-ByExample
- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- Location:
- vendor/current/docs-xml/Samba3-ByExample
- Files:
-
- 1 deleted
- 17 edited
-
SBE-2000UserNetwork.xml (modified) (7 diffs)
-
SBE-500UserNetwork.xml (modified) (3 diffs)
-
SBE-AddingUNIXClients.xml (modified) (21 diffs)
-
SBE-Appendix1.xml (modified) (2 diffs)
-
SBE-Appendix2.xml (modified) (10 diffs)
-
SBE-DomainAppsSupport.xml (modified) (13 diffs)
-
SBE-HighAvailability.xml (modified) (1 diff)
-
SBE-KerberosFastStart.xml (deleted)
-
SBE-MakingHappyUsers.xml (modified) (27 diffs)
-
SBE-MigrateNT4Samba3.xml (modified) (31 diffs)
-
SBE-MigrateNW4Samba3.xml (modified) (2 diffs)
-
SBE-SecureOfficeServer.xml (modified) (7 diffs)
-
SBE-SimpleOfficeServer.xml (modified) (7 diffs)
-
SBE-Support.xml (modified) (1 diff)
-
SBE-TheSmallOffice.xml (modified) (5 diffs)
-
SBE-UpgradingSamba.xml (modified) (17 diffs)
-
SBE-preface.xml (modified) (10 diffs)
-
index.xml (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/docs-xml/Samba3-ByExample/SBE-2000UserNetwork.xml
r414 r988 573 573 <indexterm><primary>LDAP</primary><secondary>backend</secondary></indexterm> 574 574 <indexterm><primary>SID</primary></indexterm> 575 When Samba -3is configured to use an LDAP backend, it stores the domain575 When Samba is configured to use an LDAP backend, it stores the domain 576 576 account information in a directory entry. This account entry contains the 577 577 domain SID. An unintended but exploitable side effect is that this makes it … … 659 659 <indexterm><primary>UID</primary></indexterm> 660 660 <indexterm><primary>GID</primary></indexterm> 661 Samba -3has the ability to use multiple password (authentication and661 Samba has the ability to use multiple password (authentication and 662 662 identity resolution) backends. The diagram in <link linkend="chap7idres"/> 663 663 demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system … … 680 680 <indexterm><primary>LDAP</primary></indexterm> 681 681 <indexterm><primary>distributed</primary></indexterm> 682 Samba is capable of using the <constant>smbpasswd</constant>, 683 <constant>tdbsam</constant>, <constant>xmlsam</constant>, 684 and <constant>mysqlsam</constant> authentication databases. The SMB 682 Samba is capable of using the <constant>smbpasswd</constant> and 683 <constant>tdbsam</constant>. The SMB 685 684 passwords can, of course, also be stored in an LDAP ldapsam 686 685 backend. LDAP is the preferred passdb backend for distributed network … … 690 689 <para> 691 690 <indexterm><primary>passdb backend</primary></indexterm> 692 Additionally, it is possible to use multiple passdb backends 693 concurrently as well as have multiple LDAP backends. As a result, you 694 can specify a failover LDAP backend. The syntax for specifying a 691 You can specify a failover LDAP backend. The syntax for specifying a 695 692 single LDAP backend in &smb.conf; is: 696 693 <screen> … … 722 719 </figure> 723 720 </para> 724 725 <para>726 Some folks have tried to implement this without the use of double quotes. This is the type of entry they727 created:728 <screen>729 ...730 passdb backend = ldapsam:ldap://master.abmas.biz \731 ldapsam:ldap://slave.abmas.biz732 ...733 </screen>734 <indexterm><primary>contiguous directory</primary></indexterm>735 The effect of this style of entry is that Samba lists the users736 that are in both LDAP databases. If both contain the same information,737 it results in each record being shown twice. This is, of course, not the738 solution desired for a failover implementation. The net effect of this739 configuration is shown in <link linkend="ch7dualadd"/>740 </para>741 742 <figure id="ch7dualadd">743 <title>Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</title>744 <imagefile scale="55">ch7-dual-additive-LDAP</imagefile>745 </figure>746 747 <para>748 If, however, each LDAP database contains unique information, this may749 well be an advantageous way to effectively integrate multiple LDAP databases750 into one seemingly contiguous directory. Only the first database will be updated.751 An example of this configuration is shown in <link linkend="ch7dualok"/>.752 </para>753 754 <figure id="ch7dualok">755 <title>Samba Configuration to Use Two LDAP Databases - The result is additive.</title>756 <imagefile scale="55">ch7-dual-additive-LDAP-Ok</imagefile>757 </figure>758 759 <note><para>760 When the use of ldapsam is specified twice, as shown here, it is imperative761 that the two LDAP directories must be disjoint. If the entries are for a762 master LDAP server as well as its own slave server, updates to the LDAP763 database may end up being lost or corrupted. You may safely use multiple764 LDAP backends only if both are entirely separate from each other.765 </para></note>766 721 767 722 <para> … … 1094 1049 <smbconfoption name="idmap uid">10000-20000</smbconfoption> 1095 1050 <smbconfoption name="idmap gid">10000-20000</smbconfoption> 1096 <smbconfoption name="printer admin">root</smbconfoption>1097 1051 <smbconfoption name="printing">cups</smbconfoption> 1098 1052 </smbconfblock> … … 1273 1227 <listitem><para> 1274 1228 <indexterm><primary>LDAP</primary></indexterm><indexterm><primary>BDC</primary></indexterm> 1275 Where Samba -3 is used as a domain controller, the use of LDAP is an1229 Where Samba is used as a domain controller, the use of LDAP is an 1276 1230 essential component to permit the use of BDCs. 1277 1231 </para></listitem> -
vendor/current/docs-xml/Samba3-ByExample/SBE-500UserNetwork.xml
r414 r988 5 5 6 6 <para> 7 The Samba -3 networking you explored in <link linkend="secure"/> covers the finer points of7 The Samba networking you explored in <link linkend="secure"/> covers the finer points of 8 8 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced 9 9 implementation of a simple configuration of the services that are important adjuncts … … 1767 1767 1768 1768 <listitem><para> 1769 Joining a Samba -3domain member server to a Samba-3 domain1769 Joining a Samba domain member server to a Samba-3 domain 1770 1770 </para></listitem> 1771 1771 … … 1937 1937 1938 1938 <para> 1939 Unless configured to do otherwise, the default behavior with Samba -3and Windows XP Professional1939 Unless configured to do otherwise, the default behavior with Samba and Windows XP Professional 1940 1940 clients is to use roaming profiles. 1941 1941 </para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-AddingUNIXClients.xml
r414 r988 307 307 <indexterm><primary>Domain Controller</primary></indexterm> 308 308 The domain member server and the domain member client are at the center of focus in this chapter. 309 Configuration of Samba -3 domain controller is covered in earlier chapters, so if your309 Configuration of Samba domain controller is covered in earlier chapters, so if your 310 310 interest is in domain controller configuration, you will not find that here. You will find good 311 311 oil that helps you to add domain member servers and clients. … … 675 675 <smbconfoption name="idmap gid">10000-20000</smbconfoption> 676 676 <smbconfoption name="winbind trusted domains only">Yes</smbconfoption> 677 <smbconfoption name="printer admin">root</smbconfoption>678 677 <smbconfoption name="printing">cups</smbconfoption> 679 678 … … 949 948 <smbconfoption name="template shell">/bin/bash</smbconfoption> 950 949 <smbconfoption name="winbind separator">+</smbconfoption> 951 <smbconfoption name="printer admin">root</smbconfoption>952 950 <smbconfoption name="hosts allow">192.168.2., 192.168.3., 127.</smbconfoption> 953 951 <smbconfoption name="printing">cups</smbconfoption> … … 1042 1040 <smbconfoption name="printcap name">CUPS</smbconfoption> 1043 1041 <smbconfoption name="wins server">192.168.2.1</smbconfoption> 1044 <smbconfoption name="printer admin">root</smbconfoption>1045 1042 <smbconfoption name="hosts allow">192.168.2., 192.168.3., 127.</smbconfoption> 1046 1043 <smbconfoption name="printing">cups</smbconfoption> … … 1075 1072 <indexterm><primary>Kerberos</primary></indexterm> 1076 1073 <indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm> 1077 One of the much-sought-after features new to Samba -3is the ability to join an Active Directory1074 One of the much-sought-after features new to Samba is the ability to join an Active Directory 1078 1075 domain using Kerberos protocols. This makes it possible to operate an entire Windows network 1079 1076 without the need to run NetBIOS over TCP/IP and permits more secure networking in general. An 1080 1077 exhaustively complete discussion of the protocols is not possible in this book; perhaps a 1081 later book may explore the intricacies of the NetBIOS-less operation that Samba -3can participate1082 in. For now, we simply focus on how a Samba -3server can be made a domain member server.1078 later book may explore the intricacies of the NetBIOS-less operation that Samba can participate 1079 in. For now, we simply focus on how a Samba server can be made a domain member server. 1083 1080 </para> 1084 1081 … … 1088 1085 <indexterm><primary>Identity resolution</primary></indexterm> 1089 1086 <indexterm><primary>Kerberos</primary></indexterm> 1090 The diagram in <link linkend="ch9-adsdc"/> demonstrates how Samba -3interfaces with1087 The diagram in <link linkend="ch9-adsdc"/> demonstrates how Samba interfaces with 1091 1088 Microsoft Active Directory components. It should be noted that if Microsoft Windows Services 1092 1089 for UNIX (SFU) has been installed and correctly configured, it is possible to use client LDAP 1093 for identity resolution just as can be done with Samba -3when using an LDAP passdb backend.1090 for identity resolution just as can be done with Samba when using an LDAP passdb backend. 