Ignore:
Timestamp:
Nov 24, 2016, 1:14:11 PM (9 years ago)
Author:
Silvan Scherrer
Message:

Samba Server: update vendor to version 4.4.3

Location:
vendor/current/docs-xml/Samba3-HOWTO
Files:
6 deleted
34 edited

Legend:

Unmodified
Added
Removed

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml

    r746 r988  
    5555<indexterm><primary>network administrator</primary></indexterm>
    5656The purpose of this chapter is to present each of the points of control that are possible with
    57 Samba-3 in the hope that this will help the network administrator to find the optimum method
     57Samba in the hope that this will help the network administrator to find the optimum method
    5858for delivering the best environment for MS Windows desktop users.
    5959</para>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml

    r414 r988  
    3434<indexterm><primary>LDAP</primary><secondary>slave</secondary></indexterm>
    3535<indexterm><primary>scalability</primary></indexterm>
    36 Samba-3 can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
    37 Samba-3 PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
     36Samba can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
     37Samba PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
    3838server or a slave server. The use of a slave LDAP server has the benefit that when the master is down, clients
    3939may still be able to log onto the network.  This effectively gives Samba a high degree of scalability and is
    … …  
    4848<indexterm><primary>non-LDAP</primary><secondary>backend</secondary></indexterm>
    4949<indexterm><primary>propagate</primary></indexterm>
    50 While it is possible to run a Samba-3 BDC with a non-LDAP backend, that backend must allow some form of
     50It is not possible to run a Samba BDC with a non-LDAP backend, as that backend must allow some form of
    5151"two-way" propagation of changes from the BDC to the master.  At this time only LDAP delivers the capability
    5252to propagate identity database changes from the BDC to the PDC. The BDC can use a slave LDAP server, while it
    5353is preferable for the PDC to use as its primary an LDAP master server.
    5454</para>
    55 
    56 <para>
    57 <indexterm><primary>non-LDAP</primary><secondary>backend</secondary></indexterm>
    58 <indexterm><primary>SAM backend</primary><secondary>non-LDAP</secondary></indexterm>
    59 <indexterm><primary>domain</primary><secondary>member</secondary><tertiary>server</tertiary></indexterm>
    60 <indexterm><primary>BDC</primary></indexterm>
    61 <indexterm><primary>PDC</primary></indexterm>
    62 <indexterm><primary>trust account password</primary></indexterm>
    63 <indexterm><primary>domain trust</primary></indexterm>
    64 The use of a non-LDAP backend SAM database is particularly problematic because domain member
    65 servers and workstations periodically change the Machine Trust Account password. The new
    66 password is then stored only locally. This means that in the absence of a centrally stored
    67 accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running
    68 as a BDC, the BDC instance of the domain member trust account password will not reach the
    69 PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in
    70 overwriting the SAM that contains the updated (changed) trust account password with resulting
    71 breakage of the domain trust.
    72 </para>
    73 
    74 <para>
    75 <indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
    76 <indexterm><primary>SAM backend</primary><secondary>ldapsam</secondary></indexterm>
    77 <indexterm><primary>SAM backend</primary><secondary>tdbsam</secondary></indexterm>
    78 <indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
    79 Considering the number of comments and questions raised concerning how to configure a BDC,
    80 let's consider each possible option and look at the pros and cons for each possible solution.
    81 <link linkend="pdc-bdc-table">The Domain Backend Account Distribution Options table below</link> lists
    82 possible design configurations for a PDC/BDC infrastructure.
    83 </para>
    84 
    85 <table frame="all" id="pdc-bdc-table"><title>Domain Backend Account Distribution Options</title>
    86 <tgroup cols="3">
    87         <colspec align="center" colwidth="1*"/>
    88         <colspec align="center" colwidth="1*"/>
    89         <colspec align="left" colwidth="3*"/>
    90 
    91         <thead>
    92         <row><entry>PDC Backend</entry><entry>BDC Backend</entry><entry>Notes/Discussion</entry></row>
    93         </thead>
    94         <tbody>
    95         <row>
    96         <entry><para>Master LDAP Server</para></entry>
    97         <entry><para>Slave LDAP Server</para></entry>
    98         <entry><para>The optimal solution that provides high integrity. The SAM will be
    99                 replicated to a common master LDAP server.</para></entry>
    100         </row>
    101         <row>
    102         <entry><para>Single Central LDAP Server</para></entry>
    103         <entry><para>Single Central LDAP Server</para></entry>
    104         <entry><para>
    105         A workable solution without failover ability. This is a usable solution, but not optimal.
    106         </para></entry>
    107         </row>
    108         <row>
    109         <entry><para>tdbsam</para></entry>
    110         <entry><para>tdbsam + <command>net rpc vampire</command></para></entry>
    111         <entry><para>
    112         Does not work with Samba-3.0; Samba does not implement the
    113         server-side protocols required.
    114         </para></entry>
    115         </row>
    116         <row>
    117         <entry><para>tdbsam</para></entry>
    118         <entry><para>tdbsam + <command>rsync</command></para></entry>
    119         <entry><para>
    120         Do not use this configuration.
    121         Does not work because the TDB files are live and data may not
    122         have been flushed to disk.  Furthermore, this will cause
    123         domain trust breakdown.
    124         </para></entry>
    125         </row>
    126         <row>
    127         <entry><para>smbpasswd file</para></entry>
    128         <entry><para>smbpasswd file</para></entry>
    129         <entry><para>
    130         Do not use this configuration.
    131         Not an elegant solution due to the delays in synchronization
    132         and also suffers
    133         from the issue of domain trust breakdown.
    134         </para></entry>
    135         </row>
    136         </tbody>
    137 </tgroup>
    138 </table>
    13955
    14056</sect1>
    … …  
    260176<indexterm><primary>PDC</primary></indexterm>
    261177<indexterm><primary>BDC</primary></indexterm>
    262 Samba-3 cannot participate in true SAM replication and is therefore not able to
    263 employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will
     178Samba cannot participate in true SAM replication and is therefore not able to
     179employ precisely the same protocols used by MS Windows NT4. A Samba BDC will
    264180not create SAM update delta files. It will not interoperate with a PDC (NT4 or Samba)
    265181to synchronize the SAM from delta files that are held by BDCs.
    … …  
    269185<indexterm><primary>PDC</primary></indexterm>
    270186<indexterm><primary>BDC</primary></indexterm>
    271 Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
    272 function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows
     187Samba cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
     188function correctly as a PDC to an MS Windows NT4 BDC. Both Samba and MS Windows
    273189NT4 can function as a BDC to its own type of PDC.
    274190</para>
    … …  
    293209be promoted to a PDC. If this happens while the original NT4 PDC is online, it is automatically demoted to an
    294210NT4 BDC. This is an important aspect of domain controller management. The tool that is used to effect a
    295 promotion or a demotion is the Server Manager for Domains. It should be noted that Samba-3 BDCs cannot be
     211promotion or a demotion is the Server Manager for Domains. It should be noted that Samba BDCs cannot be
    296212promoted in this manner because reconfiguration of Samba requires changes to the &smb.conf; file. It is easy
    297213enough to manuall change the &smb.conf; file and then restart relevant Samba network services.
    … …  
    454370As of the release of MS Windows 2000 and Active Directory, this information is now stored
    455371in a directory that can be replicated and for which partial or full administrative control
    456 can be delegated. Samba-3 is not able to be a domain controller within an Active Directory
    457 tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot
    458 act as a BDC to an Active Directory domain controller.
     372can be delegated. Samba-4.0 is able to be a domain controller within an Active Directory
     373tree, and it can be an Active Directory server.  The details for how
     374this can be done are documented in the <ulink
     375url="https://wiki.samba.org/index.php/Samba4/HOWTO">Samba 4.0 as an
     376AD DC HOWTO</ulink>
     377
    459378</para>
    460379
    … …  
    554473
    555474<itemizedlist>
    556         <listitem><para>
    557         <indexterm><primary>SID</primary></indexterm>
    558         <indexterm><primary>PDC</primary></indexterm>
    559         <indexterm><primary>BDC</primary></indexterm>
    560         <indexterm><primary>private/secrets.tdb</primary></indexterm>
    561         <indexterm><primary>private/MACHINE.SID</primary></indexterm>
    562         <indexterm><primary>domain SID</primary></indexterm>
    563         The domain SID has to be the same on the PDC and the BDC. In Samba versions pre-2.2.5, the domain SID was
    564         stored in the file <filename>private/MACHINE.SID</filename>.  For all versions of Samba released since 2.2.5
    565         the domain SID is stored in the file <filename>private/secrets.tdb</filename>. This file is unique to each
    566         server and cannot be copied from a PDC to a BDC; the BDC will generate a new SID at startup. It will overwrite
    567         the PDC domain SID with the newly created BDC SID.  There is a procedure that will allow the BDC to acquire the
    568         domain SID. This is described here.
    569         </para>
    570 
    571         <para>
    572         <indexterm><primary>domain SID</primary></indexterm>
    573         <indexterm><primary>PDC</primary></indexterm>
    574         <indexterm><primary>BDC</primary></indexterm>
    575         <indexterm><primary>secrets.tdb</primary></indexterm>
    576         <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>getsid</tertiary></indexterm>
    577         To retrieve the domain SID from the PDC or an existing BDC and store it in the
    578         <filename>secrets.tdb</filename>, execute:
    579         </para>
    580 <screen>
    581 &rootprompt;<userinput>net rpc getsid</userinput>
    582 </screen>
    583         </listitem>
    584 
    585475        <listitem><para>
    586476        <indexterm><primary>secrets.tdb</primary></indexterm>
    … …  
    624514        <indexterm><primary>LDAP</primary></indexterm>
    625515        The Samba password database must be replicated from the PDC to the BDC.
    626         Although it is possible to synchronize the <filename>smbpasswd</filename>
    627         file with <command>rsync</command> and <command>ssh</command>, this method
    628         is broken and flawed, and is therefore not recommended. A better solution
     516        The solution
    629517        is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC.
    630518        The use of rsync is inherently flawed by the fact that the data will be replicated
    … …  
    732620<indexterm><primary>domain member server</primary></indexterm>
    733621<indexterm><primary>idmap backend</primary></indexterm>
    734 Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it
     622Samba has introduced a new ID mapping facility. One of the features of this facility is that it
    735623allows greater flexibility in how user and group IDs are handled in respect to NT domain user and group
    736624SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values
    … …  
    805693<indexterm><primary>PDC</primary></indexterm>
    806694<indexterm><primary>logon requests</primary></indexterm>
    807 Can I get the benefits of a BDC with Samba?  Yes, but only to a Samba PDC.The
     695Can I get the benefits of a BDC with Samba?  Yes, but only to a Samba
     696PDC or as a <ulink
     697url="https://wiki.samba.org/index.php/Samba4/HOWTO">Samba 4.0 Active
     698Directory domain controller.</ulink>  The
    808699main reason for implementing a BDC is availability. If the PDC is a Samba
    809700machine, a second Samba machine can be set up to service logon requests whenever
    … …  
    813704</sect2>
    814705
    815 <sect2>
    816 <title>How Do I Replicate the smbpasswd File?</title>
    817 
    818 <para>
    819 <indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
    820 <indexterm><primary>smbpasswd</primary></indexterm>
    821 <indexterm><primary>SAM</primary></indexterm>
    822 Replication of the smbpasswd file is sensitive. It has to be done whenever changes
    823 to the SAM are made. Every user's password change is done in the smbpasswd file and
    824 has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary.
    825 </para>
    826 
    827 <para>
    828 <indexterm><primary>plaintext password</primary></indexterm>
    829 <indexterm><primary>ssh</primary></indexterm>
    830 <indexterm><primary>rsync</primary></indexterm>
    831 As the smbpasswd file contains plaintext password equivalents, it must not be
    832 sent unencrypted over the wire. The best way to set up smbpasswd replication from
    833 the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport.
    834 <command>ssh</command> itself can be set up to accept <emphasis>only</emphasis>
    835 <command>rsync</command> transfer without requiring the user to type a password.
    836 </para>
    837 
    838 <para>
    839 <indexterm><primary>machine trust accounts</primary></indexterm>
    840 <indexterm><primary>LDAP</primary></indexterm>
    841 As said a few times before, use of this method is broken and flawed. Machine trust
    842 accounts will go out of sync, resulting in a broken domain. This method is
    843 <emphasis>not</emphasis> recommended. Try using LDAP instead.
    844 </para>
    845 
    846 </sect2>
    847 
    848 <sect2>
    849 <title>Can I Do This All with LDAP?</title>
    850 
    851 <para>
    852 <indexterm><primary>pdb_ldap</primary></indexterm>
    853 <indexterm><primary>LDAP</primary></indexterm>
    854 The simple answer is yes. Samba's pdb_ldap code supports binding to a replica
    855 LDAP server and will also follow referrals and rebind to the master if it ever
    856 needs to make a modification to the database. (Normally BDCs are read-only, so
    857 this will not occur often).
    858 </para>
    859 
    860 </sect2>
    861706</sect1>
    862707</chapter>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml

    r414 r988  
    3333
    3434<para>
    35 <indexterm><primary>comp.protocols.smb</primary></indexterm>
    36 <indexterm><primary>newsgroup</primary></indexterm>
    3735<indexterm><primary>configuration problem</primary></indexterm>
    38 If you post the bug to the comp.protocols.smb
    39 newsgroup or the mailing list, do not assume that we will read it. If you suspect that your
    40 problem is not a bug but a configuration problem, it is better to send
     36If you suspect that your
     37problem is not a bug but a configuration problem, it is best to send
    4138it to the Samba mailing list, as there are thousands of other users on
    4239that list who may be able to help you.
    … …  
    261258of the spinning process and type:
    262259<screen>
    263 &rootprompt; gdb /usr/local/samba/sbin/smbd
     260&rootprompt; gdb -p PID
    264261</screen>
    265262<indexterm><primary>spinning process</primary></indexterm>
    266 then <quote>attach `pid'</quote> (of the spinning process), then type <quote>bt</quote> to
     263then type <quote>bt full</quote> to
    267264get a backtrace to see where the smbd is in the call path.
    268265</para>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml

    r746 r988  
    9999<indexterm><primary>Printcap</primary></indexterm>
    100100<indexterm><primary>PrintcapFormat</primary></indexterm>
    101 Printing with CUPS in the most basic &smb.conf; setup in Samba-3.0 (as was true for 2.2.x) requires just two
    102 parameters: <smbconfoption name="printing">cups</smbconfoption> and <smbconfoption
    103 name="printcap">cups</smbconfoption>. CUPS does not need a printcap file.  However, the
     101Printing with CUPS in the most basic &smb.conf; setup in Samba requires just this parameter: <smbconfoption name="printing">cups</smbconfoption>. CUPS does not need a printcap file.  However, the
    104102<filename>cupsd.conf</filename> configuration file knows of two related directives that control how such a
    105103file will be automatically created and maintained by CUPS for the convenience of third-party applications
    … …  
    117115        <para>
    118116<indexterm><primary>libcups.so</primary></indexterm>
    119         Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support.
     117        Samba has a special relationship to CUPS, and to use CUPS Samba must be compiled with CUPS library support.
    120118        Most recent installations have this support enabled. By default, CUPS linking is compiled
    121         into smbd and other Samba binaries. Of course, you can use CUPS even
    122         if Samba is not linked against <filename>libcups.so</filename> &smbmdash; but
    123         there are some differences in required or supported configuration.
    124         </para>
    125 
    126         <para>
    127 <indexterm><primary>libcups</primary></indexterm>
    128 <indexterm><primary>ldd</primary></indexterm>
    129         When Samba is compiled and linked with <filename>libcups</filename>, <smbconfoption name="printcap">cups</smbconfoption>
    130         uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V
    131         commands with an additional <command>-oraw</command> option for printing. On a Linux
    132         system, you can use the <command>ldd</command> utility to find out if smbd has been linked with the
    133         libcups library (<command>ldd</command> may not be present on other OS platforms, or its function may be embodied
    134         by a different command):
    135 <screen>
    136 &rootprompt;<userinput>ldd `which smbd`</userinput>
    137 libssl.so.0.9.6 =&gt; /usr/lib/libssl.so.0.9.6 (0x4002d000)
    138 libcrypto.so.0.9.6 =&gt; /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
    139 libcups.so.2 =&gt; /usr/lib/libcups.so.2 (0x40123000)
    140 [....]
    141 </screen>
    142         </para>
    143 
    144         <para>
    145 <indexterm><primary>libcups.so.2</primary></indexterm>
    146         The line <computeroutput>libcups.so.2 =&gt; /usr/lib/libcups.so.2 (0x40123000)</computeroutput> shows
    147         there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups
    148         is set, then <emphasis>any otherwise manually set print command in &smb.conf; is ignored</emphasis>.
    149         This is an important point to remember!
    150         </para>
    151 
    152         <tip><para> Should it be necessary, for any reason, to set your own print commands, you can do this by setting
    153         <smbconfoption name="printing">sysv</smbconfoption>. However, you will lose all the benefits
    154         of tight CUPS-Samba integration. When you do this, you must manually configure the printing system commands
    155         (most important:
    156         <smbconfoption name="print command"/>; other commands are
    157         <smbconfoption name="lppause command"/>,
    158         <smbconfoption name="lpresume command"/>,
    159         <smbconfoption name="lpq command"/>,
    160         <smbconfoption name="lprm command"/>,
    161         <smbconfoption name="queuepause command"/> and
    162         <smbconfoption name="queue resume command"/>).
    163         </para></tip>
     119        into smbd and other Samba binaries.  The parameter
     120        <smbconfoption name="printing">cups</smbconfoption> will only
     121        be accepted if this is the case.
     122        </para>
    164123
    165124        </sect2>
    … …  
    180139        <smbconfoption name="load printers">yes</smbconfoption>
    181140        <smbconfoption name="printing">cups</smbconfoption>
    182         <smbconfoption name="printcap name">cups</smbconfoption>
    183141
    184142        <smbconfsection name="[printers]"/>
    … …  
    189147        <smbconfoption name="writable">no</smbconfoption>
    190148        <smbconfoption name="printable">yes</smbconfoption>
    191         <smbconfoption name="printer admin">root, @ntadmins, @smbprintadm</smbconfoption>
    192149        </smbconfblock>
    193150        </example>
    … …  
    224181        <smbconfsection name="[global]"/>
    225182        <smbconfoption name="printing">cups</smbconfoption>
    226         <smbconfoption name="printcap name">cups</smbconfoption>
    227183        <smbconfoption name="load printers">yes</smbconfoption>
    228184
    … …  
    233189        <smbconfoption name="writable">no</smbconfoption>
    234190        <smbconfoption name="printable">yes</smbconfoption>
    235         <smbconfoption name="printer admin">root, @ntadmins, @smbprintadm</smbconfoption>
    236191
    237192        <smbconfsection name="[special_printer]"/>
    … …  
    244199        <smbconfoption name="writable">no</smbconfoption>
    245200        <smbconfoption name="printable">yes</smbconfoption>
    246         <smbconfoption name="printer admin">kurt</smbconfoption>
    247201        <smbconfoption name="hosts deny">0.0.0.0</smbconfoption>
    248202        <smbconfoption name="hosts allow">turbo_xp, 10.160.50.23, 10.160.51.60</smbconfoption>
    … …  
    252206        <para>
    253207        This special share is only for testing purposes. It does not write the print job to a file. It just logs the job parameters
    254         known to Samba into the <filename>/tmp/smbprn.log</filename> file and deletes the job-file. Moreover, the
    255         <smbconfoption name="printer admin"/> of this share is <quote>kurt</quote> (not the <quote>@ntadmins</quote> group),
    256         guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it
     208        known to Samba into the <filename>/tmp/smbprn.log</filename> file and deletes the job-file. Moreover, guest access is not
     209        allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it
    257210        allows access from only three hosts. To prevent CUPS from kicking in and taking over the print jobs for that share, we need to set
    258211        <smbconfoption name="printing">sysv</smbconfoption> and <smbconfoption name="printcap">lpstat</smbconfoption>.
    … …  
    22032156<smbconfblock>
    22042157<smbconfoption name="printing">cups</smbconfoption>
    2205 <smbconfoption name="printcap">cups</smbconfoption>
    22062158</smbconfblock>
    22072159
    … …  
    22092161When these parameters are specified, all manually set print directives (like <smbconfoption name="print
    22102162command"/> or <smbconfoption name="lppause command"/>) in &smb.conf; (as well as in Samba itself) will be
    2211 ignored. Instead, Samba will directly interface with CUPS through its application program interface (API), as
    2212 long as Samba has been compiled with CUPS library (libcups) support. If Samba has not been compiled with CUPS
    2213 support, and if no other print commands are set up, then printing will use the <emphasis>System V</emphasis>
    2214 AT&amp;T command set, with the -oraw option automatically passing through (if you want your own defined print
    2215 commands to work with a Samba server that has CUPS support compiled in, simply use <smbconfoption
    2216 name="classicalprinting">sysv</smbconfoption>). This is illustrated in <link linkend="f13small">the Printing via
     2163ignored. Instead, Samba will directly interface with CUPS through its
     2164application program interface (API).
     2165This is illustrated in <link linkend="f13small">the Printing via
    22172166CUPS/Samba Server diagram</link>.
    22182167</para>
    … …  
    47374686                        <smbconfoption name="printing">cups</smbconfoption>.</para></listitem>
    47384687
    4739         <listitem><para>Another Samba &smb.conf; setting of
    4740                         <smbconfoption name="printcap">cups</smbconfoption>.</para></listitem>
    47414688</itemizedlist>
    47424689
    … …  
    47524699</sect2>
    47534700
    4754 <sect2>
    4755 <title>Manual Configuration</title>
    4756 
    4757 <para>
    4758 If you want to do things manually, replace the <smbconfoption name="printing">cups</smbconfoption>
    4759 by <smbconfoption name="printing">bsd</smbconfoption>. Then your manually set commands may work
    4760 (I haven't tested this), and a <smbconfoption name="print command">lp -d %P %s; rm %s</smbconfoption>
    4761 may do what you need.
    4762 </para>
    4763 </sect2>
    47644701</sect1>
    47654702
    … …  
    49114848        <para>
    49124849        If <command>cupsaddsmb</command>, or <command>rpcclient addriver</command> emit the error message
    4913         WERR_BAD_PASSWORD, refer to <link linkend="root-ask-loop">the previous common error</link>.
     4850        WERR_BAD_PASSWORD/WERR_INVALID_PASSWORD, refer to <link linkend="root-ask-loop">the previous common error</link>.
    49144851        </para>
    49154852       