1094 1091 The UNIX tool that you need for this, as in the case of LDAP on UNIX/Linux, is the PADL 1095 1092 Software nss_ldap tool-set. Compared with use of winbind and Kerberos, the use of 1096 1093 LDAP-based identity resolution is a little less secure. In view of the fact that this solution 1097 1094 requires additional software to be installed on the Windows 200x ADS domain controllers, 1098 and that means more management overhead, it is likely that most Samba -3ADS client sites1095 and that means more management overhead, it is likely that most Samba ADS client sites 1099 1096 may elect to use winbind. 1100 1097 </para> 1101 1098 1102 1099 <para> 1103 Do not attempt to use this procedure if you are not 100 percent certain that the build of Samba -31100 Do not attempt to use this procedure if you are not 100 percent certain that the build of Samba 1104 1101 you are using has been compiled and linked with all the tools necessary for this to work. 1105 Given the importance of this step, you must first validate that the Samba -3message block1102 Given the importance of this step, you must first validate that the Samba message block 1106 1103 daemon (<command>smbd</command>) has the necessary features. 1107 1104 </para> … … 1127 1124 <step><para> 1128 1125 <indexterm><primary>smbd</primary></indexterm> 1129 Before you try to use Samba -3, you want to know for certain that your executables have1126 Before you try to use Samba, you want to know for certain that your executables have 1130 1127 support for Kerberos and for LDAP. Execute the following to identify whether or 1131 1128 not this build is perhaps suitable for use: … … 1205 1202 <indexterm><primary>validated</primary></indexterm> 1206 1203 The next step is to identify which version of the Kerberos libraries have been used. 1207 In order to permit Samba -3to interoperate with Windows 2003 Active Directory, it is1204 In order to permit Samba to interoperate with Windows 2003 Active Directory, it is 1208 1205 essential that it has been linked with either MIT Kerberos version 1.3.1 or later, 1209 1206 or that it has been linked with Heimdal Kerberos 0.6 plus specific patches. You may … … 1224 1221 1225 1222 <para> 1226 From this point on, you are certain that the Samba -3build you are using has the1227 necessary capabilities. You can now configure Samba -3 and the NSS.1223 From this point on, you are certain that the Samba build you are using has the 1224 necessary capabilities. You can now configure Samba and the NSS. 1228 1225 </para></step> 1229 1226 … … 1275 1272 Joined 'FRAN' to realm 'LONDON.ABMAS.BIZ' 1276 1273 </screen> 1277 You have successfully made your Samba -3server a member of the ADS domain1274 You have successfully made your Samba server a member of the ADS domain 1278 1275 using Kerberos protocols. 1279 1276 </para> … … 1424 1421 <indexterm><primary>Active Directory</primary><secondary>server</secondary></indexterm> 1425 1422 <indexterm><primary>Kerberos</primary></indexterm> 1426 You may now perform final verification that communications between Samba -3winbind and1423 You may now perform final verification that communications between Samba winbind and 1427 1424 the Active Directory server is using Kerberos protocols. Execute the following: 1428 1425 <screen> … … 1520 1517 -------------- End Of Security Descriptor 1521 1518 </programlisting> 1522 And now you have conclusive proof that your Samba -3ADS domain member server1519 And now you have conclusive proof that your Samba ADS domain member server 1523 1520 called <constant>FRAN</constant> is able to communicate fully with the ADS 1524 1521 domain controllers. … … 1529 1526 1530 1527 <para> 1531 Your Samba -3ADS domain member server is ready for use. During training sessions,1528 Your Samba ADS domain member server is ready for use. During training sessions, 1532 1529 you may be asked what is inside the <filename>winbindd_cache.tdb and winbindd_idmap.tdb</filename> 1533 1530 files. Since curiosity just took hold of you, execute the following: … … 1724 1721 <smbconfoption name="winbind enum groups">No</smbconfoption> 1725 1722 <smbconfoption name="winbind nested groups">Yes</smbconfoption> 1726 <smbconfoption name="printer admin">"KPAK\Domain Admins"</smbconfoption>1727 1723 </smbconfblock> 1728 1724 </example> … … 1818 1814 <indexterm><primary>ADAM</primary></indexterm> 1819 1815 <indexterm><primary>ADS</primary></indexterm> 1820 The storage of IDMAP information in LDAP can be used with both NT4/Samba- 3-style domains as well as1816 The storage of IDMAP information in LDAP can be used with both NT4/Samba-style domains as well as 1821 1817 with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant 1822 1818 LDAP server can be used. It is therefore possible to deploy this IDMAP configuration using … … 1852 1848 <para> 1853 1849 <indexterm><primary>realm</primary></indexterm> 1854 In the case of an NT4 or Samba- 3-style domain the <parameter>realm</parameter> is not used, and the1850 In the case of an NT4 or Samba-style domain the <parameter>realm</parameter> is not used, and the 1855 1851 command used to join the domain is <command>net rpc join</command>. The above example also demonstrates 1856 1852 advanced error reporting techniques that are documented in the chapter called "Reporting Bugs" in 1857 <quote>The Official Samba -3HOWTO and Reference Guide, Second Edition</quote> (TOSHARG2).1853 <quote>The Official Samba HOWTO and Reference Guide, Second Edition</quote> (TOSHARG2). 1858 1854 </para> 1859 1855 … … 2195 2191 systems logons (SSO), providing user and group accounts are stored in an LDAP directory. This 2196 2192 provides logon services for UNIX/Linux users, while Windows users obtain their sign-on 2197 support via Samba -3.2193 support via Samba. 2198 2194 </para> 2199 2195 … … 2223 2219 <para> 2224 2220 The following steps provide a Linux system that users can log onto using 2225 Windows NT4 (or Samba -3) domain network credentials:2221 Windows NT4 (or Samba) domain network credentials: 2226 2222 </para> 2227 2223 … … 2756 2752 2757 2753 <para> 2758 Is proper DNS operation necessary for Samba -3plus LDAP? If so, what must I put into2754 Is proper DNS operation necessary for Samba plus LDAP? If so, what must I put into 2759 2755 my DNS configuration? 2760 2756 </para> … … 2818 2814 <para> 2819 2815 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 2820 use Samba -3with that configuration?2816 use Samba with that configuration? 2821 2817 </para> 2822 2818 … … 2856 2852 <primary>authentication</primary> 2857 2853 </indexterm> 2858 No. This is not okay. It means that your Samba -3client has joined the ADS domain as2859 a Windows NT4 client, and Samba -3will not be using Kerberos-based authentication.2854 No. This is not okay. It means that your Samba client has joined the ADS domain as 2855 a Windows NT4 client, and Samba will not be using Kerberos-based authentication. 2860 2856 </para> 2861 2857 -
vendor/current/docs-xml/Samba3-ByExample/SBE-Appendix1.xml
r414 r988 51 51 <para> 52 52 Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with 53 Samba -3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.53 Samba. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button. 54 54 See <link linkend="swxpp004"></link>. 55 55 <figure id="swxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure> … … 77 77 78 78 <para> 79 Enter the name <quote>root</quote> and the root password from your Samba -3server. See <link linkend="swxpp008"></link>.79 Enter the name <quote>root</quote> and the root password from your Samba server. See <link linkend="swxpp008"></link>. 80 80 <figure id="swxpp008"><title>Computer Name Changes &smbmdash; User name and Password Panel</title><imagefile>wxpp008</imagefile></figure> 81 81 </para></step> -
vendor/current/docs-xml/Samba3-ByExample/SBE-Appendix2.xml
r414 r988 24 24 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet 25 25 card connected using a hub. Also required is one additional server (either Windows 26 NT4 Server, Windows 2000 Server, or a Samba -3on UNIX/Linux server) running a network26 NT4 Server, Windows 2000 Server, or a Samba on UNIX/Linux server) running a network 27 27 sniffer and analysis application (Wireshark is a good choice). All work should be undertaken 28 28 on a quiet network where there is no other traffic. It is best to use a dedicated hub … … 119 119 120 120 <para> 121 Recommended preparatory reading: <emphasis>The Official Samba -3HOWTO and Reference Guide, Second121 Recommended preparatory reading: <emphasis>The Official Samba HOWTO and Reference Guide, Second 122 122 Edition</emphasis> (TOSHARG2) Chapter 9, <quote>Network Browsing,</quote> and Chapter 3, 123 123 <quote>Server Types and Security Modes.</quote> … … 752 752 753 753 <sect2> 754 <title>Windows 200x/XP Client Interaction with Samba -3</title>754 <title>Windows 200x/XP Client Interaction with Samba</title> 755 755 756 756 <para> … … 947 947 database and thus must be stored elsewhere on the UNIX system in a manner that Samba can 948 948 use. Samba-2.x permitted such encrypted passwords to be stored in the <constant>smbpasswd</constant> 949 file or in an LDAP database. Samba -3permits use of multiple <parameter>passdb backend</parameter>949 file or in an LDAP database. Samba permits use of multiple <parameter>passdb backend</parameter> 950 950 databases in concurrent deployment. Refer to <emphasis>TOSHARG2</emphasis>, Chapter 10, <quote>Account Information Databases.</quote> 951 951 </para></listitem> … … 1143 1143 1144 1144 <para> 1145 Is it possible to reduce network broadcast activity with Samba -3?1145 Is it possible to reduce network broadcast activity with Samba? 1146 1146 </para> 1147 1147 … … 1170 1170 <note><para> 1171 1171 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as 1172 well as with Samba -3.1172 well as with Samba. 1173 1173 </para></note> 1174 1174 … … 1206 1206 1207 1207 <para> 1208 Samba -3supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling.1208 Samba supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling. 1209 1209 Just create user accounts by running <command>smbpasswd -a 'username'</command> 1210 1210 </para> … … 1232 1232 <para> 1233 1233 The parameter in the &smb.conf; file that controls this behavior is known as <parameter>encrypt 1234 passwords</parameter>. The default setting for this in Samba -3is <constant>Yes (Enabled)</constant>.1234 passwords</parameter>. The default setting for this in Samba is <constant>Yes (Enabled)</constant>. 1235 1235 </para> 1236 1236 … … 1243 1243 <para> 1244 1244 Is it necessary to specify <smbconfoption name="encrypt passwords">Yes</smbconfoption> 1245 when Samba -3is configured as a domain member?1245 when Samba is configured as a domain member? 1246 1246 </para> 1247 1247 … … 1260 1260 1261 1261 <para> 1262 Is it necessary to specify a <parameter>guest account</parameter> when Samba -3is configured1262 Is it necessary to specify a <parameter>guest account</parameter> when Samba is configured 1263 1263 as a domain member server? 1264 1264 </para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-DomainAppsSupport.xml
r414 r988 11 11 <indexterm><primary>ldapsam</primary></indexterm> 12 12 <indexterm><primary>Active Directory</primary></indexterm> 13 You've come a long way now. You have pretty much mastered Samba -3 for14 most uses it can be put to. Up until now, you have cast Samba -3 in the leading13 You've come a long way now. You have pretty much mastered Samba for 14 most uses it can be put to. Up until now, you have cast Samba in the leading 15 15 role, and where authentication was required, you have used one or another of 16 16 Samba's many authentication backends (from flat text files with smbpasswd … … 43 43 44 44 <para> 45 You have decided to set the ball rolling by introducing Samba -3 into the network45 You have decided to set the ball rolling by introducing Samba into the network 46 46 gradually, taking over key services and easing the way to a full migration and, 47 47 therefore, integration into Abmas's existing business later. … … 136 136 Functionally, the user's Internet Explorer requests a browsing session with the 137 137 Squid proxy, for which it offers its AD authentication token. Squid hands off 138 the authentication request to the Samba -3authentication helper application138 the authentication request to the Samba authentication helper application 139 139 called <command>ntlm_auth</command>. This helper is a hook into winbind, the 140 Samba -3 NTLM authentication daemon. Winbind enables UNIX services to authenticate140 Samba NTLM authentication daemon. Winbind enables UNIX services to authenticate 141 141 against Microsoft Windows domains, including Active Directory domains. As Active 142 142 Directory authentication is a modified Kerberos authentication, winbind is assisted … … 160 160 161 161 <listitem><para> 162 Configuring, compiling, and then installing the supporting Samba -3components162 Configuring, compiling, and then installing the supporting Samba components 163 163 </para></listitem> 164 164 … … 193 193 First, your system needs to be prepared and in a known good state to proceed. This consists 194 194 of making sure that everything the system depends on is present and that everything that could 195 interfere or conflict with the system is removed. You will be configuring the Squid and Samba -3195 interfere or conflict with the system is removed. You will be configuring the Squid and Samba 196 196 packages and updating them if necessary. If conflicting packages of these programs are installed, 197 197 they must be removed. … … 417 417 <para> 418 418 <indexterm><primary>Active Directory</primary></indexterm> 419 Samba must be configured to correctly use Active Directory. Samba -3 must be used, since it419 Samba must be configured to correctly use Active Directory. Samba must be used, since it 420 420 has the necessary components to interface with Active Directory. 421 421 </para> 422 422 423 423 <procedure> 424 <title>Securing Samba -3With ADS Support Steps</title>424 <title>Securing Samba With ADS Support Steps</title> 425 425 426 426 <step><para> … … 430 430 <indexterm><primary>MIT KRB5</primary></indexterm> 431 431 <indexterm><primary>ntlm_auth</primary></indexterm> 432 Download the latest stable Samba -3for Red Hat Linux from the official Samba Team432 Download the latest stable Samba for Red Hat Linux from the official Samba Team 433 433 <ulink url="http://ftp.samba.org">FTP site.</ulink> The official Samba Team 434 434 RPMs for Red Hat Fedora Linux contain the <command>ntlm_auth</command> tool … … 524 524 <indexterm><primary>Squid</primary></indexterm> 525 525 <indexterm><primary>ntlm_auth</primary></indexterm> 526 Squid uses the <command>ntlm_auth</command> helper build with Samba -3.526 Squid uses the <command>ntlm_auth</command> helper build with Samba. 527 527 You may test <command>ntlm_auth</command> with the command: 528 528 <screen> … … 574 574 <indexterm><primary>winbind</primary></indexterm> 575 575 <indexterm><primary>authentication</primary></indexterm> 576 For Squid to benefit from Samba -3, NSS must be updated to allow winbind as a valid route to user authentication.576 For Squid to benefit from Samba, NSS must be updated to allow winbind as a valid route to user authentication. 577 577 </para> 578 578 … … 625 625 <indexterm><primary>Squid</primary></indexterm> 626 626 <indexterm><primary>Active Directory</primary><secondary>authentication</secondary></indexterm> 627 Squid must be configured correctly to interact with the Samba -3627 Squid must be configured correctly to interact with the Samba 628 628 components that handle Active Directory authentication. 629 629 </para> … … 864 864 <indexterm><primary>smbd</primary></indexterm> 865 865 <indexterm><primary>file and print server</primary></indexterm> 866 Samba -3is a file and print server. The core components that provide this functionality are <command>smbd</command>,866 Samba is a file and print server. The core components that provide this functionality are <command>smbd</command>, 867 867 <command>nmbd</command>, and the identity resolver daemon, <command>winbindd</command>. 868 868 </para> … … 871 871 <indexterm><primary>SMB/CIFS</primary></indexterm> 872 872 <indexterm><primary>smbclient</primary></indexterm> 873 Samba -3is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>.873 Samba is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>. 874 874 </para> 875 875 … … 880 880 <indexterm><primary>inter-operability</primary></indexterm> 881 881 <indexterm><primary>authentication</primary></indexterm> 882 Samba -3includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.883 Samba -3includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux882 Samba includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 883 Samba includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux 884 884 servers and clients. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts 885 as well as logins to an SMB/CIFS authentication server backend. Samba -3includes name service switch (NSS) modules885 as well as logins to an SMB/CIFS authentication server backend. Samba includes name service switch (NSS) modules 886 886 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 887 887 server products). -
vendor/current/docs-xml/Samba3-ByExample/SBE-HighAvailability.xml
r414 r988 12 12 to wrap up the theme and contents of a book in what is generally regarded as the 13 13 chapter that should draw conclusions. This book is a suspense thriller, and since 14 the plot of the stories told mostly lead you to bigger, better Samba -3networking14 the plot of the stories told mostly lead you to bigger, better Samba networking 15 15 solutions, it is perhaps appropriate to close this book with a few pertinent comments 16 regarding some of the things everyone can do to deliver a reliable Samba -3network.16 regarding some of the things everyone can do to deliver a reliable Samba network. 17 17 </para> 18 18 -
vendor/current/docs-xml/Samba3-ByExample/SBE-MakingHappyUsers.xml