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml

    r414 r988  
    2121
    2222<sect1>
    23 <title>Access Samba Source Code via Subversion</title>
     23<title>Access Samba Source Code via GIT</title>
    2424
    2525
    … …  
    2929<para>
    3030<indexterm><primary>Subversion</primary></indexterm>
    31 Samba is developed in an open environment. Developers use a
    32 Subversion to <quote>checkin</quote> (also known as
    33 <quote>commit</quote>) new source code. Samba's various Subversion branches can
    34 be accessed via anonymous Subversion using the instructions
    35 detailed in this chapter.
    36 </para>
    37 
    38 <para>
    39 This chapter is a modified version of the instructions found at the
    40 <ulink noescape="1" url="http://samba.org/samba/subversion.html">Samba</ulink> Web site.
     31Samba is developed in an open environment. Developers use
     32GIT to <quote>checkin</quote> (also known as
     33<quote>commit</quote>) new source code.  See the
     34<ulink noescape="1"
     35       url="https://wiki.samba.org/index.php/Using_Git_for_Samba_Development">Using
     36Git for Samba Development page</ulink> in the Samba wiki.
    4137</para>
    4238
    4339</sect2>
    4440
    45 <sect2>
    46 <title>Subversion Access to samba.org</title>
    47 
    48 <para>
    49 The machine samba.org runs a publicly accessible Subversion
    50 repository for access to the source code of several packages,
    51 including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways
    52 of accessing the Subversion server on this host.
    53 </para>
    54 
    55 <sect3>
    56 <title>Access via ViewCVS</title>
    57 
    58 
    59 <para>
    60 <indexterm><primary>SVN</primary><secondary>web</secondary></indexterm>
    61 You can access the source code via your favorite WWW browser. This allows you to access
    62 the contents of individual files in the repository and also to look at the revision
    63 history and commit logs of individual files. You can also ask for a diff
    64 listing between any two versions on the repository.
    65 </para>
    66 
    67 <para>
    68 Use the URL
    69 <ulink noescape="1" url="http://viewcvs.samba.org/">http://viewcvs.samba.org/</ulink>.
    70 </para>
    71 </sect3>
    72 
    73 <sect3>
    74 <title>Access via Subversion</title>
    75 
    76 <para>
    77 <indexterm><primary>Subversion</primary></indexterm>
    78 You can also access the source code via a normal Subversion client. This gives you much more control over what
    79 you can do with the repository and allows you to check out whole source trees and keep them up to date via
    80 normal Subversion commands. This is the preferred method of access if you are a developer and not just a
    81 casual browser.
    82 </para>
    83 
    84 <para>In order to be able to download the Samba sources off Subversion, you need
    85 a Subversion client. Your distribution might include one, or you can download the
    86 sources from <ulink noescape="1" url="http://subversion.tigris.org/">http://subversion.tigris.org/</ulink>.
    87 </para>
    88 
    89 <para>
    90 To gain access via anonymous Subversion, use the following steps.
    91 </para>
    92 
    93 <procedure>
    94         <title>Retrieving Samba using Subversion</title>
    95 
    96         <step>
    97         <para>
    98         Install a recent copy of Subversion. All you really need is a
    99         copy of the Subversion client binary.
    100         </para>
    101         </step>
    102 
    103         <step>
    104         <para>
    105         Run the command
    106         <screen>
    107         <userinput>svn co svn://svnanon.samba.org/samba/trunk samba</userinput>.
    108         </screen>
    109         </para>
    110        
    111         <para>
    112         This will create a directory called <filename>samba</filename> containing the
    113         latest Samba source code (usually the branch that is going to be the next major release). This
    114         currently corresponds to the 3.1 development tree.
    115         </para>
    116        
    117         <para>
    118         Subversion branches other then trunk can be obtained by adding branches/BRANCH_NAME to the URL you check
    119         out. A list of branch names can be found on the <quote>Development</quote> page of the Samba Web site. A
    120         common request is to obtain the latest 3.0 release code. This could be done by using the following command:
    121         <screen>
    122         <userinput>svn co svn://svnanon.samba.org/samba/branches/SAMBA_3_0 samba_3</userinput>.
    123         </screen>
    124         </para>
    125         </step>
    126 
    127         <step>
    128         <para>
    129         Whenever you want to merge in the latest code changes, use the following command from within the Samba
    130         directory:
    131         <screen>
    132         <userinput>svn update</userinput>
    133         </screen>
    134         </para>
    135         </step>
    136 </procedure>
    137        
    138 </sect3>
    139 </sect2>
    14041
    14142</sect1>
    … …  
    14950        <indexterm><primary>ftp</primary></indexterm>
    15051        <parameter>pserver.samba.org</parameter> also exports unpacked copies of most parts of the Subversion tree
    151         at the Samba <ulink noescape="1" url="ftp://pserver.samba.org/pub/unpacked">pserver</ulink> location and also
     52        at the Samba <ulink noescape="1" url="ftp://samba.org/pub/unpacked">unpacked</ulink> location and also
    15253        via anonymous rsync at the Samba <ulink noescape="1"
    153         url="rsync://pserver.samba.org/ftp/unpacked/">rsync</ulink> server location.  I recommend using rsync rather
     54        url="rsync://samba.org/ftp/unpacked/">rsync</ulink> server location.  I recommend using rsync rather
    15455        than ftp, because rsync is capable of compressing data streams, but it is also more useful than FTP because
    15556        during a partial update it will transfer only the data that is missing plus a small overhead.  See <ulink
    … …  
    15960        <para>
    16061        The disadvantage of the unpacked trees is that they do not support automatic
    161         merging of local changes as Subversion does. <command>rsync</command> access is most convenient
     62        merging of local changes as GIT does. <command>rsync</command> access is most convenient
    16263        for an initial install.                     
    16364        </para>
    … …  
    18283
    18384<para><screen>
    184 &prompt;<userinput>wget http://us1.samba.org/samba/ftp/samba-3.0.20.tar.asc</userinput>
    185 &prompt;<userinput>wget http://us1.samba.org/samba/ftp/samba-pubkey.asc</userinput>
     85&prompt;<userinput>wget http://samba.org/samba/ftp/samba-latest.tar.asc</userinput>
     86&prompt;<userinput>wget http://samba.org/samba/ftp/samba-latest.tar.gz</userinput>
     87&prompt;<userinput>wget http://samba.org/samba/ftp/samba-pubkey.asc</userinput>
    18688</screen></para>
    18789
    … …  
    19698and verify the Samba source code integrity with:
    19799<screen>
    198 &prompt;<userinput>gzip -d samba-3.0.20.tar.gz</userinput>
    199 &prompt;<userinput>gpg --verify samba-3.0.20.tar.asc</userinput>
     100&prompt;<userinput>gzip -d samba-latest.tar.gz</userinput>
     101&prompt;<userinput>gpg --verify samba-latest.tar.asc</userinput>
    200102</screen>
    201103</para>
    … …  
    216118       
    217119        <para>
    218         <indexterm><primary>autogen.sh</primary></indexterm>
    219 <indexterm><primary>configure</primary></indexterm>
    220         After the source tarball has been unpacked, the next step involves
    221         configuration to match Samba to your operating system platform.
    222         If your source directory does not contain the <command>configure</command> script,
    223         it is necessary to build it before you can continue. Building of
    224         the configure script requires the correct version of the autoconf
    225         tool kit. Where the necessary version of autoconf is present,
    226         the configure script can be generated by executing the following
    227         (please note that in Samba 3.4.x, the directory is called source3 instead
    228         of source):
    229 <screen>
    230 &rootprompt; cd samba-3.0.20/source
    231 &rootprompt; ./autogen.sh
    232 </screen>
    233         </para>
    234        
    235 
    236         <para>
    237120        <indexterm><primary>configure</primary></indexterm>
    238121        To build the binaries, run the program <userinput>./configure
    239         </userinput> in the source directory. This should automatically
     122        </userinput> in the top level directory of the source tree. This should automatically
    240123        configure Samba for your operating system. If you have unusual
    241124        needs, then you may wish to first run:
    … …  
    266149        </para>
    267150       
    268         <para>
    269         Some people prefer to install binary files and man pages separately. If this is
    270         your wish, the binary files can be installed by executing:
    271 <screen>
    272 &rootprompt; <userinput>make installbin</userinput>
    273 </screen>
    274         The man pages can be installed using this command:
    275 <screen>
    276 &rootprompt; <userinput>make installman</userinput>
    277 </screen>
    278         </para>
    279 
    280         <para>
    281         Note that if you are upgrading from a previous version of Samba the old
    282         versions of the binaries will be renamed with an <quote>.old</quote> extension.
    283         You can go back to the previous version by executing:
    284 <screen>
    285 &rootprompt; <userinput>make revert</userinput>
    286 </screen>
    287         As you can see from this, building and installing Samba does not need to
    288         result in disaster!
    289         </para>
    290        
    291 
    292151        <sect2>
    293152        <title>Compiling Samba with Active Directory Support</title>
    … …  
    319178        <para>
    320179        After you run configure, make sure that the
    321         <filename>include/config.h</filename> it generates contain lines like this:
     180        <filename>bin/default/include/config.h</filename> it generates contain lines like this:
    322181<programlisting>
    323182#define HAVE_KRB5 1
    … …  
    328187        <para>
    329188        If it does not, configure did not find your KRB5 libraries or
    330         your LDAP libraries. Look in <filename>config.log</filename> to figure
     189        your LDAP libraries. Look in <filename>bin/config.log</filename> to figure
    331190        out why and fix it.
    332191        </para>
    … …  
    409268
    410269        <sect2>
    411         <title>Starting from inetd.conf</title>
    412 
    413         <indexterm><primary>inetd</primary></indexterm>
    414        
    415         <note>
    416         <para>The following will be different if
    417         you use NIS, NIS+, or LDAP to distribute services maps.</para>
    418         </note>
    419        
    420         <para>Look at your <filename>/etc/services</filename>.
    421         What is defined at port 139/tcp? If nothing is defined,
    422         then add a line like this:</para>
    423 
    424         <para><programlisting>netbios-ssn     139/tcp</programlisting></para>
    425 
    426         <para>Similarly for 137/udp, you should have an entry like:</para>
    427 
    428         <para><programlisting>netbios-ns        137/udp</programlisting></para>
    429 
    430         <para>
    431         Next, edit your <filename>/etc/inetd.conf</filename> and add two lines like this:
    432 <programlisting>
    433 netbios-ssn stream tcp nowait root /usr/local/samba/sbin/smbd smbd
    434 netbios-ns dgram udp wait root /usr/local/samba/sbin/nmbd nmbd
    435 </programlisting>
    436         </para>
    437 
    438 <indexterm><primary>/etc/inetd.conf</primary></indexterm>
    439         <para>
    440         The exact syntax of <filename>/etc/inetd.conf</filename>
    441         varies between UNIXes. Look at the other entries in inetd.conf
    442         for a guide.
    443         </para>
    444 
    445         <para>
    446         <indexterm><primary>xinetd</primary></indexterm>
    447         Some distributions use xinetd instead of inetd. Consult the
    448         xinetd manual for configuration information.
    449         </para>
    450 
    451         <note><para>Some UNIXes already have entries like netbios_ns
    452         (note the underscore) in <filename>/etc/services</filename>.
    453         You must edit <filename>/etc/services</filename> or
    454         <filename>/etc/inetd.conf</filename> to make them consistent.
    455         </para></note>
    456 
    457         <note><para>
    458         <indexterm><primary>ifconfig</primary></indexterm>
    459         On many systems you may need to use the
    460         <smbconfoption name="interfaces"/> option in &smb.conf; to specify
    461         the IP address and netmask of your interfaces. Run
    462         <application>ifconfig</application> as root if you do
    463         not know what the broadcast is for your net. &nmbd; tries
    464         to determine it at runtime, but fails on some UNIXes.
    465         </para></note>
    466 
    467         <warning><para>
    468         Many UNIXes only accept around five parameters on the command
    469         line in <filename>inetd.conf</filename>.  This means you shouldn't
    470         use spaces between the options and arguments, or you should use
    471         a script and start the script from <command>inetd</command>.
    472         </para></warning>
    473 
    474         <para>
    475         Restart <application>inetd</application>, perhaps just send it a HUP,
    476         like this:
    477 <indexterm><primary>killall</primary></indexterm>
    478 <screen>
    479 &rootprompt;<userinput>killall -HUP inetd</userinput>
    480 </screen>
    481         </para>
    482                
    483         </sect2>
    484        
    485         <sect2>
    486         <title>Alternative: Starting &smbd; as a Daemon</title>
     270        <title>Starting &smbd; as a Daemon</title>
    487271               
    488272        <para>
    … …  
    521305        <sect3>
    522306        <title>Starting Samba for Red Hat Linux</title>
    523 
    524         <para>
    525         Red Hat Linux has not always included all Samba components in the standard installation.
    526         So versions of Red Hat Linux do not install the winbind utility, even though it is present
    527         on the installation CDROM media. Check to see if the <command>winbindd</command> is present
    528         on the system:
    529 <screen>
    530 &rootprompt; ls /usr/sbin/winbindd
    531 /usr/sbin/winbindd
    532 </screen>
    533         This means that the appropriate RPM package was installed. The following response means
    534         that it is not installed:
    535 <screen>
    536 /bin/ls: /usr/sbin/winbind: No such file or directory
    537 </screen>
    538         In this case, it should be installed if you intend to use <command>winbindd</command>. Search
    539         the CDROM installation media for the samba-winbind RPM and install it following Red Hat
    540         guidelines.
    541         </para>
    542 
    543307        <para>
    544308        The process for starting Samba will now be outlined. Be sure to configure Samba's &smb.conf;

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml

    r414 r988  
    121121this book. However, if someone will contribute more comprehensive documentation we will gladly review it, and
    122122if it is suitable extend this section of this chapter. Until such documentation becomes available the hosting
    123 of multiple samba servers on a single host is considered not supported for Samba-3 by the Samba Team.
     123of multiple samba servers on a single host is considered not supported for Samba by the Samba Team.
    124124</para>
    125125

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml

    r414 r988  
    131131<note><para>
    132132<indexterm><primary>/etc/samba</primary></indexterm>
    133 <indexterm><primary>/usr/local/samba/lib</primary></indexterm>
     133<indexterm><primary>/usr/local/samba/etc</primary></indexterm>
    134134Your &smb.conf; file may be located in <filename>/etc/samba</filename>
    135 or in <filename>/usr/local/samba/lib</filename>.
     135or in <filename>/usr/local/samba/etc</filename>.
    136136</para></note>
    137137</step>
    … …  
    432432<listitem>
    433433        <para>
    434         You have shadow passwords (or some other password system) but didn't
    435         compile in support for them in &smbd;.
     434        Password encryption is enabled by default, but you have not
     435        yet set a password for your samba user. Run
     436        <command>smbpasswd -a username</command>
    436437        </para>
    437438</listitem>
    … …  
    445446<listitem>
    446447        <para>
    447         You have a mixed-case password and you haven't enabled the <smbconfoption name="password level"/> option at a high enough level.
     448        You have explicitly disabled encrypted passwords with
     449        <smbconfoption name="encrypt passwords">no</smbconfoption> have a mixed-case password.
    448450        </para>
    449451</listitem>
    … …  
    455457</listitem>
    456458
    457 <listitem>
    458         <para>
    459         You enabled password encryption but didn't map UNIX to Samba users. Run
    460         <command>smbpasswd -a username</command>
    461         </para>
    462 </listitem>
    463459</orderedlist>
    464460
    … …  
    545541
    546542<para>
    547 It's also possible that the server can't work out what username to connect you as.
    548 To see if this is the problem, add the line
    549 <smbconfoption name="user">username</smbconfoption> to the
    550 <smbconfsection name="[tmp]"/> section of
    551 &smb.conf; where <parameter>username</parameter> is the
    552 username corresponding to the password you typed. If you find this
    553 fixes things, you may need the username mapping option.
    554 </para>
    555 
    556 <para>
    557 It might also be the case that your client only sends encrypted passwords
     543By default, most clients only sends encrypted passwords
    558544and you have <smbconfoption name="encrypt passwords">no</smbconfoption> in &smb.conf;.
    559545Change this setting to `yes' to fix this.
    … …  
    588574specified in &smb.conf;). You should be able to double-click on the name
    589575of the server and get a list of shares. If you get the error message <quote>invalid password,</quote>
    590  you are probably running Windows NT and it
    591 is refusing to browse a server that has no encrypted password
    592 capability and is in user-level security mode. In this case, either set
    593 <smbconfoption name="security">server</smbconfoption> and
    594 <smbconfoption name="password server">Windows_NT_Machine</smbconfoption> in your
    595 &smb.conf; file or make sure <smbconfoption name="encrypt passwords"/> is
    596 set to <quote>yes</quote>.
     576your client may be refusing to browse a server that has no encrypted password
     577capability. In this case make sure <smbconfoption name="encrypt passwords"/> is
     578set to <quote>yes</quote> and repeat the steps in this gude.
    597579</para>
    598580