r746 r988 364 364 The implementation of Samba BDCs necessitates the installation and configuration of LDAP. 365 365 For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial 366 LDAP servers in current use with Samba -3include:366 LDAP servers in current use with Samba include: 367 367 </para> 368 368 … … 396 396 offerings, it requires that you manually edit the server configuration files and manually 397 397 initialize the LDAP directory database. OpenLDAP itself has only command-line tools to 398 help you to get OpenLDAP and Samba -3running as required, albeit with some learning curve challenges.398 help you to get OpenLDAP and Samba running as required, albeit with some learning curve challenges. 399 399 </para> 400 400 … … 448 448 tools and the creation of shell and Perl scripts a bit 449 449 challenging. OpenLDAP can be easily customized, though it includes 450 many ready-to-use schemas. Samba -3provides an OpenLDAP schema file450 many ready-to-use schemas. Samba provides an OpenLDAP schema file 451 451 that is required for use as a passdb backend. 452 452 </para> … … 454 454 <para> 455 455 <indexterm><primary>interoperability</primary></indexterm> 456 For those who are willing to brave the process of installing and configuring LDAP and Samba -3interoperability,456 For those who are willing to brave the process of installing and configuring LDAP and Samba interoperability, 457 457 there are a few nice Web-based tools that may help you to manage your users and groups more effectively. 458 458 The Web-based tools you might like to consider include the … … 520 520 server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system 521 521 accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account 522 attributes Samba needs. Samba -3can use the LDAP backend to store:522 attributes Samba needs. Samba can use the LDAP backend to store: 523 523 </para> 524 524 … … 540 540 <indexterm><primary>UID</primary></indexterm> 541 541 <indexterm><primary>nss_ldap</primary></indexterm> 542 The use of LDAP with Samba -3makes it necessary to store UNIX accounts as well as Windows Networking542 The use of LDAP with Samba makes it necessary to store UNIX accounts as well as Windows Networking 543 543 accounts in the LDAP backend. This implies the need to use the 544 544 <ulink url="http://www.padl.com/Contents/OpenSourceSoftware.html">PADL LDAP tools</ulink>. The resolution … … 858 858 859 859 <para> 860 This book is about Samba -3, so you can confine the printing style to just the smart860 This book is about Samba, so you can confine the printing style to just the smart 861 861 style of installation. Those interested in further information regarding intelligent 862 862 printing should review documentation on the Easy Software Products Web site. … … 1250 1250 1251 1251 <itemizedlist> 1252 <listitem><para>Samba -3PDC Server Configuration</para>1252 <listitem><para>Samba PDC Server Configuration</para> 1253 1253 <orderedlist> 1254 1254 <listitem><para>DHCP and DNS servers</para></listitem> 1255 1255 <listitem><para>OpenLDAP server</para></listitem> 1256 1256 <listitem><para>PAM and NSS client tools</para></listitem> 1257 <listitem><para>Samba -3PDC</para></listitem>1257 <listitem><para>Samba PDC</para></listitem> 1258 1258 <listitem><para>Idealx smbldap scripts</para></listitem> 1259 1259 <listitem><para>LDAP initialization</para></listitem> … … 1266 1266 </orderedlist> 1267 1267 </listitem> 1268 <listitem><para>Samba -3BDC Server Configuration</para>1268 <listitem><para>Samba BDC Server Configuration</para> 1269 1269 <orderedlist> 1270 1270 <listitem><para>DHCP and DNS servers</para></listitem> … … 1384 1384 1385 1385 <para> 1386 Samba -3and OpenLDAP will have a degree of interdependence that is unavoidable. The method1387 for bootstrapping the LDAP and Samba -3configuration is relatively straightforward. If you1386 Samba and OpenLDAP will have a degree of interdependence that is unavoidable. The method 1387 for bootstrapping the LDAP and Samba configuration is relatively straightforward. If you 1388 1388 follow these guidelines, the resulting system should work fine. 1389 1389 </para> … … 1782 1782 <indexterm><primary>secrets.tdb</primary></indexterm> 1783 1783 <indexterm><primary>smbpasswd</primary></indexterm> 1784 Samba -3communicates with the LDAP server. The password that it uses to1784 Samba communicates with the LDAP server. The password that it uses to 1785 1785 authenticate to the LDAP server must be stored in the <filename>secrets.tdb</filename> 1786 1786 file. Execute the following to create the new <filename>secrets.tdb</filename> files … … 1798 1798 <indexterm><primary>smbd</primary></indexterm> 1799 1799 <indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm> 1800 Samba -3generates a Windows Security Identifier (SID) only when <command>smbd</command>1800 Samba generates a Windows Security Identifier (SID) only when <command>smbd</command> 1801 1801 has been started. For this reason, you start Samba. After a few seconds delay, 1802 1802 execute: … … 1857 1857 1858 1858 <para> 1859 Your Samba -3PDC is now ready to communicate with the LDAP password backend. Let's get on with1859 Your Samba PDC is now ready to communicate with the LDAP password backend. Let's get on with 1860 1860 configuration of the LDAP server. 1861 1861 </para> … … 1926 1926 <para> 1927 1927 <indexterm><primary>Idealx</primary><secondary>smbldap-tools</secondary></indexterm> 1928 The Idealx scripts, or equivalent, are necessary to permit Samba -3to manage accounts1928 The Idealx scripts, or equivalent, are necessary to permit Samba to manage accounts 1929 1929 on the LDAP server. You have chosen the Idealx scripts because they are the best-known 1930 1930 LDAP configuration scripts. The use of these scripts will help avoid the necessity … … 2233 2233 2234 2234 <para> 2235 At this time, Samba -3requires that on a PDC all UNIX (POSIX) group accounts that are2235 At this time, Samba requires that on a PDC all UNIX (POSIX) group accounts that are 2236 2236 mapped (linked) to Windows domain group accounts must be in the LDAP database. It does not 2237 2237 hurt to have UNIX user and group accounts in both the system files as well as in the LDAP … … 2296 2296 <indexterm><primary>directory</primary><secondary>Computers container</secondary></indexterm> 2297 2297 In the following examples, as the LDAP database is initialized, we do create a container 2298 for Computer (machine) accounts. In the Samba -3&smb.conf; files, specific use is made2298 for Computer (machine) accounts. In the Samba &smb.conf; files, specific use is made 2299 2299 of the People container, not the Computers container, for domain member accounts. This is not a 2300 2300 mistake; it is a deliberate action that is necessitated by the fact that the resolution of … … 2673 2673 <indexterm><primary>ldapsam</primary></indexterm> 2674 2674 <indexterm><primary>pdbedit</primary></indexterm> 2675 The final validation step involves making certain that Samba -3can obtain the user2675 The final validation step involves making certain that Samba can obtain the user 2676 2676 accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: 2677 2677 <screen> … … 2758 2758 <step><para> 2759 2759 The server you have so carefully built is now ready for another important step. You 2760 start the Samba -3 server and validate its operation. Execute the following to render all2760 start the Samba server and validate its operation. Execute the following to render all 2761 2761 the processes needed fully operative so that, on system reboot, they are automatically 2762 2762 started: … … 2801 2801 <step><para> 2802 2802 <indexterm><primary>smbclient</primary></indexterm> 2803 You may now check Samba -3operation as follows:2803 You may now check Samba operation as follows: 2804 2804 <screen> 2805 2805 &rootprompt; smbclient -L massive -U% … … 2859 2859 <para> 2860 2860 <indexterm><primary>CUPS</primary></indexterm> 2861 The configuration for Samba -3to enable CUPS raw-print-through printing has already been2861 The configuration for Samba to enable CUPS raw-print-through printing has already been 2862 2862 taken care of in the &smb.conf; file. The only preparation needed for <constant>smart</constant> 2863 printing to be possible involves creation of the directories in which Samba -3stores2863 printing to be possible involves creation of the directories in which Samba stores 2864 2864 Windows printing driver files. 2865 2865 </para> … … 2965 2965 2966 2966 <sect1 id="sbehap-bldg1"> 2967 <title>Samba -3BDC Configuration</title>2967 <title>Samba BDC Configuration</title> 2968 2968 2969 2969 <procedure> … … 3055 3055 <step><para> 3056 3056 <indexterm><primary>smbpasswd</primary></indexterm> 3057 You must now set the LDAP administrative password into the Samba -3<filename>secrets.tdb</filename>3057 You must now set the LDAP administrative password into the Samba <filename>secrets.tdb</filename> 3058 3058 file by executing this command: 3059 3059 <screen> … … 3066 3066 Now you must obtain the domain SID from the PDC and store it into the 3067 3067 <filename>secrets.tdb</filename> file also. This step is not necessary with an LDAP 3068 passdb backend because Samba -3 obtains the domain SID from the3068 passdb backend because Samba obtains the domain SID from the 3069 3069 sambaDomain object it automatically stores in the LDAP backend. It does not hurt to 3070 3070 add the SID to the <filename>secrets.tdb</filename>, and if you wish to do so, this … … 3075 3075 for Domain MEGANET2 in secrets.tdb 3076 3076 </screen> 3077 When configuring a Samba -3BDC that has an LDAP backend, there is no need to take3077 When configuring a Samba BDC that has an LDAP backend, there is no need to take 3078 3078 any special action to join it to the domain. However, winbind communicates with the 3079 3079 domain controller that is running on the localhost and must be able to authenticate, … … 3095 3095 <primary>pdbedit</primary> 3096 3096 </indexterm> 3097 Verify that user and group account resolution works via Samba -3tools as follows:3097 Verify that user and group account resolution works via Samba tools as follows: 3098 3098 <screen> 3099 3099 &rootprompt; pdbedit -L … … 3124 3124 <step><para> 3125 3125 The server you have so carefully built is now ready for another important step. Now 3126 start the Samba -3server and validate its operation. Execute the following to render all3126 start the Samba server and validate its operation. Execute the following to render all 3127 3127 the processes needed fully operative so that, upon system reboot, they are automatically 3128 3128 started: … … 3137 3137 &rootprompt; rcwinbind start 3138 3138 </screen> 3139 Samba -3should now be running and is ready for a quick test. But not quite yet!3139 Samba should now be running and is ready for a quick test. But not quite yet! 3140 3140 </para></step> 3141 3141 -