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml

    r414 r988  
    5656<indexterm><primary>domain control</primary></indexterm>
    5757<indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
    58 Samba-3 can join an MS Windows NT4-style domain as a native member server, an
     58Samba can join an MS Windows NT4-style domain as a native member server, an
    5959MS Windows Active Directory domain as a native member server, or a Samba domain
    6060control network. Domain membership has many advantages:
    … …  
    194194        A corresponding UNIX account, typically stored in <filename>/etc/passwd</filename>. Work is in progress to
    195195        allow a simplified mode of operation that does not require UNIX user accounts, but this has not been a feature
    196         of the early releases of Samba-3, and is not currently planned for release either.
     196        of the early releases of Samba, and is not currently planned for release either.
    197197        </para></listitem>
    198198</itemizedlist>
    … …  
    607607
    608608<sect2>
    609 <title>Joining an NT4-type Domain with Samba-3</title>
     609<title>Joining an NT4-type Domain with Samba</title>
    610610
    611611<para><link linkend="assumptions">Assumptions</link> lists names that are used in the remainder of this chapter.</para>
    … …  
    798798</sect2>
    799799
    800 <sect2>
    801 <title>Why Is This Better Than <parameter>security = server</parameter>?</title>
    802 
    803 <para>
    804 <indexterm><primary>domain security</primary></indexterm>
    805 <indexterm><primary>UNIX users</primary></indexterm>
    806 <indexterm><primary>authentication</primary></indexterm>
    807 Currently, domain security in Samba does not free you from having to create local UNIX users to represent the
    808 users attaching to your server. This means that if domain user <constant>DOM\fred</constant> attaches to your
    809 domain security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX file
    810 system. This is similar to the older Samba security mode <smbconfoption
    811 name="security">server</smbconfoption>, where Samba would pass through the authentication request to a Windows
    812 NT server in the same way as a Windows 95 or Windows 98 server would.
    813 </para>
    814 
    815 <para>
    816 <indexterm><primary>winbind</primary></indexterm>
    817 <indexterm><primary>UID</primary></indexterm>
    818 <indexterm><primary>GID</primary></indexterm>
    819 Please refer to <link linkend="winbind">Winbind: Use of Domain Accounts</link>, for information on a system
    820 to automatically assign UNIX UIDs and GIDs to Windows NT domain users and groups.
    821 </para>
    822 
    823 <para>
    824 <indexterm><primary>domain-level</primary></indexterm>
    825 <indexterm><primary>authentication</primary></indexterm>
    826 <indexterm><primary>RPC</primary></indexterm>
    827 The advantage of domain-level security is that the authentication in domain-level security is passed down the
    828 authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now
    829 participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba
    830 servers into a resource domain and have the authentication passed on from a resource domain PDC to an account
    831 domain PDC).
    832 </para>
    833 
    834 <para>
    835 <indexterm><primary>PDC</primary></indexterm>
    836 <indexterm><primary>BDC</primary></indexterm>
    837 <indexterm><primary>connection resources</primary></indexterm>
    838 In addition, with <smbconfoption name="security">server</smbconfoption>, every Samba daemon on a server has to
    839 keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the
    840 connection resources on a Microsoft NT server and cause it to run out of available connections. With
    841 <smbconfoption name="security">domain</smbconfoption>, however, the Samba daemons connect to the PDC or BDC
    842 only for as long as is necessary to authenticate the user and then drop the connection, thus conserving PDC
    843 connection resources.
    844 </para>
    845 
    846 <para>
    847 <indexterm><primary>PDC</primary></indexterm>
    848 <indexterm><primary>authentication reply</primary></indexterm>
    849 <indexterm><primary>SID</primary></indexterm>
    850 <indexterm><primary>NT groups</primary></indexterm>
    851 Finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the
    852 authentication reply, the Samba server gets the user identification information such as the user SID, the list
    853 of NT groups the user belongs to, and so on.
    854 </para>
    855 
    856 <note>
    857 <para>
    858 Much of the text of this document was first published in the Web magazine
    859 <ulink url="http://www.linuxworld.com"><emphasis>LinuxWorld</emphasis></ulink> as the article <ulink
    860 url="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"/>
    861 <emphasis>Doing the NIS/NT Samba</emphasis>.
    862 </para>
    863 </note>
    864 
    865 </sect2>
    866800</sect1>
    867801
    … …  
    874808<indexterm><primary>KDC</primary></indexterm>
    875809<indexterm><primary>Kerberos</primary></indexterm>
    876 This is a rough guide to setting up Samba-3 with Kerberos authentication against a
     810This is a rough guide to setting up Samba with Kerberos authentication against a
    877811Windows 200x KDC. A familiarity with Kerberos is assumed.
    878812</para>
    … …  
    980914[libdefaults]
    981915        default_realm = YOUR.KERBEROS.REALM
    982 
    983 [realms]
    984         YOUR.KERBEROS.REALM = {
    985         kdc = your.kerberos.server
    986         }
     916        dns_lookup_kdc = true
    987917
    988918[domain_realms]
    … …  
    992922
    993923<para>
    994 <indexterm><primary>Heimdal</primary></indexterm>
    995 When using Heimdal versions before 0.6, use the following configuration settings:
     924If you must specify the KDC directly, the minimal configuration is:
    996925<screen>
    997926[libdefaults]
    998927        default_realm      = YOUR.KERBEROS.REALM
    999         default_etypes     = des-cbc-crc des-cbc-md5
    1000         default_etypes_des = des-cbc-crc des-cbc-md5
    1001928
    1002929[realms]
    … …  
    1016943<replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput> and
    1017944making sure that your password is accepted by the Win2000 KDC.
    1018 </para>
    1019 
    1020 <para>
    1021 <indexterm><primary>Heimdal</primary></indexterm>
    1022 <indexterm><primary>ADS</primary></indexterm>
    1023 <indexterm><primary>KDC</primary></indexterm>
    1024 <indexterm><primary>Windows 2003</primary></indexterm>
    1025 With Heimdal versions earlier than 0.6.x you can use only newly created accounts
    1026 in ADS or accounts that have had the password changed once after migration, or
    1027 in case of <constant>Administrator</constant> after installation. At the
    1028 moment, a Windows 2003 KDC can only be used with Heimdal releases later than 0.6
    1029 (and no default etypes in krb5.conf). Unfortunately, this whole area is still
    1030 in a state of flux.
    1031945</para>
    1032946
    … …  
    1053967<indexterm><primary>Kerberos</primary></indexterm>
    1054968Clock skew limits are configurable in the Kerberos protocols. The default setting is five minutes.
    1055 </para>
    1056 
    1057 <para>
    1058 <indexterm><primary>DNS</primary></indexterm>
    1059 <indexterm><primary>KDC</primary></indexterm>
    1060 <indexterm><primary>hostname</primary></indexterm>
    1061 <indexterm><primary>realm</primary></indexterm>
    1062 You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that
    1063 this reverse lookup maps to must either be the NetBIOS name of the KDC (i.e., the hostname with no domain
    1064 attached) or it can be the NetBIOS name followed by the realm.
    1065 </para>
    1066 
    1067 <para>
    1068 <indexterm><primary>/etc/hosts</primary></indexterm>
    1069 <indexterm><primary>KDC</primary></indexterm>
    1070 <indexterm><primary>realm</primary></indexterm>
    1071 The easiest way to ensure you get this right is to add a <filename>/etc/hosts</filename> entry mapping the IP
    1072 address of your KDC to its NetBIOS name. If you do not get this correct, then you will get a <errorname>local
    1073 error</errorname> when you try to join the realm.
    1074969</para>
    1075970
    … …  
    11131008<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
    11141009When making a Windows client a member of an ADS domain within a complex organization, you
    1115 may want to create the machine trust account within a particular organizational unit. Samba-3 permits
     1010may want to create the machine trust account within a particular organizational unit. Samba permits
    11161011this to be done using the following syntax:
    11171012<screen>
    … …  
    11601055        <replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput>.
    11611056        <replaceable>USERNAME</replaceable> must be a user who has rights to add a machine to the domain.
    1162         </para></listitem></varlistentry>
    1163 
    1164         <varlistentry><term>Unsupported encryption/or checksum types</term>
    1165         <listitem><para>
    1166         <indexterm><primary>/etc/krb5.conf</primary></indexterm>
    1167         <indexterm><primary>unsupported encryption</primary></indexterm>
    1168         <indexterm><primary>Kerberos</primary></indexterm>
    1169         Make sure that the <filename>/etc/krb5.conf</filename> is correctly configured
    1170         for the type and version of Kerberos installed on the system.
    11711057        </para></listitem></varlistentry>
    11721058</variablelist>
    … …  
    12181104server using &smbclient; and Kerberos. Use &smbclient; as usual, but
    12191105specify the <option>-k</option> option to choose Kerberos authentication.
    1220 </para>
    1221 
    1222 </sect2>
    1223 
    1224 <sect2>
    1225 <title>Notes</title>
    1226 
    1227 <para>
    1228 <indexterm><primary>administrator password</primary></indexterm>
    1229 <indexterm><primary>change password</primary></indexterm>
    1230 <indexterm><primary>encryption types</primary></indexterm>
    1231 You must change the administrator password at least once after installing a domain controller,
    1232 to create the right encryption types.
    1233 </para>
    1234 
    1235 <para>
    1236 <indexterm><primary>_kerberos._udp</primary></indexterm>
    1237 <indexterm><primary>_ldap._tcp</primary></indexterm>
    1238 <indexterm><primary>default DNS setup</primary></indexterm>
    1239 Windows 200x does not seem to create the <parameter>_kerberos._udp</parameter> and
    1240 <parameter>_ldap._tcp</parameter> in the default DNS setup. Perhaps this will be fixed later in service packs.
    12411106</para>
    12421107
    … …  
    14011266
    14021267</sect2>
    1403 
    1404 <sect2>
    1405         <title>I Can't Join a Windows 2003 PDC</title>
    1406 
    1407         <para>
    1408 <indexterm><primary>SMB signing</primary></indexterm>
    1409 <indexterm><primary>SMB</primary></indexterm>
    1410 <indexterm><primary>Windows 2003</primary></indexterm>
    1411 <indexterm><primary>SMB/CIFS</primary></indexterm>
    1412         Windows 2003 requires SMB signing. Client-side SMB signing has been implemented in Samba-3.0.
    1413         Set <smbconfoption name="client use spnego">yes</smbconfoption> when communicating
    1414         with a Windows 2003 server. This will not interfere with other Windows clients that do not
    1415         support the more advanced security features of Windows 2003 because the client will simply
    1416         negotiate a protocol that both it and the server suppport. This is a well-known fall-back facility
    1417         that is built into the SMB/CIFS protocols.
    1418         </para>
    1419 
    1420 </sect2>
    1421 
    14221268</sect1>
    14231269</chapter>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml

    r414 r988  
    183183<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
    184184<smbconfoption name="netbios name">HOBBIT</smbconfoption>
    185 <smbconfoption name="security">share</smbconfoption>
     185<smbconfoption name="security">user</smbconfoption>
     186<smbconfoption name="map to guest">bad user</smbconfoption>
    186187
    187188<smbconfsection name="[data]"/>
    … …  
    221222        workgroup = MIDEARTH
    222223        netbios name = HOBBIT
    223         security = share
     224        security = user
     225        map to guest = bad user
    224226
    225227[data]
    … …  
    287289<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
    288290<smbconfoption name="netbios name">HOBBIT</smbconfoption>
    289 <smbconfoption name="security">SHARE</smbconfoption>
     291<smbconfoption name="security">USER</smbconfoption>
     292<smbconfoption name="map to guest">bad user</smbconfoption>
    290293
    291294<smbconfsection name="[data]"/>
    … …  
    341344<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
    342345<smbconfoption name="netbios name">LUTHIEN</smbconfoption>
    343 <smbconfoption name="security">share</smbconfoption>
    344 <smbconfoption name="printcap name">cups</smbconfoption>
    345 <smbconfoption name="disable spoolss">Yes</smbconfoption>
    346 <smbconfoption name="show add printer wizard">No</smbconfoption>
     346<smbconfoption name="security">user</smbconfoption>
    347347<smbconfoption name="printing">cups</smbconfoption>
    348348
    … …  
    445445                encrypted passwords in a file called <filename>/etc/samba/smbpasswd</filename>.
    446446                The default &smb.conf; entry that makes this happen is
    447                 <smbconfoption name="passdb backend">smbpasswd, guest</smbconfoption>. Since this is the default,
    448                 it is not necessary to enter it into the configuration file. Note that the guest backend is
    449                 added to the list of active passdb backends no matter whether it specified directly in Samba configuration
    450                 file or not.
     447                <smbconfoption name="passdb backend">smbpasswd</smbconfoption>. Since this is the default,
     448                it is not necessary to enter it into the configuration file.
    451449                </para>
    452450
    … …  
    475473<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
    476474<smbconfoption name="netbios name">OLORIN</smbconfoption>
    477 <smbconfoption name="printcap name">cups</smbconfoption>
    478 <smbconfoption name="disable spoolss">Yes</smbconfoption>
    479475<smbconfoption name="show add printer wizard">No</smbconfoption>
    480476<smbconfoption name="printing">cups</smbconfoption>
    … …  
    496492<smbconfoption name="comment">All Printers</smbconfoption>
    497493<smbconfoption name="path">/var/spool/samba</smbconfoption>
    498 <smbconfoption name="printer admin">root, maryo</smbconfoption>
    499494<smbconfoption name="create mask">0600</smbconfoption>
    500495<smbconfoption name="guest ok">Yes</smbconfoption>
    … …  
    730725<smbconfoption name="comment">All Printers</smbconfoption>
    731726<smbconfoption name="path">/var/spool/samba</smbconfoption>
    732 <smbconfoption name="printer admin">root, maryo</smbconfoption>
    733727<smbconfoption name="create mask">0600</smbconfoption>
    734728<smbconfoption name="guest ok">Yes</smbconfoption>
    … …  
    882876        <para>
    883877        A more scalable domain control authentication backend option might use
    884         Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
    885         for both options as a domain member server. As a PDC, Samba-3 is not able to provide
     878        Microsoft Active Directory or an LDAP-based backend. Samba provides
     879        for both options as a domain member server. As a PDC, Samba is not able to provide
    886880        an exact alternative to the functionality that is available with Active Directory.
    887         Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
     881        Samba can provide a scalable LDAP-based PDC/BDC solution.
    888882        </para>
    889883
    … …  
    891885        The tdbsam authentication backend provides no facility to replicate
    892886        the contents of the database, except by external means (i.e., there is no self-contained protocol
    893         in Samba-3 for Security Account Manager database [SAM] replication).
     887        in Samba for Security Account Manager database [SAM] replication).
    894888        </para>
    895889
    … …  
    904898                The engineering office network server we present here is designed to demonstrate use
    905899                of the new tdbsam password backend. The tdbsam
    906                 facility is new to Samba-3. It is designed to provide many user and machine account controls
     900                facility is new to Samba. It is designed to provide many user and machine account controls
    907901                that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
    908902                </para>
    … …  
    962956<smbconfoption name="comment">All Printers</smbconfoption>
    963957<smbconfoption name="path">/var/spool/samba</smbconfoption>
    964 <smbconfoption name="printer admin">root, maryo</smbconfoption>
    965958<smbconfoption name="create mask">0600</smbconfoption>
    966959<smbconfoption name="guest ok">Yes</smbconfoption>
    … …  
    972965<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
    973966<smbconfoption name="write list">maryo, root</smbconfoption>
    974 <smbconfoption name="printer admin">maryo, root</smbconfoption>
    975967
    976968<smbconfcomment>Needed to support domain logons</smbconfcomment>
    … …  
    10561048
    10571049                <para>
    1058                 In this section we finally get to review in brief a Samba-3 configuration that
     1050                In this section we finally get to review in brief a Samba configuration that
    10591051                uses a Lightweight Directory Access (LDAP)-based authentication backend. The
    10601052                main reasons for this choice are to provide the ability to host primary
    … …  
    10671059
    10681060                        <para>
    1069                         This is an example of a minimal configuration to run a Samba-3 PDC
     1061                        This is an example of a minimal configuration to run a Samba PDC
    10701062                        using an LDAP authentication backend. It is assumed that the operating system
    10711063                        has been correctly configured.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml

    r414 r988  
    407407
    408408        <orderedlist>
    409                 <listitem><para>For Samba-3 domain controllers and domain member servers/clients.</para></listitem>
     409                <listitem><para>For Samba domain controllers and domain member servers/clients.</para></listitem>
    410410                <listitem><para>To manage domain member Windows workstations.</para></listitem>
    411411        </orderedlist>
    … …  
    490490        alias entities. Each has a well-known RID. These must be preserved for continued
    491491        integrity of operation. Samba must be provisioned with certain essential domain groups that require
    492         the appropriate RID value. When Samba-3 is configured to use <constant>tdbsam</constant>, the essential
     492        the appropriate RID value. When Samba is configured to use <constant>tdbsam</constant>, the essential
    493493        domain groups are automatically created. It is the LDAP administrator's responsibility to create
    494494        (provision) the default NT groups.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml

    r414 r988  
    1818The Microsoft Windows operating system has a number of features that impose specific challenges
    1919to interoperability with the operating systems on which Samba is implemented. This chapter deals
    20 explicitly with the mechanisms Samba-3 (version 3.0.8 and later) uses to overcome one of the
     20explicitly with the mechanisms Samba (version 3.0.8 and later) uses to overcome one of the
    2121key challenges in the integration of Samba servers into an MS Windows networking environment.
    2222This chapter deals with identity mapping (IDMAP) of Windows security identifiers (SIDs)
    … …  
    121121        <indexterm><primary>SID</primary></indexterm>
    122122        <indexterm><primary>Active Directory</primary></indexterm>
    123         Samba-3 can act as a Windows NT4 PDC or BDC, thereby providing domain control protocols that
    124         are compatible with Windows NT4. Samba-3 file and print sharing protocols are compatible with
     123        Samba can act as a Windows NT4 PDC or BDC, thereby providing domain control protocols that
     124        are compatible with Windows NT4. Samba file and print sharing protocols are compatible with
    125125        all versions of MS Windows products. Windows NT4, as with MS Active Directory,
    126126        extensively makes use of Windows SIDs.
    … …  
    131131        <indexterm><primary>UID</primary></indexterm>
    132132        <indexterm><primary>GID</primary></indexterm>
    133         Samba-3 domain member servers and clients must interact correctly with MS Windows SIDs. Incoming
     133        Samba domain member servers and clients must interact correctly with MS Windows SIDs. Incoming
    134134        Windows SIDs must be translated to local UNIX UIDs and GIDs. Outgoing information from the Samba
    135135        server must provide to MS Windows clients and servers appropriate SIDs.
    … …  
    236236                                is an appliance like file server on which no local accounts are configured and
    237237                                winbind is used to obtain account credentials from the domain controllers for the
    238                                 domain. The domain control can be provided by Samba-3, MS Windows NT4, or MS Windows
     238                                domain. The domain control can be provided by Samba, MS Windows NT4, or MS Windows
    239239                                Active Directory.
    240240                                </para>
    … …  
    453453        <para>
    454454        IDMAP information can be written directly to the LDAP server so long as all domain controllers
    455         have access to the master (writable) LDAP server. Samba-3 at this time does not handle LDAP redirects
     455        have access to the master (writable) LDAP server. Samba at this time does not handle LDAP redirects
    456456        in the IDMAP backend. This means that it is is unsafe to use a slave (replicate) LDAP server with
    457457        the IDMAP facility.
    … …  
    596596<smbconfoption name="winbind use default domain">Yes</smbconfoption>
    597597<smbconfoption name="winbind nested groups">Yes</smbconfoption>
    598 <smbconfoption name="printer admin">"BUTTERNET\Domain Admins"</smbconfoption>
    599598</smbconfblock>
    600599</example>
    … …  
    729728<smbconfoption name="winbind enum groups">No</smbconfoption>
    730729<smbconfoption name="winbind nested groups">Yes</smbconfoption>
    731 <smbconfoption name="printer admin">"Domain Admins"</smbconfoption>
    732730</smbconfblock>
    733731</example>
    … …  
    822820        <indexterm><primary>ADAM</primary></indexterm>
    823821        <indexterm><primary>ADS</primary></indexterm>
    824         The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains and
     822        The storage of IDMAP information in LDAP can be used with both NT4/Samba-style domains and
    825823        ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any
    826824        standards-complying LDAP server can be used. It is therefore possible to deploy this IDMAP
    … …  
    858856        <para>
    859857        <indexterm><primary>realm</primary></indexterm>
    860         In the case of an NT4 or Samba-3-style domain the <parameter>realm</parameter> is not used, and the
     858        In the case of an NT4 or Samba-style domain the <parameter>realm</parameter> is not used, and the
    861859        command used to join the domain is <command>net rpc join</command>. The above example also demonstrates
    862860        advanced error-reporting techniques that are documented in <link linkend="dbglvl">Reporting Bugs</link>.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml

    r414 r988  
    124124
    125125        <para>
    126         This section contains brief descriptions of the databases that are used by Samba-3.
     126        This section contains brief descriptions of the databases that are used by Samba.
    127127        </para>
    128128
    129129        <para>
    130130<indexterm><primary>tdb file locations</primary></indexterm>
    131         The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores
     131        The directory in which Samba stores the tdb files is determined by compile-time directives. Samba stores
    132132        tdb files in two locations. The best way to determine these locations is to execute the following
    133133        command:
    … …  
    137137</screen>
    138138        This means that the confidential tdb files are stored in the <filename>/etc/samba/private</filename>
    139         directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
     139        directory. Samba also uses a number of tdb files that contain more mundane data. The location of
    140140        these files can be found by executing:
    141141<screen>
    … …  
    658658
    659659        <para>
    660         &winbindd; will run as one or two daemons, depending on whether or not it is being
    661         run in <emphasis>split mode</emphasis> (in which case there will be two instances).
    662         </para>
    663 
    664         </sect2>
    665 
    666         <sect2>
    667                 <title>Error Message: open_oplock_ipc</title>
    668 
    669         <para>
    670         An error message is observed in the log files when &smbd; is started: <quote>open_oplock_ipc: Failed to
    671         get local UDP socket for address 100007f. Error was Cannot assign requested.</quote>
    672         </para>
    673 
    674         <para>
    675         Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback
    676         device is an internal (virtual) network device with the IP address <emphasis>127.0.0.1</emphasis>.
    677         Read your OS documentation for details on how to configure the loopback on your system.
     660        &winbindd; will run as many processes depending in part on how many
     661        domains it needs to contact.
    678662        </para>
    679663

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml

    r414 r988  
    2828<indexterm><primary>ADS</primary></indexterm>
    2929<indexterm><primary>LDAP-based</primary></indexterm>
    30 Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
    31 will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
     30Samba supports NT4-style domain trust relationships. This is a feature that many sites
     31will want to use if they migrate to Samba from an NT4-style domain and do not want to
    3232adopt Active Directory or an LDAP-based authentication backend. This chapter explains
    3333some background information regarding trust relationships and how to create them. It is now
    34 possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba
     34possible for Samba to trust NT4 (and vice versa), as well as to create Samba-to-Samba
    3535trusts.
    3636</para>
    … …  
    7575<indexterm><primary>scalability</primary></indexterm>
    7676<indexterm><primary>trust relationships</primary></indexterm>
    77 Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
     77Samba can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
    7878trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4.
    7979</para>
    … …  
    8585<indexterm><primary>interdomain trusts</primary></indexterm>
    8686<indexterm><primary>ADS</primary></indexterm>
    87 Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its
     87Given that Samba can function with a scalable backend authentication database such as LDAP, and given its
    8888ability to run in primary as well as backup domain control modes, the administrator would be well-advised to
    8989consider alternatives to the use of interdomain trusts simply because, by the very nature of how trusts
    … …  
    166166Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with
    167167Windows 2000 and ADS, the red and blue domains can trust each other. This is an inherent feature of ADS
    168 domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
     168domains. Samba implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
    169169security domains in similar manner to MS Windows NT4-style domains.
    170170</para>
    … …  
    340340<indexterm><primary>between domains</primary></indexterm>
    341341Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a
    342 Windows NT4 server. However, the remote end could just as well be another Samba-3  domain. It can be clearly
     342Windows NT4 server. However, the remote end could just as well be another Samba  domain. It can be clearly
    343343seen, after reading this document, that combining Samba-specific parts of what's written in the following
    344344sections leads to trust between domains in a purely Samba environment.
    … …  
    591591
    592592<para>
    593 It works with Samba-3  and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
     593It works with Samba  and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
    594594Both domain controllers, Samba and NT must have the same WINS server; otherwise,
    595595the trust will never work.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml

    r414 r988  
    7373        The real people behind Samba are users like you. You have inspired the
    7474        developers (the Samba Team) to do more than any of them imagined could or should
    75         be done. User feedback drives Samba development. Samba-3 in particular incorporates
     75        be done. User feedback drives Samba development. Samba in particular incorporates
    7676        a huge amount of work done as a result of user requests, suggestions and direct
    7777        code contributions.
    … …  
    133133        Existing Samba books are largely addressed to the UNIX administrator.
    134134        From the perspective of this target group the existing books serve
    135         an adequate purpose, with one exception &smbmdash; now that Samba-3 is out
     135        an adequate purpose, with one exception &smbmdash; now that Samba is out
    136136        they need to be updated!
    137137        </para>
    … …  
    163163                <varlistentry><term>General Installation</term>
    164164                        <listitem><para>
    165                         Designed to help you get Samba-3 running quickly.
     165                        Designed to help you get Samba running quickly.
    166166                        The Fast Start chapter is a direct response to requests from
    167167                        Microsoft network administrators for some sample configurations
    … …  
    182182                        <listitem><para>
    183183                        The mechanics of network browsing have long been the Achilles heel of
    184                         all Microsoft Windows users. Samba-3 introduces new user and machine
     184                        all Microsoft Windows users. Samba introduces new user and machine
    185185                        account management facilities, a new way to map UNIX groups and Windows
    186186                        groups, Interdomain trusts, new loadable file system drivers (VFS), and
    … …  
    216216               
    217217<para>
    218 Welcome to Samba-3 and the first published document to help you and your users to enjoy a whole
     218Welcome to Samba and the first published document to help you and your users to enjoy a whole
    219219new world of interoperability between Microsoft Windows and the rest of the world.
    220220</para>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml

    r414 r988  
    77</chapterinfo>
    88
    9 <title>Migration from NT4 PDC to Samba-3 PDC</title>
     9<title>Migration from NT4 PDC to Samba PDC</title>
    1010
    1111<para>
    … …  
    1313<indexterm><primary>domain control</primary></indexterm>
    1414This is a rough guide to assist those wishing to migrate from NT4 domain control to
    15 Samba-3-based domain control.
     15Samba-based domain control.
    1616</para>
    1717
    … …  
    2828<para>
    2929<indexterm><primary>migration plan</primary></indexterm>
    30 Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
     30Those wishing to migrate from MS Windows NT4 domain control to a Samba domain control
    3131environment would do well to develop a detailed migration plan. So here are a few pointers to
    3232help migration get underway.
    … …  
    3939<indexterm><primary>migration process</primary></indexterm>
    4040The key objective for most organizations is to make the migration from MS Windows NT4
    41 to Samba-3 domain control as painless as possible. One of the challenges you may experience
     41to Samba domain control as painless as possible. One of the challenges you may experience
    4242in your migration process may well be convincing management that the new environment
    4343should remain in place. Many who have introduced open source technologies have experienced
    … …  
    4747<para>
    4848<indexterm><primary>change motivations</primary></indexterm>
    49 Before attempting a migration to a Samba-3-controlled network, make every possible effort to
     49Before attempting a migration to a Samba-controlled network, make every possible effort to
    5050gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change
    5151is important for the organization. Possible motivations to make a change include:
    … …  
    7474<indexterm><primary>ADS</primary></indexterm>
    7575<indexterm><primary>without ADS</primary></indexterm>
    76 Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers
     76Make sure everyone knows that Samba is not MS Windows NT4. Samba-3 offers
    7777an alternative solution that is both different from MS Windows NT4 and offers
    78 advantages compared with it. Gain recognition that Samba-3 lacks many of the
     78advantages compared with it. Gain recognition that Samba lacks many of the
    7979features that Microsoft has promoted as core values in migration from MS Windows NT4 to
    8080MS Windows 2000 and beyond (with or without Active Directory services).
    … …  
    8282
    8383<para>
    84 What are the features that Samba-3 cannot provide?
     84What are the features that Samba cannot provide?
    8585</para>
    8686
    … …  
    100100
    101101<para>
    102 The features that Samba-3 does provide and that may be of compelling interest to your site
     102The features that Samba does provide and that may be of compelling interest to your site
    103103include:
    104104</para>
    … …  
    135135<para>
    136136<indexterm><primary>successful migration</primary></indexterm>
    137 Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
     137Before migrating a network from MS Windows NT4 to Samba, consider all necessary factors. Users
    138138should be educated about changes they may experience so the change will be a welcome one
    139139and not become an obstacle to the work they need to do. The following sections explain factors that will
    … …  
    161161<indexterm><primary>slave servers</primary></indexterm>
    162162<indexterm><primary>multiple domains</primary></indexterm>
    163 Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
     163Samba can be configured as a domain controller, a backup domain controller (probably best called
    164164a secondary controller), a domain member, or a standalone server. The Windows network security
    165165domain context should be sized and scoped before implementation. Particular attention needs to be
    166166paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs).
    167 One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP
     167One way in which Samba differs from Microsoft technology is that if one chooses to use an LDAP
    168168authentication backend, then the same database can be used by several different domains. In a
    169169complex organization, there can be a single LDAP database, which itself can be distributed (have
    … …  
    282282<indexterm><primary>SID</primary></indexterm>
    283283<indexterm><primary>NTuser.DAT</primary></indexterm>
    284 Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS
     284Profiles may also be managed using the Samba tool <command>profiles</command>. This tool allows the MS
    285285Windows NT-style security identifiers (SIDs) that are stored inside the profile
    286 <filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain.
     286<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba domain.
    287287</para>
    288288</sect3>
    … …  
    296296<indexterm><primary>migrate group</primary></indexterm>
    297297<indexterm><primary>map</primary></indexterm>
    298 It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
    299 attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
     298It is possible to migrate all account settings from an MS Windows NT4 domain to Samba. Before
     299attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba the
    300300groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to
    301301suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
    … …  
    322322<indexterm><primary>netlogon share</primary></indexterm>
    323323<indexterm><primary>BDC</primary></indexterm>
    324         Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
     324        Samba is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
    325325        to function as a BDC: <parameter>domain master = No</parameter>.
    326326        </para></listitem>
    … …  
    415415<para>
    416416There are three basic choices for sites that intend to migrate from MS Windows NT4
    417 to Samba-3:
     417to Samba:
    418418</para>
    419419
    … …  
    473473        </row>
    474474        <row>
    475         <entry><para>Move all accounts from NT4 into Samba-3</para></entry>
     475        <entry><para>Move all accounts from NT4 into Samba</para></entry>
    476476        <entry><para>Copy and improve</para></entry>
    477477        <entry><para>Authentication regime (database location and access)</para></entry>
    … …  
    493493        </row>
    494494        <row>
    495         <entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry>
     495        <entry><para>Integrate Samba, then migrate while users are active, then change of control (swap out)</para></entry>
    496496        <entry><para>Take advantage of lower maintenance opportunity</para></entry>
    497497        <entry><para></para></entry>
    … …  
    503503
    504504<sect2>
    505 <title>Samba-3 Implementation Choices</title>
     505<title>Samba Implementation Choices</title>
    506506
    507507<variablelist>
    508508                <varlistentry><term>Authentication Database/Backend</term><listitem>
    509509                <para>
    510                 Samba-3 can use an external authentication backend:
     510                Samba can use an external authentication backend:
    511511                </para>
    512512
    … …  
    516516                        <listitem><para>External server could use Active Directory or NT4 domain.</para></listitem>
    517517                        <listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem>
    518                         <listitem><para> Samba-3 can use a local authentication backend: <parameter>smbpasswd</parameter>,
     518                        <listitem><para> Samba can use a local authentication backend: <parameter>smbpasswd</parameter>,
    519519                                <parameter>tdbsam</parameter>, <parameter>ldapsam</parameter>
    520520                        </para></listitem>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml

    r414 r988  
    4444<indexterm><primary>ADS</primary></indexterm>
    4545MS Windows 2000 and later versions can be configured to operate with no NetBIOS
    46 over TCP/IP. Samba-3 and later versions also support this mode of operation.
     46over TCP/IP. Samba and later versions also support this mode of operation.
    4747When the use of NetBIOS over TCP/IP has been disabled, the primary
    4848means for resolution of MS Windows machine names is via DNS and Active Directory.
    … …  
    15631563<indexterm><primary>DNS/LDAP/ADS</primary></indexterm>
    15641564<indexterm><primary>name resolution</primary></indexterm>
    1565 MS Windows 2000 and later versions, as with Samba-3 and later versions, can be
     1565MS Windows 2000 and later versions, as with Samba and later versions, can be
    15661566configured to not use NetBIOS over TCP/IP. When configured this way,
    15671567it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
    … …  
    17461746<indexterm><primary>ADS</primary></indexterm>
    17471747<indexterm><primary>DNS</primary></indexterm>
    1748 It is possible to operate Samba-3 without NetBIOS over TCP/IP. If you do this, be warned that if used outside
     1748It is possible to operate Samba without NetBIOS over TCP/IP. If you do this, be warned that if used outside
    17491749of MS ADS, this will forgo network browsing support. ADS permits network browsing support through DNS,
    17501750providing appropriate DNS records are inserted for all Samba servers.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml

    r414 r988  
    145145
    146146<para>
    147 The following functionalities are new to the Samba-3 release:
     147The following functionalities are an overview of some of the features
     148in the Samba-4 release:
    148149</para>
    149150
    … …  
    151152        <listitem><para>
    152153        <indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
    153         Samba-3 supports the use of a choice of backends that may be used in which user, group and machine
    154         accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend
    155         data sets, or as fail-over data sets.
     154        Samba-4 supports the use of a choice of backends that may be used in which user, group and machine
     155        accounts may be stored, but only when acting as a classic
     156        (NT4) domain controller,
     157        but not when it is acting as an Active Directory Domain Controller.
    156158        </para>
    157159
    … …  
    163165        <indexterm><primary>reliability</primary></indexterm>
    164166        An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated,
    165         which is of great value because it confers scalability and provides a high degree of reliability.
     167        which is of great value because it confers scalability and
     168        provides a high degree of reliability.  This may be used when
     169        Samba-4 is acting as an classic (NT4-like) domain controller,
     170        but not when it is acting as an Active Directory Domain Controller.
    166171        </para></listitem>
    167172
    … …  
    170175        <indexterm><primary>trust account</primary><secondary>interdomain</secondary></indexterm>
    171176        <indexterm><primary>interoperability</primary></indexterm>
    172         Windows NT4 domain trusts. Samba-3 supports workstation and server (machine) trust accounts. It also
     177        Windows NT4 domain trusts. Samba-4 supports workstation and server (machine) trust accounts. It also
    173178        supports Windows NT4 style interdomain trust accounts, which further assists in network scalability
    174         and interoperability.
     179        and interoperability, but only when itself is an classic
     180        (NT4-like) domain controller.
    175181        </para></listitem>
    176182       
    … …  
    183189        <indexterm><primary>network</primary><secondary>browsing</secondary></indexterm>
    184190        Operation without NetBIOS over TCP/IP, rather using the raw SMB over TCP/IP. Note, this is feasible
    185         only when operating as a Microsoft active directory domain member server. When acting as a Samba domain
     191        only when operating as a Microsoft active directory domain
     192        member server. When acting as a Samba classic (NT4-like) domain
    186193        controller the use of NetBIOS is necessary to provide network browsing support.
    187194        </para></listitem>
    … …  
    191198        <indexterm><primary>TCP port</primary></indexterm>
    192199        <indexterm><primary>session services</primary></indexterm>
    193         Samba-3 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
     200        Samba-4 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
    194201        TCP/IP (TCP port 445) session services, and Microsoft compatible ONC DCE RPC services (TCP port 135)
    195202        services.
    196203        </para></listitem>
    197204
     205
    198206        <listitem><para>
    199         <indexterm><primary>Nexus.exe</primary></indexterm>
    200         Management of users and groups via the User Manager for Domains. This can be done on any MS Windows client
    201         using the <filename>Nexus.exe</filename> toolkit for Windows 9x/Me, or using the SRVTOOLS.EXE package for MS
    202         Windows NT4/200x/XP platforms. These packages are available from Microsoft's Web site.
     207        <indexterm><primary>kerberos</primary></indexterm>
     208        <indexterm><primary>active directory</primary></indexterm>
     209        Acting as a Windows 2000 active directory domain controller
     210        (i.e., Kerberos and Active Directory).
    203211        </para></listitem>
    204212
    205213        <listitem><para>
    206         Implements full Unicode support. This simplifies cross-locale internationalization support. It also opens up
    207         the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.
     214        <indexterm><primary>MMC</primary></indexterm>
     215        <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
     216        <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
     217        The Windows 200x/XP Microsoft Management Console (MMC) can be
     218        used to manage a Samba-4 server, when it is an Active
     219        Directory Domain Controller.  When acting as a classic (NT4)
     220        domain controller, you
     221        can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
     222        part of the SVRTOOLS.EXE package mentioned later.
    208223        </para></listitem>
    209224</itemizedlist>
    210225
    211226<para>
    212 The following functionalities are not provided by Samba-3:
     227The following functionalities are not provided by Samba-4:
    213228</para>
    214229
    … …  
    218233        <indexterm><primary>replication</primary></indexterm>
    219234        SAM replication with Windows NT4 domain controllers (i.e., a Samba PDC and a Windows NT BDC, or vice versa).
    220         This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-3 can not
     235        This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-4 can not
    221236        participate in replication of account data to Windows PDCs and BDCs.
    222237        </para></listitem>
    223238       
    224         <listitem><para>
    225         <indexterm><primary>kerberos</primary></indexterm>
    226         <indexterm><primary>active directory</primary></indexterm>
    227         Acting as a Windows 2000 active directory domain controller (i.e., Kerberos and Active Directory). In point of
    228         fact, Samba-3 does have some Active Directory domain control ability that is at this time purely experimental.
    229         Active directory domain control is one of the features that is being developed in Samba-4, the next
    230         generation Samba release. At this time there are no plans to enable active directory domain control
    231         support during the Samba-3 series life-cycle.
    232         </para></listitem>
    233 
    234         <listitem><para>
    235         <indexterm><primary>MMC</primary></indexterm>
    236         <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
    237         <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
    238         The Windows 200x/XP Microsoft Management Console (MMC) cannot be used to manage a Samba-3 server. For this you
    239         can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
    240         part of the SVRTOOLS.EXE package mentioned later.
    241         </para></listitem>
    242239</itemizedlist>
    243240
    244241<para>
    245 <indexterm><primary>Windows XP Home edition</primary></indexterm>
    246 <indexterm><primary>LanMan</primary></indexterm>
    247 Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined in this chapter. The
    248 protocol for support of Windows 9x/Me-style network (domain) logons is completely different from NT4/Windows
    249 200x-type domain logons and has been officially supported for some time. These clients use the old LanMan
    250 network logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.
    251 </para>
    252 
    253 <para>
    254242<indexterm><primary>group</primary><secondary>mapping</secondary></indexterm>
    255 Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
     243Samba implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
    256244to explain in a short space). This is discussed more fully in <link linkend="groupmapping">Group Mapping: MS
    257245Windows and UNIX</link>.
    … …  
    262250<indexterm><primary>trust account</primary><secondary>machine</secondary></indexterm>
    263251<indexterm><primary>machine account</primary></indexterm>
    264 Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
     252Samba-4, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
    265253Account information in a suitable backend data-store.  Refer to <link linkend="machine-trust-accounts">MS
    266 Windows Workstation/Server Machine Trust Accounts</link>. With Samba-3 there can be multiple backends for
    267 this. A complete discussion of account database backends can be found in <link linkend="passdb">Account
     254Windows Workstation/Server Machine Trust Accounts</link>. A complete discussion of account database backends can be found in <link linkend="passdb">Account
    268255Information Databases</link>.
    269256</para>
    … …  
    323310system. It is often assumed that such a centralized system will use a single authentication infrastructure
    324311that can be used by all information systems. The Microsoft Windows NT4 security domain architecture and the
    325 Micrsoft active directory service are often put forward as the ideal foundation for such a system. It is
     312Microsoft active directory service are often put forward as the ideal foundation for such a system. It is
    326313conceptually simple to install an external authentication agent on each of the disparate infromation systems
    327314that can then use the Microsoft (NT4 domain or ads service) for user authentication and access control. The
    … …  
    426413Primary domain control, if it is to be scalable to meet the needs of large sites, must therefore be capable of
    427414using LDAP. The rapid adoption of OpenLDAP, and Samba configurations that use it, is ample proof that the era
    428 of the directory has started. Samba-3 does not demand the use of LDAP, but the demand for a mechanism by which
     415of the directory has started. Samba does not demand the use of LDAP, but the demand for a mechanism by which
    429416user and group identity information can be distributed makes it an an unavoidable option.
    430417</para>
    … …  
    434421<indexterm><primary>LDAP</primary></indexterm>
    435422<indexterm><primary>e-Directory</primary></indexterm>
    436 At this time, the use of Samba based BDCs, necessitates the use of LDAP. The most commonly used LDAP
     423At this time, the use of Samba based BDCs, necessitates the use of
     424either the Samba-4 Active Directory Domain controller or, for classic
     425(NT4-like)domains an LDAP backend. The most commonly used LDAP
    437426implementation used by Samba sites is OpenLDAP. It is possible to use any standards compliant LDAP server.
    438427Those known to work includes those manufactured by: IBM, CA, Novell (e-Directory), and others.
    … …  
    477466<indexterm><primary>authenticatior</primary></indexterm>
    478467<indexterm><primary>synchronization</primary></indexterm>
     468<indexterm><primary>FSMO</primary></indexterm>
     469<indexterm><primary>Flexible Single Master Operator</primary><see>FSMO</see></indexterm>
    479470<indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
    480471In the case of MS Windows NT4-style domains, it is the PDC that initiates a new domain control database.
    481472This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key
    482473part in NT4-type domain user authentication and in synchronization of the domain authentication
    483 database with BDCs.
    484 </para>
    485 
    486 <para>
    487 <indexterm><primary>domain</primary><secondary>controller</secondary><tertiary>hierarchy</tertiary></indexterm>
    488 <indexterm><primary>LDAP</primary></indexterm>
    489 <indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
    490 <indexterm><primary>machine account</primary></indexterm>
    491 With MS Windows 200x Server-based Active Directory domains, one domain controller initiates a potential
    492 hierarchy of domain controllers, each with its own area of delegated control. The master domain
    493 controller has the ability to override any downstream controller, but a downline controller has
    494 control only over its downline. With Samba-3, this functionality can be implemented using an
    495 LDAP-based user and machine account backend.
     474database with BDCs.  With Active Directory domains, while some servers
     475may be a Flexible Single Master Operator (FSMO) role owner (and
     476therefore hold the monopoly for certain operations), it is in general
     477a distributed, multi-master replicated directory.
    496478</para>
    497479
    … …  
    499481<indexterm><primary>backend database</primary></indexterm>
    500482<indexterm><primary>registry</primary></indexterm>
    501 New to Samba-3 is the ability to use a backend database that holds the same type of data as the NT4-style SAM
    502 database (one of the registry files)<footnote><para>See also <link linkend="passdb">Account Information
     483Samba-4 can use a backend database that holds the same type of data as the NT4-style SAM
     484database (one of the registry files).  For BDC/BDC operations in a
     485classic domain, this functionality can be implemented using an
     486LDAP-based user and machine account backend.  The Samba-4 Active
     487Directory Domain controller implements the required storage internally.<footnote><para>See also <link linkend="passdb">Account Information
    503488Databases</link>.</para></footnote>
    504489</para>
    … …  
    527512<indexterm><primary>demote</primary></indexterm>
    528513A Windows NT4 BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to PDC,
    529 the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic operation; the PDC
     514the previous PDC is automatically demoted to a BDC. With Samba, this is not an automatic operation; the PDC
    530515and BDC must be manually configured, and other appropriate changes also need to be made.
    531516</para>
    … …  
    548533</itemizedlist>
    549534
    550 <note><para>
    551 <indexterm><primary>promote</primary></indexterm>
    552 Algin Technology LLC provide a commercial tool that makes it possible to promote a Windows NT4 standalone
    553 server to a PDC or a BDC, and also permits this process to be reversed. Refer to the <ulink
    554 url="http://utools.com/UPromote.asp">Algin</ulink> web site for further information.
    555 </para></note>
    556 
    557535<para>
    558536<indexterm><primary>domain</primary><secondary>control</secondary><tertiary>role</tertiary></indexterm>
    559537<indexterm><primary>native member</primary></indexterm>
    560 Samba-3 servers can readily be converted to and from domain controller roles through simple changes to the
    561 &smb.conf; file. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active
     538Samba servers can readily be converted to and from domain controller roles through simple changes to the
     539&smb.conf; file. Samba is capable of acting fully as a native member of a Windows 200x server Active
    562540Directory domain.
    563541</para>
    … …  
    573551<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
    574552<indexterm><primary>SAM</primary><secondary>replication</secondary></indexterm>
    575 New to Samba-3 is the ability to function fully as an MS Windows NT4-style domain controller,
    576 excluding the SAM replication components. However, please be aware that Samba-3 also supports the
     553New to Samba is the ability to function fully as an MS Windows NT4-style domain controller,
     554excluding the SAM replication components. However, please be aware that Samba also supports the
    577555MS Windows 200x domain control protocols.
    578556</para>
    579 
    580 <para>
    581 <indexterm><primary>ADS</primary></indexterm>
    582 At this time any appearance that Samba-3 is capable of acting as a <emphasis>domain controller</emphasis> in
    583 native ADS mode is limited and experimental in nature.  This functionality should not be used until the Samba
    584 Team offers formal support for it.  At such a time, the documentation will be revised to duly reflect all
    585 configuration and management requirements. Samba can act as a NT4-style domain controller in a Windows 2000/XP
    586 environment. However, there are certain compromises:
    587 </para>
    588 
    589 <itemizedlist>
    590         <listitem><para>No machine policy files.</para></listitem>
    591         <listitem><para>No Group Policy Objects.</para></listitem>
    592         <listitem><para>No synchronously executed Active Directory logon scripts.</para></listitem>
    593         <listitem><para>Can't use Active Directory management tools to manage users and machines.</para></listitem>
    594         <listitem><para>Registry changes tattoo the main registry, while with Active Directory they do not leave
    595                 permanent changes in effect.</para></listitem>
    596         <listitem><para>Without Active Directory you cannot perform the function of exporting specific
    597                 applications to specific users or groups.</para></listitem>
    598 </itemizedlist>
    599557
    600558</sect2>
    … …  
    647605
    648606<para>
    649 The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows
     607The following are necessary for configuring Samba as an MS Windows NT4-style PDC for MS Windows
    650608NT4/200x/XP clients:
    651609</para>
    … …  
    663621</itemizedlist>
    664622
    665 <para>
    666 The following provisions are required to serve MS Windows 9x/Me clients:
    667 </para>
    668 
    669 <itemizedlist>
    670         <listitem><para>Configuration of basic TCP/IP and MS Windows networking.</para></listitem>
    671         <listitem><para>Correct designation of the server role (<smbconfoption name="security">user</smbconfoption>).</para></listitem>
    672         <listitem><para>Network logon configuration (since Windows 9x/Me/XP Home are not technically domain
    673         members, they do not really participate in  the security aspects of Domain logons as such).</para></listitem>
    674         <listitem><para>Roaming profile configuration.</para></listitem>
    675         <listitem><para>Configuration of system policy handling.</para></listitem>
    676         <listitem><para>Installation of the network driver <quote>Client for MS Windows Networks</quote> and configuration
    677         to log onto the domain.</para></listitem>
    678         <listitem><para>Placing Windows 9x/Me clients in user-level security &smbmdash; if it is desired to allow
    679         all client-share access to be controlled according to domain user/group identities.</para></listitem>
    680         <listitem><para>Adding and managing domain user accounts.</para></listitem>
    681 </itemizedlist>
    682 
    683623<note><para>
    684624<indexterm><primary>roaming profiles</primary></indexterm>
    … …  
    727667It is rather easy to configure Samba to provide these. Each Samba domain controller must provide the NETLOGON
    728668service that Samba calls the <smbconfoption name="domain logons"/> functionality (after the name of the
    729 parameter in the &smb.conf; file). Additionally, one server in a Samba-3 domain must advertise itself as the
     669parameter in the &smb.conf; file). Additionally, one server in a Samba domain must advertise itself as the
    730670domain master browser.<footnote><para>See <link linkend="NetworkBrowsing">Network
    731671Browsing</link>.</para></footnote> This causes the PDC to claim a domain-specific NetBIOS name that identifies
    … …  
    755695<smbconfoption name="workgroup"><replaceable>&example.workgroup;</replaceable></smbconfoption>
    756696<smbconfoption name="passdb backend">tdbsam</smbconfoption>
    757 <smbconfoption name="os level">33</smbconfoption>
    758 <smbconfoption name="preferred master">auto</smbconfoption>
    759 <smbconfoption name="domain master">yes</smbconfoption>
    760 <smbconfoption name="local master">yes</smbconfoption>
    761697<smbconfoption name="security">user</smbconfoption>
    762698<smbconfoption name="domain logons">yes</smbconfoption>
    … …  
    810746        <varlistentry><term>Domain Control Parameters </term>
    811747                <listitem><para>
    812                 <indexterm><primary>os level</primary></indexterm>
    813                 <indexterm><primary>preferred master</primary></indexterm>
    814                 <indexterm><primary>domain master</primary></indexterm>
    815748                <indexterm><primary>network</primary><secondary>logon</secondary></indexterm>
    816                 The parameters <emphasis>os level, preferred master, domain master, security,
    817                 encrypt passwords</emphasis>, and <emphasis>domain logons</emphasis> play a central role in assuring domain
     749                The parameters <emphasis>domain logons</emphasis>
     750                parameter is the key parameter indicating domain
    818751                control and network logon support.
    819                 </para>
    820 
    821                 <para>
    822                 <indexterm><primary>DMB</primary></indexterm>
    823                 <indexterm><primary>encryped password</primary></indexterm>
    824                 The <emphasis>os level</emphasis> must be set at or above a value of 32. A domain controller
    825                 must be the DMB, must be set in <emphasis>user</emphasis> mode security,
    826                 must support Microsoft-compatible encrypted passwords, and must provide the network logon
    827                 service (domain logons). Encrypted passwords must be enabled. For more details on how
    828                 to do this, refer to <link linkend="passdb">Account Information Databases</link>.
    829752                </para></listitem>
    830753        </varlistentry>
    … …  
    867790                This share is used to store user desktop profiles. Each user must have a directory at the root
    868791                of this share. This directory must be write-enabled for the user and must be globally read-enabled.
    869                 Samba-3 has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will
     792                Samba has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will
    870793                allow a Samba administrator to make the directory read-only to everyone. Of course this is useful
    871794                only after the profile has been properly created.
    … …  
    884807<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
    885808<smbconfoption name="domain logons">Yes</smbconfoption>
    886 <smbconfoption name="domain master">Yes</smbconfoption>
    887809<smbconfoption name="security">User</smbconfoption>
    888810</smbconfblock>
    … …  
    901823<para>
    902824<indexterm><primary>active directory</primary></indexterm>
    903 Samba-3 is not, and cannot act as, an Active Directory server. It cannot truly function as an Active Directory
    904 PDC. The protocols for some of the functionality of Active Directory domain controllers has been partially
    905 implemented on an experimental only basis. Please do not expect Samba-3 to support these protocols. Do not
    906 depend on any such functionality either now or in the future. The Samba Team may remove these experimental
    907 features or may change their behavior. This is mentioned for the benefit of those who have discovered secret
    908 capabilities in Samba-3 and who have asked when this functionality will be completed. The answer is maybe
    909 someday or maybe never!
     825Samba-4 is also available as an Active Directory server. It can truly function as an Active Directory
     826PDC. The protocols for some of the functionality of Active Directory
     827domain controllers has been implemented.
    910828</para>
    911829
    … …  
    913831<indexterm><primary>domain controllers</primary></indexterm>
    914832<indexterm><primary>active directory</primary></indexterm>
    915 To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style
    916 domain controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have
    917 a number of features that Windows NT4 domain controllers do not have. In short, Samba-3 is not NT4 and it
    918 is not Windows Server 200x: it is not an Active Directory server. We hope this is plain and simple
    919 enough for all to understand.
     833<indexterm><primary>classic domain support</primary></indexterm>
     834To be sure, Samba-4 is also designed to provide most of the functionality that Microsoft Windows NT4-style
     835domain controllers have. Samba-4 does not have all the capabilities of Windows NT4, but it does have
     836a number of features that Windows NT4 domain controllers do not
     837have. We call it a <emphasis>classic domain</emphasis> controller for
     838this reason, as in short, Samba-4 when acting in this mode is not NT4,
     839and the Active Directory Domain Control aspect is a distinct capability.
    920840</para>
    921841
    … …  
    937857<indexterm><primary>domain logon</primary></indexterm>
    938858All domain controllers must run the netlogon service (<emphasis>domain logons</emphasis>
    939 in Samba). One domain controller must be configured with <smbconfoption name="domain master">Yes</smbconfoption>
     859in Samba). One domain controller must be configured without the
     860<smbconfoption name="domain master"></smbconfoption> parameter
    940861(the PDC); on all BDCs set the parameter <smbconfoption name="domain master">No</smbconfoption>.
    941862</para>
    … …  
    949870<smbconfsection name="[global]"/>
    950871<smbconfoption name="domain logons">Yes</smbconfoption>
    951 <smbconfoption name="domain master">(Yes on PDC, No on BDCs)</smbconfoption>
     872<smbconfoption name="domain master">(omit on PDC, No on BDCs)</smbconfoption>
    952873
    953874<smbconfsection name="[netlogon]"/>
    … …  
    961882</sect3>
    962883<sect3>
    963 <title>The Special Case of MS Windows XP Home Edition</title>
    964 
    965 <para>
    966 <indexterm><primary>Windows XP Home edition</primary></indexterm>
    967 To be completely clear: If you want MS Windows XP Home Edition to integrate with your
     884<title>The Special Case of MS Windows Home Editions</title>
     885
     886<para>
     887<indexterm><primary>Windows Home editions</primary></indexterm>
     888To be completely clear: If you want MS Windows Home Editions to integrate with your
    968889MS Windows NT4 or Active Directory domain security, understand it cannot be done.
    969 The only option is to purchase the upgrade from MS Windows XP Home Edition to
    970 MS Windows XP Professional.
     890The only option is to purchase the upgrade from MS Windows Home Edition to
     891a MS Windows Professional edition.
    971892</para>
    972893
    973894<note><para>
    974 MS Windows XP Home Edition does not have the ability to join any type of domain
    975 security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely
    976 lacks the ability to log onto a network.
     895MS Windows Home Editions do not have the ability to join any type of domain
     896security facility. Unlike MS Windows 9x/Me, MS Windows Home Edition
     897deliberatly lacks the ability to log onto a network.
    977898</para></note>
    978899
    … …  
    986907</sect3>
    987908
    988 <sect3>
    989 <title>The Special Case of Windows 9x/Me</title>
    990 
    991 <para>
    992 <indexterm><primary>domain</primary></indexterm>
    993 <indexterm><primary>workgroup</primary></indexterm>
    994 <indexterm><primary>authentication</primary></indexterm>
    995 <indexterm><primary>browsing</primary></indexterm>
    996 <indexterm><primary>rights</primary></indexterm>
    997 A domain and a workgroup are exactly the same in terms of network
    998 browsing. The difference is that a distributable authentication
    999 database is associated with a domain, for secure login access to a
    1000 network. Also, different access rights can be granted to users if they
    1001 successfully authenticate against a domain logon server. Samba-3 does this
    1002 now in the same way as MS Windows NT/200x.
    1003 </para>
    1004 
    1005 <para>
    1006 <indexterm><primary>browsing</primary></indexterm>
    1007 The SMB client logging on to a domain has an expectation that every other
    1008 server in the domain should accept the same authentication information.
    1009 Network browsing functionality of domains and workgroups is identical and
    1010 is explained in this documentation under the browsing discussions.
    1011 It should be noted that browsing is totally orthogonal to logon support.
    1012 </para>
    1013 
    1014 <para>
    1015 <indexterm><primary>single-logon</primary></indexterm>
    1016 <indexterm><primary>domain logons</primary></indexterm>
    1017 <indexterm><primary>network logon</primary></indexterm>
    1018 Issues related to the single-logon network model are discussed in this
    1019 section. Samba supports domain logons, network logon scripts, and user
    1020 profiles for MS Windows for Workgroups and MS Windows 9x/Me clients,
    1021 which are the focus of this section.
    1022 </para>
    1023 
    1024 <para>
    1025 <indexterm><primary>broadcast request</primary></indexterm>
    1026 When an SMB client in a domain wishes to log on, it broadcasts requests for a logon server. The first one to
    1027 reply gets the job and validates its password using whatever mechanism the Samba administrator has installed.
    1028 It is possible (but ill advised) to create a domain where the user database is not shared between servers;
    1029 that is, they are effectively workgroup servers advertising themselves as participating in a domain. This
    1030 demonstrates how authentication is quite different from but closely involved with domains.
    1031 </para>
    1032 
    1033 <para>
    1034 Using these features, you can make your clients verify their logon via
    1035 the Samba server, make clients run a batch file when they log on to
    1036 the network and download their preferences, desktop, and start menu.
    1037 </para>
    1038 
    1039 <para><emphasis>
    1040 MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.
    1041 </emphasis></para>
    1042 
    1043 <para>
    1044 Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/Me client
    1045 performs a logon:
    1046 </para>
    1047 
    1048 <orderedlist>
    1049 <listitem>
    1050         <para>
    1051         <indexterm><primary>DOMAIN&lt;1C&gt;</primary></indexterm>
    1052         <indexterm><primary>logon server</primary></indexterm>
    1053         The client broadcasts (to the IP broadcast address of the subnet it is in)
    1054         a NetLogon request. This is sent to the NetBIOS name DOMAIN&lt;1C&gt; at the
    1055         NetBIOS layer. The client chooses the first response it receives, which
    1056         contains the NetBIOS name of the logon server to use in the format of
    1057         <filename>\\SERVER</filename>. The <literal>1C</literal> name is the name
    1058         type that is registered by domain controllers (SMB/CIFS servers that provide
    1059         the netlogon service).
    1060         </para>
    1061 </listitem>
    1062 
    1063 <listitem>
    1064         <para>
    1065         <indexterm><primary>IPC$</primary></indexterm>
    1066         <indexterm><primary>SMBsessetupX</primary></indexterm>
    1067         <indexterm><primary>SMBtconX</primary></indexterm>
    1068         The client connects to that server, logs on (does an SMBsessetupX) and
    1069         then connects to the IPC$ share (using an SMBtconX).
    1070         </para>
    1071 </listitem>
    1072 
    1073 <listitem>
    1074         <para>
    1075         <indexterm><primary>NetWkstaUserLogon</primary></indexterm>
    1076         The client does a NetWkstaUserLogon request, which retrieves the name
    1077         of the user's logon script.
    1078         </para>
    1079 </listitem>
    1080 
    1081 <listitem>
    1082         <para>
    1083         The client then connects to the NetLogon share and searches for said script.   
    1084         If it is found and can be read, it is retrieved and executed by the client.
    1085         After this, the client disconnects from the NetLogon share.
    1086         </para>
    1087 </listitem>
    1088 
    1089 <listitem>
    1090         <para>
    1091         <indexterm><primary>NetUserGetInfo</primary></indexterm>
    1092         <indexterm><primary>profile</primary></indexterm>
    1093         The client sends a NetUserGetInfo request to the server to retrieve
    1094         the user's home share, which is used to search for profiles. Since the
    1095         response to the NetUserGetInfo request does not contain much more than 
    1096         the user's home share, profiles for Windows 9x clients must reside in the user
    1097         home directory.
    1098         </para>
    1099 </listitem>
    1100 
    1101 <listitem>
    1102         <para>
    1103         <indexterm><primary>profiles</primary></indexterm>
    1104         The client connects to the user's home share and searches for the
    1105         user's profile. As it turns out, you can specify the user's home share as
    1106         a share name and path. For example, <filename>\\server\fred\.winprofile</filename>.
    1107         If the profiles are found, they are implemented.
    1108         </para>
    1109 </listitem>
    1110 
    1111 <listitem>
    1112         <para>
    1113         <indexterm><primary>CONFIG.POL</primary></indexterm>
    1114         The client then disconnects from the user's home share and reconnects to
    1115         the NetLogon share and looks for <filename>CONFIG.POL</filename>, the policies file. If this is
    1116         found, it is read and implemented.
    1117         </para>
    1118 </listitem>
    1119 </orderedlist>
    1120 
    1121 <para>
    1122 The main difference between a PDC and a Windows 9x/Me logon server configuration is:
    1123 </para>
    1124 
    1125 <itemizedlist>
    1126 <listitem><para>
    1127         <indexterm><primary>password</primary><secondary>plaintext</secondary></indexterm>
    1128         <indexterm><primary>plaintext password</primary></indexterm>
    1129         Password encryption is not required for a Windows 9x/Me logon server. But note
    1130         that beginning with MS Windows 98 the default setting is that plaintext
    1131         password support is disabled. It can be re-enabled with the registry
    1132         changes that are documented in <link linkend="PolicyMgmt">System and Account Policies</link>.
    1133         </para></listitem>
    1134 
    1135         <listitem><para>
    1136         <indexterm><primary>machine trust account</primary></indexterm>
    1137         Windows 9x/Me clients do not require and do not use Machine Trust Accounts.
    1138         </para></listitem>
    1139 </itemizedlist>
    1140 
    1141 <para>
    1142 <indexterm><primary>network logon services</primary></indexterm>
    1143 A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the
    1144 network logon services that MS Windows 9x/Me expect to find.
    1145 </para>
    1146 
    1147 <note><para>
    1148 <indexterm><primary>sniffer</primary></indexterm>
    1149 Use of plaintext passwords is strongly discouraged. Where used they are easily detected
    1150 using a sniffer tool to examine network traffic.
    1151 </para></note>
    1152 
    1153 </sect3>
    1154909</sect2>
    1155910
    … …  
    13381093that the account name is the machine NetBIOS name with a <quote>$</quote> appended to it (i.e.,
    13391094computer_name$). There must be an entry in both the POSIX UNIX system account backend as well as in the
    1340 SambaSAMAccount backend. The default backend for Samba-3 (i.e., the parameter <parameter>passdb
     1095SambaSAMAccount backend. The default backend for Samba (i.e., the parameter <parameter>passdb
    13411096backend</parameter> is not specified in the &smb.conf; file, or if specified is set to
    13421097<literal>smbpasswd</literal>, are respectively the <filename>/etc/passwd</filename> and
    … …  
    13851140effect that the domain controller cannot be found; the other claims that the account does not
    13861141exist in the domain or that the password is incorrect. This may be due to incompatible
    1387 settings between the Windows client and the Samba-3 server for <emphasis>schannel</emphasis>
     1142settings between the Windows client and the Samba server for <emphasis>schannel</emphasis>
    13881143(secure channel) settings or <emphasis>smb signing</emphasis> settings. Check your Samba
    13891144settings for <emphasis>client schannel</emphasis>, <emphasis>server schannel</emphasis>,
    … …  
    14011156
    14021157<para>
    1403 It is important that these be set consistently with the Samba-3 server settings.
     1158It is important that these be set consistently with the Samba server settings.
    14041159</para>
    14051160