vendor/current/docs-xml/Samba3-ByExample/SBE-MigrateNT4Samba3.xml
r414 r988 2 2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3 3 <chapter id="ntmigration"> 4 <title>Migrating NT4 Domain to Samba -3</title>4 <title>Migrating NT4 Domain to Samba</title> 5 5 6 6 <para> 7 7 Ever since Microsoft announced that it was discontinuing support for Windows 8 8 NT4, Samba users started to ask for detailed instructions on how to migrate 9 from NT4 to Samba -3. This chapter provides background information that should9 from NT4 to Samba. This chapter provides background information that should 10 10 meet these needs. 11 11 </para> … … 34 34 <indexterm><primary>accounts</primary><secondary>group</secondary></indexterm> 35 35 <indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm> 36 The migration from NT4 to Samba -3can involve a number of factors, including36 The migration from NT4 to Samba can involve a number of factors, including 37 37 migration of data to another server, migration of network environment controls 38 38 such as group policies, and migration of the users, groups, and machine … … 43 43 <indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm> 44 44 It should be pointed out now that it is possible to migrate some systems from 45 a Windows NT4 domain environment to a Samba -3domain environment. This is certainly45 a Windows NT4 domain environment to a Samba domain environment. This is certainly 46 46 not possible in every case. It is possible to just migrate the domain accounts 47 to Samba -3and then to switch machines, but as a hands-off transition, this is more47 to Samba and then to switch machines, but as a hands-off transition, this is more 48 48 the exception than the rule. Most systems require some tweaking after 49 49 migration before an environment that is acceptable for immediate use … … 59 59 <indexterm><primary>passdb backend</primary></indexterm> 60 60 You are about to migrate an MS Windows NT4 domain accounts database to 61 a Samba -3 server. The Samba-3 server is using a61 a Samba server. The Samba-3 server is using a 62 62 <parameter>passdb backend</parameter> based on LDAP. The 63 63 <constant>ldapsam</constant> is ideal because an LDAP backend can be distributed … … 67 67 <para> 68 68 Your objective is to document the process of migrating user and group accounts 69 from several NT4 domains into a single Samba -3LDAP backend database.69 from several NT4 domains into a single Samba LDAP backend database. 70 70 </para> 71 71 … … 101 101 <indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm> 102 102 <indexterm><primary>disruptive</primary></indexterm> 103 Before commencing an NT4 to Samba -3migration, you should consider what your objectives are.104 While in some cases it is possible simply to migrate an NT4 domain to a single Samba -3server,103 Before commencing an NT4 to Samba migration, you should consider what your objectives are. 104 While in some cases it is possible simply to migrate an NT4 domain to a single Samba server, 105 105 that may not be a good idea from an administration perspective. Since the process involves going 106 106 through a certain amount of disruptive activity anyhow, why not take this opportunity to … … 117 117 particularly Windows XP Professional. The migration provides opportunity to revise and update 118 118 roaming profile deployment as well as folder redirection. Given that you must port the 119 greater network configuration of this from the old NT4 server to the new Samba -3server.119 greater network configuration of this from the old NT4 server to the new Samba server. 120 120 Do not forget to validate the security descriptors in the profiles share as well as network logon 121 scripts. Feedback from sites that are migrating to Samba -3suggests that many are using this121 scripts. Feedback from sites that are migrating to Samba suggests that many are using this 122 122 as a good time to update desktop systems also. In all, the extra effort should constitute no 123 123 real disruption to users, but rather, with due diligence and care, should make their network experience … … 131 131 <indexterm><primary>strategic</primary></indexterm> 132 132 <indexterm><primary>active directory</primary></indexterm> 133 Migration of an NT4 domain user and group database to Samba -3involves a certain strategic133 Migration of an NT4 domain user and group database to Samba involves a certain strategic 134 134 element. Many sites have asked for instructions regarding merging of multiple NT4 135 domains into one Samba -3LDAP database. It seems that this is viewed as a significant135 domains into one Samba LDAP database. It seems that this is viewed as a significant 136 136 added value compared with the alternative of migration to Windows Server 200x and Active 137 137 Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration … … 211 211 212 212 <para> 213 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba -3213 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba 214 214 domain may be seen by those who had power over them as a loss of prestige or a loss of 215 215 power. The imposition of a single domain may even be seen as a threat. So in migrating and … … 220 220 <para> 221 221 The best advice that can be given to those who set out to merge NT4 domains into a single 222 Samba -3domain is to promote (sell) the action as one that reduces costs and delivers222 Samba domain is to promote (sell) the action as one that reduces costs and delivers 223 223 greater network interoperability and manageability. 224 224 </para> … … 233 233 <para> 234 234 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 235 to Samba -3are being performed using a new server or a new installation of a Linux or UNIX235 to Samba are being performed using a new server or a new installation of a Linux or UNIX 236 236 server. If you contemplate doing this, please note that the steps that follow in this 237 237 chapter assume familiarity with the information that has been previously covered in this … … 241 241 242 242 <para> 243 We present here the steps and example output for two NT4 to Samba -3domain migrations. The243 We present here the steps and example output for two NT4 to Samba domain migrations. The 244 244 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the 245 245 scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter> … … 260 260 <itemizedlist> 261 261 <listitem><para> 262 Prepare the target Samba -3server. This involves configuring Samba-3 for262 Prepare the target Samba server. This involves configuring Samba-3 for 263 263 migration to either a tdbsam or an ldapsam backend. 264 264 </para></listitem> … … 284 284 285 285 <listitem><para> 286 Upgrade the Samba -3server from a BDC to a PDC, and validate all account286 Upgrade the Samba server from a BDC to a PDC, and validate all account 287 287 information. 288 288 </para></listitem> … … 297 297 298 298 <para> 299 In this example, the migration is of an NT4 PDC to a Samba -3PDC with an LDAP backend. The accounts about299 In this example, the migration is of an NT4 PDC to a Samba PDC with an LDAP backend. The accounts about 300 300 to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the 301 301 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. … … 401 401 402 402 <example id="sbent4smb"> 403 <title>NT4 Migration Samba -3Server <filename>smb.conf</filename> &smbmdash; Part: A</title>403 <title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: A</title> 404 404 <smbconfblock> 405 405 <smbconfsection name="[global]"/> … … 448 448 449 449 <example id="sbent4smb2"> 450 <title>NT4 Migration Samba -3Server <filename>smb.conf</filename> &smbmdash; Part: B</title>450 <title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: B</title> 451 451 <smbconfblock> 452 452 <smbconfsection name="[apps]"/> … … 665 665 <para> 666 666 Another way to obtain the domain SID from the target NT4 domain that is being 667 migrated to Samba -3is by executing the following:667 migrated to Samba is by executing the following: 668 668 <screen> 669 669 &rootprompt; net rpc info -S TRANSGRESSION … … 912 912 <step><para> 913 913 Now it is time to join the Samba BDC to the target NT4 domain that is being 914 migrated to Samba -3by executing the following:914 migrated to Samba by executing the following: 915 915 <screen> 916 916 &rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get … … 1046 1046 <step><para> 1047 1047 The final responsibility in the migration process is to create identical 1048 shares and printing resources on the new Samba -3server, copy all data1048 shares and printing resources on the new Samba server, copy all data 1049 1049 across, set up privileges, and set share and file/directory access controls. 1050 1050 </para></step> … … 1079 1079 <step><para> 1080 1080 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all 1081 NT4 BDCs have been shut down can the Samba -3PDC be started.1081 NT4 BDCs have been shut down can the Samba PDC be started. 1082 1082 </para></step> 1083 1083 … … 1089 1089 1090 1090 <step><para> 1091 The configuration of Samba -3BDC servers can be accomplished now or at any1091 The configuration of Samba BDC servers can be accomplished now or at any 1092 1092 convenient time in the future. Please refer to the carefully detailed process 1093 1093 for doing so is outlined in <link linkend="sbehap-bldg1"/>. … … 1216 1216 1217 1217 <step><para> 1218 Prepare a Samba -3server precisely per the instructions shown in <link linkend="Big500users"/>.1218 Prepare a Samba server precisely per the instructions shown in <link linkend="Big500users"/>. 1219 1219 Set the workgroup name to <constant>MEGANET</constant>. 1220 1220 </para></step> … … 1396 1396 1397 1397 <para> 1398 Migration of an NT4 PDC database to a Samba -3PDC is possible.1398 Migration of an NT4 PDC database to a Samba PDC is possible. 1399 1399 </para> 1400 1400 … … 1409 1409 1410 1410 <listitem><para> 1411 Multiple NT4 domains can be merged into a single Samba -31411 Multiple NT4 domains can be merged into a single Samba 1412 1412 domain. 1413 1413 </para></listitem> 1414 1414 1415 1415 <listitem><para> 1416 The net Samba -3domain most likely requires some1416 The net Samba domain most likely requires some 1417 1417 administration and updating before going live. 1418 1418 </para></listitem> … … 1527 1527 <primary>LDAP database</primary> 1528 1528 </indexterm> 1529 Samba -3must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba1529 Samba must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1530 1530 does not fabricate the UNIX IDs from thin air, but rather requires them to be located 1531 1531 in a suitable place. … … 1632 1632 </indexterm> 1633 1633 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1634 Samba -3domain. Does it make any sense to migrate the machine accounts in that case?1634 Samba domain. Does it make any sense to migrate the machine accounts in that case? 1635 1635 </para> 1636 1636 … … 1649 1649 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1650 1650 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1651 unjoin the domain and then rejoin the newly renamed Samba -3domain, you can be certain to avoid1651 unjoin the domain and then rejoin the newly renamed Samba domain, you can be certain to avoid 1652 1652 this tattooing effect. 1653 1653 </para> … … 1662 1662 <primary>multiple group mappings</primary> 1663 1663 </indexterm> 1664 After merging multiple NT4 domains into a Samba -3domain, I lost all multiple group mappings. Why?1664 After merging multiple NT4 domains into a Samba domain, I lost all multiple group mappings. Why? 1665 1665 </para> 1666 1666 … … 1673 1673 <primary>/etc/group</primary> 1674 1674 </indexterm> 1675 Samba -3 currently does not implement multiple group membership internally. If you use the Windows1675 Samba currently does not implement multiple group membership internally. If you use the Windows 1676 1676 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group 1677 1677 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend, … … 1753 1753 <primary>vampire</primary> 1754 1754 </indexterm> 1755 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba -31755 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba 1756 1756 LDAP backend system using the vampire process? 1757 1757 </para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-MigrateNW4Samba3.xml
r414 r988 2 2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3 3 <chapter id="nw4migration"> 4 <title>Migrating NetWare Server to Samba -3</title>4 <title>Migrating NetWare Server to Samba</title> 5 5 6 6 <para> … … 137 137 the information presented in this chapter is provided to demonstrate 138 138 how Misty dealt with a particular NetWare migration requirement, and 139 it provides an overall approach to the implementation of a Samba -3139 it provides an overall approach to the implementation of a Samba 140 140 environment that is significantly divergent from that presented in 141 141 <link linkend="happy"/>. -
vendor/current/docs-xml/Samba3-ByExample/SBE-SecureOfficeServer.xml
r414 r988 10 10 and dependability. It was enough for the basic needs each was designed to fulfill. In 11 11 this chapter you address a more complex set of needs. The solution you explore 12 introduces you to basic features that are specific to Samba -3.12 introduces you to basic features that are specific to Samba. 13 13 </para> 14 14 15 15 <para> 16 16 You should note that a working and secure solution could be implemented using Samba-2.2.x. 17 In the exercises presented here, you are gradually using more Samba- 3-specific features,17 In the exercises presented here, you are gradually using more Samba-specific features, 18 18 so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given. 19 To avoid confusion, this book is all about Samba -3. Let's get the exercises in this19 To avoid confusion, this book is all about Samba. Let's get the exercises in this 20 20 chapter underway. 21 21 </para> … … 176 176 <para> 177 177 Many of the conclusions you draw here are obvious. Some requirements are not very clear 178 or may simply be your means of drawing the most out of Samba -3. Much can be done more simply178 or may simply be your means of drawing the most out of Samba. Much can be done more simply 179 179 than you will demonstrate here, but keep in mind that the network must scale to at least 500 180 180 users. This means that some functionality will be overdesigned for the current 130-user … … 235 235 The configuration of Web serving, Web proxy services, electronic mail, and the details of 236 236 generic antivirus handling are beyond the scope of this book and therefore are not 237 covered except insofar as this affects Samba -3.237 covered except insofar as this affects Samba. 238 238 </para> 239 239 … … 789 789 790 790 <step><para> 791 Install the Samba -3binary RPM from the Samba-Team FTP site. Assuming that the binary791 Install the Samba binary RPM from the Samba-Team FTP site. Assuming that the binary 792 792 RPM file is called <filename>samba-3.0.20-1.i386.rpm</filename>, one way to install this 793 793 file is as follows: … … 2214 2214 <para> 2215 2215 <indexterm><primary>GPL</primary></indexterm> 2216 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided 2216 Samba is provided under the terms of the GNU 2217 GPL Version 3, a copy of which is provided 2217 2218 with the source code. 2218 2219 </para> … … 2461 2462 The guideline provided in <emphasis>TOSHARG2</emphasis>, Chapter 10, Section 10.1.2, 2462 2463 is to limit the number of accounts in the tdbsam backend to 250. This is the point 2463 at which most networks tend to want backup domain controllers (BDCs). Samba -3does2464 at which most networks tend to want backup domain controllers (BDCs). Samba does 2464 2465 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The 2465 2466 limitation of 250 users per tdbsam is predicated only on the need for replication, … … 2540 2541 2541 2542 <para> 2542 The default order by which Samba -3attempts to communicate with MS Windows clients is via port 445 (the TCP port2543 The default order by which Samba attempts to communicate with MS Windows clients is via port 445 (the TCP port 2543 2544 used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS 2544 2545 over TCP/IP. In this configuration Windows network operations are predicated around NetBIOS over TCP/IP. By 2545 2546 specifying the use of only port 139, the intent is to reduce unsuccessful service connection attempts. 2546 The result of this is improved network performance. Where Samba -3is installed as an Active Directory Domain2547 The result of this is improved network performance. Where Samba is installed as an Active Directory Domain 2547 2548 member, the default behavior is highly beneficial and should not be changed. 2548 2549 </para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-SimpleOfficeServer.xml
r414 r988 19 19 Instead of a bland technical discussion, each principle is demonstrated by way of a 20 20 real-world scenario for which a working solution<footnote><para>The examples given mirror those documented 21 in The Official Samba -3HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional21 in The Official Samba HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional 22 22 insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4. 23 23 </para></footnote> is fully described. … … 148 148 149 149 <step><para> 150 Download the Samba -3RPM packages for Red Hat Fedora Core2 from the Samba150 Download the Samba RPM packages for Red Hat Fedora Core2 from the Samba 151 151 <ulink url="http://www.samba.org">FTP servers.</ulink> 152 152 </para></step> … … 557 557 created. Any new directories created still have the same owner, group, and permissions as the 558 558 directory they are in. This should eliminate all permissions-based file access problems. For 559 more information on this subject, refer to TOSHARG2<footnote><para>The Official Samba -3HOWTO and559 more information on this subject, refer to TOSHARG2<footnote><para>The Official Samba HOWTO and 560 560 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</para></footnote> or refer 561 561 to the UNIX man page for the <command>chmod</command> and the <command>chown</command> commands. … … 565 565 Install the &smb.conf; file shown in <link linkend="charity-smbconfnew"/> in the 566 566 <filename>/etc/samba</filename> directory. This newer &smb.conf; file uses user-mode security 567 and is more suited to the mode of operation of Samba -3than the older share-mode security567 and is more suited to the mode of operation of Samba than the older share-mode security 568 568 configuration that was shown in the first edition of this book. 569 569 </para> … … 1098 1098 1099 1099 <procedure> 1100 <title>Migration from Windows NT4 Workstation System to Samba -3</title>1100 <title>Migration from Windows NT4 Workstation System to Samba</title> 1101 1101 1102 1102 <step><para><indexterm> … … 1114 1114 1115 1115 <step><para> 1116 Install the latest Samba -3binary Red Hat Linux RPM that is available from the1116 Install the latest Samba binary Red Hat Linux RPM that is available from the 1117 1117 Samba FTP site. 1118 1118 </para></step> … … 1249 1249 1250 1250 <step><para> 1251 Verify that the files are being copied correctly from the Windows NT4 machine to the Samba -3server.1252 This is best done on the Samba -3 server. Check the contents of the directory tree under1251 Verify that the files are being copied correctly from the Windows NT4 machine to the Samba server. 1252 This is best done on the Samba server. Check the contents of the directory tree under 1253 1253 <filename>/data</filename> by executing the following command: 1254 1254 <screen> -
vendor/current/docs-xml/Samba3-ByExample/SBE-Support.xml
r414 r988 77 77 url="https://lists.samba.org/mailman/">web</ulink> site. The public mailing list that can be used to obtain 78 78 free, user contributed, support is called the <literal>samba</literal> list. The email address for this list 79 is at <literal>mail:samba@ samba.org</literal>. Information regarding the Samba IRC channels may be found on79 is at <literal>mail:samba@lists.samba.org</literal>. Information regarding the Samba IRC channels may be found on 80 80 the Samba <ulink url="http://www.samba.org/samba.irc.html">IRC</ulink> web page. 81 81 </para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-TheSmallOffice.xml
r414 r988 174 174 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is 175 175 possible to start with the installation that you have created here, migrate it 176 to a Samba -3configuration, and then secure the system further. Configurations following176 to a Samba configuration, and then secure the system further. Configurations following 177 177 this one utilize features that may not be supported in Samba-2.2.x releases. 178 178 However, you should note that the examples in each chapter start with the assumption … … 317 317 318 318 <step><para> 319 Install the Samba -3binary RPM from the Samba-Team FTP site.319 Install the Samba binary RPM from the Samba-Team FTP site. 320 320 </para></step> 321 321 … … 1139 1139 1140 1140 <para> 1141 Samba -3does not permit a Domain Group to become visible to Domain network clients unless the account1141 Samba does not permit a Domain Group to become visible to Domain network clients unless the account 1142 1142 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 1143 1143 <guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>. … … 1222 1222 <para> 1223 1223 If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective 1224 SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba -3)1224 SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba) 1225 1225 or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 1226 1226 to check the man page for this command for detailed instructions regarding the steps involved. … … 1241 1241 1242 1242 <para> 1243 Samba -3implements a Windows NT4-style security domain architecture. This type of Domain cannot1243 Samba implements a Windows NT4-style security domain architecture. This type of Domain cannot 1244 1244 be managed using tools present on a Windows XP Professional installation. You may download from the 1245 1245 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use 1246 1246 it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event 1247 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba -31247 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba 1248 1248 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant> 1249 for the Samba -3Domain. It may help to log on as the <constant>root</constant> account.1249 for the Samba Domain. It may help to log on as the <constant>root</constant> account. 1250 1250 </para> 1251 1251 -
vendor/current/docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml
r414 r988 2 2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3 3 <chapter id="upgrades"> 4 <title>Updating Samba -3</title>4 <title>Updating Samba</title> 5 5 6 6 <para> … … 17 17 <indexterm><primary>smbpasswd</primary></indexterm> 18 18 <indexterm><primary>passdb backend</primary></indexterm> 19 There has also been much talk about migration of Samba -3from an smbpasswd19 There has also been much talk about migration of Samba from an smbpasswd 20 20 passdb backend to the use of the tdbsam or ldapsam facilities that are new 21 to Samba -3.21 to Samba. 22 22 </para> 23 23 … … 232 232 <indexterm><primary>SAS</primary></indexterm> 233 233 <indexterm><primary>SID</primary></indexterm> 234 In Samba -3on a domain controller (PDC or BDC), the domain name controls the domain234 In Samba on a domain controller (PDC or BDC), the domain name controls the domain 235 235 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 236 236 the SID. On a standalone server the hostname still controls the SID. … … 240 240 <indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm> 241 241 <indexterm><primary>net</primary><secondary>setlocalsid</secondary></indexterm> 242 The local machine SID can be backed up using this procedure (Samba -3):242 The local machine SID can be backed up using this procedure (Samba): 243 243 <screen> 244 244 &rootprompt; net getlocalsid > /etc/samba/my-local-SID … … 262 262 <para> 263 263 Where the <filename>secrets.tdb</filename> file exists and a version of Samba 2.x or later 264 has been used, there is no specific need to go through this update process. Samba -3has the264 has been used, there is no specific need to go through this update process. Samba has the 265 265 ability to read the older tdb file and to perform an in-situ update to the latest tdb format. 266 266 This is not a reversible process &smbmdash; it is a one-way upgrade. … … 296 296 &rootprompt; rpcclient hostname lsaquery -Uroot%password 297 297 </screen> 298 This can also be done with Samba -3by executing:298 This can also be done with Samba by executing: 299 299 <screen> 300 300 &rootprompt; net rpc info -Uroot%password … … 431 431 <para> 432 432 <indexterm><primary>compile-time</primary></indexterm> 433 Samba -3provides a neat new way to track the location of all control files as well as to433 Samba provides a neat new way to track the location of all control files as well as to 434 434 find the compile-time options used as the Samba package was built. Here is how the dark 435 435 secrets of the internals of the location of control files within Samba executables can … … 482 482 <indexterm><primary>internationalization</primary></indexterm> 483 483 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 484 was done using particular locale codepage mapping techniques. Samba -3supports Unicode in file names, thus484 was done using particular locale codepage mapping techniques. Samba supports Unicode in file names, thus 485 485 providing true internationalization support. 486 486 </para> … … 496 496 <para> 497 497 <indexterm><primary>UTF-8</primary></indexterm> 498 Files that are created with Samba -3will use UTF-8 encoding. Should the file system ever end up with a498 Files that are created with Samba will use UTF-8 encoding. Should the file system ever end up with a 499 499 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 500 500 effort to set straight. … … 682 682 <para> 683 683 <indexterm><primary>parameters</primary></indexterm> 684 The following parameters are new to Samba -3and should be correctly configured.684 The following parameters are new to Samba and should be correctly configured. 685 685 Please refer to <link linkend="secure"/> through <link linkend="net2000users"/> 686 686 in this book for examples of use of the new parameters shown here: … … 710 710 <indexterm><primary>add user script</primary></indexterm> 711 711 The <parameter>add machine script</parameter> functionality was previously 712 handled by the <parameter>add user script</parameter>, which in Samba -3is712 handled by the <parameter>add user script</parameter>, which in Samba is 713 713 used exclusively to add user accounts. 714 714 </para> … … 749 749 Samba version 2.x could be compiled for use either with or without LDAP. 750 750 The LDAP control settings in the &smb.conf; file in this old version are 751 completely different (and less complete) than they are with Samba -3. This751 completely different (and less complete) than they are with Samba. This 752 752 means that after migrating the control files, it is necessary to reconfigure 753 753 the LDAP settings entirely. … … 828 828 * ldapsam - attribute rich account storage and retrieval 829 829 backend utilizing an LDAP directory. 830 * ldapsam_compat - a 2.2 backward compatible LDAP account831 backend832 830 833 831 Certain functions of the smbpasswd(8) tool have been split between the 834 832 new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) 835 833 utility. See the respective man pages for details. 836 837 ######################################################################838 LDAP839 ####840 841 This section outlines the new features affecting Samba / LDAP842 integration.843 844 New Schema845 ----------846 847 A new object class (sambaSamAccount) has been introduced to replace848 the old sambaAccount. This change aids us in the renaming of849 attributes to prevent clashes with attributes from other vendors.850 There is a conversion script (examples/LDAP/convertSambaAccount) to851 modify and LDIF file to the new schema.852 853 Example:854 855 $ ldapsearch .... -b "ou=people,dc=..." > sambaAcct.ldif856 $ convertSambaAccount --sid=<Domain SID> \857 --input=sambaAcct.ldif --output=sambaSamAcct.ldif \858 --changetype=[modify|add]859 860 The <DOM SID> can be obtained by running 'net getlocalsid861 <DOMAINNAME>' on the Samba PDC as root. The changetype determines862 the format of the generated LDIF output--either create new entries863 or modify existing entries.864 865 The old sambaAccount schema may still be used by specifying the866 "ldapsam_compat" passdb backend. However, the sambaAccount and867 associated attributes have been moved to the historical section of868 the schema file and must be uncommented before use if needed.869 The 2.2 object class declaration for a sambaAccount has not changed870 in the 3.0 samba.schema file.871 872 Other new object classes and their uses include:873 874 * sambaDomain - domain information used to allocate rids875 for users and groups as necessary. The attributes are added876 in 'ldap suffix' directory entry automatically if877 an idmap uid/gid range has been set and the 'ldapsam'878 passdb backend has been selected.879 880 * sambaGroupMapping - an object representing the881 relationship between a posixGroup and a Windows882 group/SID. These entries are stored in the 'ldap883 group suffix' and managed by the 'net groupmap' command.884 885 * sambaUnixIdPool - created in the 'ldap idmap suffix' entry886 automatically and contains the next available 'idmap uid' and887 'idmap gid'888 889 * sambaIdmapEntry - object storing a mapping between a890 SID and a UNIX uid/gid. These objects are created by the891 idmap_ldap module as needed.892 893 * sambaSidEntry - object representing a SID alone, as a Structural894 class on which to build the sambaIdmapEntry.895 896 834 897 835 New Suffix for Searching … … 974 912 975 913 <sect2> 976 <title>Samba -3to Samba-3 Updates on the Same Server</title>914 <title>Samba to Samba-3 Updates on the Same Server</title> 977 915 978 916 <para> 979 917 The guidance in this section deals with updates to an existing 980 Samba -3server installation.918 Samba server installation. 981 919 </para> 982 920 … … 985 923 986 924 <para> 987 With the provision that the binary Samba -3package has been built988 with the same path and feature settings as the existing Samba -3989 package that is being updated, an update of Samba -3versions 3.0.0925 With the provision that the binary Samba package has been built 926 with the same path and feature settings as the existing Samba 927 package that is being updated, an update of Samba versions 3.0.0 990 928 through 3.0.4 can be updated to 3.0.5 without loss of functionality 991 929 and without need to change either the &smb.conf; file or, where … … 1001 939 <indexterm><primary>schema</primary></indexterm> 1002 940 <indexterm><primary>LDAP</primary><secondary>schema</secondary></indexterm> 1003 When updating versions of Samba -3prior to 3.0.6 to 3.0.6 through 3.0.10,941 When updating versions of Samba prior to 3.0.6 to 3.0.6 through 3.0.10, 1004 942 it is necessary only to update the LDAP schema (where LDAP is used). 1005 Always use the LDAP schema file that is shipped with the latest Samba -3943 Always use the LDAP schema file that is shipped with the latest Samba 1006 944 update. 1007 945 </para> … … 1065 1003 1066 1004 <sect2> 1067 <title>Migrating Samba -3to a New Server</title>1005 <title>Migrating Samba to a New Server</title> 1068 1006 1069 1007 <para> -
vendor/current/docs-xml/Samba3-ByExample/SBE-preface.xml
r414 r988 16 16 This book is your means to the straight path. It provides step-by-step, 17 17 proven, working examples of Samba deployments. If you want to deploy 18 Samba -3with the least effort, or if you want to become an expert at deploying19 Samba -3without having to search through lots of documentation, this18 Samba with the least effort, or if you want to become an expert at deploying 19 Samba without having to search through lots of documentation, this 20 20 book is the ticket to your destination. 21 21 </para> … … 42 42 43 43 <para> 44 The focus of attention in this book is Samba -3. Specific notes are made in44 The focus of attention in this book is Samba. Specific notes are made in 45 45 respect of how Samba may be made secure. This book does not attempt to provide 46 46 detailed information regarding secure operation and configuration of peripheral … … 75 75 All example case configuration files, scripts, and other tools are provided 76 76 on the CD-ROM. This book is descriptive, provides detailed diagrams, and 77 makes deployment of Samba -3a breeze.77 makes deployment of Samba a breeze. 78 78 </para> 79 79 … … 87 87 necessitate this documentation update. This update has the specific intent to 88 88 refocus this book so that its guidance can be followed for samba-3.0.20 89 and beyond. Further changes are expected as Samba -3 matures further and will89 and beyond. Further changes are expected as Samba matures further and will 90 90 be reflected in future updates. 91 91 </para> … … 426 426 </para> 427 427 428 <para><emphasis>TechInfo</emphasis> &smbmdash; Slave LDAP servers are introduced. Samba is429 configured to use multiple LDAP backends. This is a brief chapter; it assumes that the428 <para><emphasis>TechInfo</emphasis> &smbmdash; Slave 429 LDAP servers are introduced. This is a brief chapter; it assumes that the 430 430 technology has been mastered and gets right down to concepts and how to deploy them. 431 431 </para> … … 456 456 457 457 <varlistentry> 458 <term>Chapter 8 &smbmdash; Updating Samba -3.</term><listitem>458 <term>Chapter 8 &smbmdash; Updating Samba.</term><listitem> 459 459 <para> 460 460 This chapter is the result of repeated requests for better documentation of the steps … … 473 473 474 474 <varlistentry> 475 <term>Chapter 9 &smbmdash; Migrating NT4 Domain to Samba -3.</term><listitem>475 <term>Chapter 9 &smbmdash; Migrating NT4 Domain to Samba.</term><listitem> 476 476 <para> 477 477 Another six months have passed. Abmas has acquired yet another company. You will find a … … 492 492 <para> 493 493 Misty Stanley-Jones has contributed information that summarizes her experience at migration 494 from a NetWare server to Samba -3.494 from a NetWare server to Samba. 495 495 </para> 496 496 … … 523 523 <term>Chapter 12 &smbmdash; Integrating Additional Services.</term><listitem> 524 524 <para> 525 The battle is almost over, Samba -3has won the day. Your team are delighted and now you525 The battle is almost over, Samba has won the day. Your team are delighted and now you 526 526 find yourself at yet another cross-roads. Abmas have acquired a snack food business, you 527 527 made promises you must keep. IT costs must be reduced, you have new resistance, but you … … 533 533 <para><emphasis>TechInfo</emphasis> &smbmdash; Samba provides the <command>ntlm_auth</command> 534 534 module that makes it possible for MS Windows Internet Explorer to connect via the Squid Web 535 and FTP proxy server. You will configure Samba -3as well as Squid to deliver authenticated535 and FTP proxy server. You will configure Samba as well as Squid to deliver authenticated 536 536 access control using the Active Directory Domain user security credentials. 537 537 </para> -
vendor/current/docs-xml/Samba3-ByExample/index.xml
r414 r988 94 94 Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other 95 95 subject is that of how to migrate from and NT4 Domain, a NetWare server, or from an earlier 96 Samba version to environments that use the most recent Samba -3 release.96 Samba version to environments that use the most recent Samba release. 97 97 </para> 98 98 … … 130 130 131 131 <?latex \cleardoublepage ?> 132 <xi:include href="SBE-KerberosFastStart.xml"/>133 <?latex \cleardoublepage ?>134 132 <xi:include href="SBE-DomainAppsSupport.xml"/> 135 133 <?latex \cleardoublepage ?>
Note:
See TracChangeset
for help on using the changeset viewer.