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml

    r414 r988  
    2121
    2222<para>
    23 <indexterm><primary>account backends</primary></indexterm>
    24 <indexterm><primary>password backends</primary></indexterm>
    25 <indexterm><primary>scalability</primary></indexterm>
    26 <indexterm><primary>ADS</primary></indexterm>
    27 Early releases of Samba-3 implemented new capability to work concurrently with multiple account backends. This
    28 capability was removed beginning with release of Samba 3.0.23. Commencing with Samba 3.0.23 it is possible to
    29 work with only one specified passwd backend.
    30 </para>
    31 
    32 <para>
    3323<indexterm><primary>passdb backend</primary></indexterm>
    3424<indexterm><primary>smbpasswd</primary></indexterm>
    … …  
    6858<title>Features and Benefits</title>
    6959
    70 <para>
    71 Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality
    72 as follows:
    73 <indexterm><primary>SAM backend</primary><secondary>smbpasswd</secondary></indexterm>
    74 <indexterm><primary>SAM backend</primary><secondary>ldapsam_compat</secondary></indexterm>
    75 <indexterm><primary>encrypted passwords</primary></indexterm>
    76 </para>
    77 
    7860<sect2>
    7961        <title>Backward Compatibility Account Storage Systems</title>
    … …  
    121103                </listitem>
    122104        </varlistentry>
    123 
    124         <varlistentry><term>ldapsam_compat (Samba-2.2 LDAP Compatibility)</term>
    125                 <listitem>
    126                         <para>
    127 <indexterm><primary>ldapsam_compat</primary></indexterm>
    128 <indexterm><primary>Samba-2.2.x LDAP schema</primary></indexterm>
    129 <indexterm><primary>OpenLDAP backend</primary></indexterm>
    130                         There is a password backend option that allows continued operation with
    131                         an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension.
    132                         This option is provided primarily as a migration tool, although there is
    133                         no reason to force migration at this time. This tool will eventually
    134                         be deprecated.
    135                         </para>
    136                 </listitem>
    137         </varlistentry>
    138105</variablelist>
    139106
    … …  
    144111
    145112<para>
    146 Samba-3 introduces a number of new password backend capabilities.
     113Samba introduces a number of new password backend capabilities.
    147114<indexterm><primary>SAM backend</primary><secondary>tdbsam</secondary></indexterm>
    148115<indexterm><primary>SAM backend</primary><secondary>ldapsam</secondary></indexterm>
    … …  
    171138                        smbpasswd</emphasis> information plus the extended MS Windows NT/200x
    172139                        SAM information into a binary format TDB (trivial database) file.
    173                         The inclusion of the extended information makes it possible for Samba-3
     140                        The inclusion of the extended information makes it possible for Samba
    174141                        to implement the same account and system access controls that are possible
    175142                        with MS Windows NT4/200x-based systems.
    … …  
    203170<indexterm><primary>schema file</primary></indexterm>
    204171<indexterm><primary>examples/LDAP</primary></indexterm>
    205                         Samba-3 has a new and extended LDAP implementation that requires configuration
     172                        Samba has a new and extended LDAP implementation that requires configuration
    206173                        of OpenLDAP with a new format Samba schema. The new format schema file is
    207174                        included in the <filename class="directory">examples/LDAP</filename> directory of the Samba distribution.
    … …  
    348315                <note>
    349316                <para>
    350 <indexterm><primary>Windows XP Home</primary></indexterm>
     317<indexterm><primary>Windows Home edition</primary></indexterm>
    351318<indexterm><primary>domain member</primary></indexterm>
    352319<indexterm><primary>domain logons</primary></indexterm>
    353                 MS Windows XP Home does not have facilities to become a domain member, and it cannot participate in domain logons.
     320                MS Windows Home editions do not have facilities to become a domain member, and cannot participate in domain logons.
    354321                </para>
    355322                </note>
    … …  
    362329                        <listitem><para>Windows NT 3.5x.</para></listitem>
    363330                        <listitem><para>Windows NT 4.0.</para></listitem>
    364                         <listitem><para>Windows 2000 Professional.</para></listitem>
    365                         <listitem><para>Windows 200x Server/Advanced Server.</para></listitem>
    366                         <listitem><para>Windows XP Professional.</para></listitem>
     331                        <listitem><para>Windows editions labeled Professional.</para></listitem>
     332                        <listitem><para>Windows editions labeled Server/Advanced Server.</para></listitem>
    367333                </itemizedlist>
    368334
    … …  
    420386<indexterm><primary>SMB encryption</primary></indexterm>
    421387                                Windows NT does not like talking to a server that does not support encrypted passwords. It will refuse to
    422                                 browse the server if the server is also in user-level security mode. It will insist on prompting the user for
     388                                browse the server. It will insist on prompting the user for
    423389                                the password on each connection, which is very annoying. The only thing you can do to stop this is to use SMB
    424390                                encryption.
    … …  
    515481<indexterm><primary>NFS</primary></indexterm>
    516482<indexterm><primary>rsync</primary></indexterm>
    517         Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs
     483        Samba has a special facility that makes it possible to maintain identical UIDs and GIDs
    518484        on all servers in a distributed network. A distributed network is one where there exists
    519485        a PDC, one or more BDCs, and/or one or more domain member servers. Why is this important?
    … …  
    1009975                in compliance with government laws and regulations is clear to all. The <command>pdbedit</command> is
    1010976                currently the only Samba tool that provides the capacity to manage account and systems access controls
    1011                 and policies. During the remaining life-cycle of the Samba-3 series it is possible the new tools may
     977                and policies. During the remaining life-cycle of the Samba series it is possible the new tools may
    1012978                be implemented to aid in this important area.
    1013979                </para>
    … …  
    16011567                        <listitem><para>minimum password age = 7 days.</para></listitem>
    16021568                        <listitem><para>bad lockout attempt = 8 bad logon attempts.</para></listitem>
    1603                         <listitem><para>lockout duration = forever, account must be manually reenabled.</para></listitem>
     1569                        <listitem><para>lockout duration = forever, account must be manually re-enabled.</para></listitem>
    16041570                </orderedlist>
    16051571
    … …  
    16351601Account policies must be set individually on each PDC and BDC. At this time (Samba 3.0.11 to Samba 3.0.14a)
    16361602account policies are not replicated automatically. This may be fixed before Samba 3.0.20 ships or some
    1637 time there after. Please check the WHATSNEW.txt file in the Samba-3 tarball for specific update notiations
     1603time there after. Please check the WHATSNEW.txt file in the Samba tarball for specific update notiations
    16381604regarding this facility.
    16391605</para></warning>
    … …  
    16771643<sect1>
    16781644<title>Password Backends</title>
    1679 
    1680 <para>
    1681 <indexterm><primary>account database</primary></indexterm>
    1682 <indexterm><primary>SMB/CIFS server</primary></indexterm>
    1683 Samba offers flexibility in backend account database design. The flexibility is immediately obvious as one
    1684 begins to explore this capability. Recent changes to Samba (since 3.0.23) have removed the mulitple backend
    1685 feature in order to simplify problems that broke some installations. This removal has made the internal
    1686 operation of Samba-3 more consistent and predictable.
    1687 </para>
    1688 
    1689 <para>
    1690 <indexterm><primary>multiple backends</primary></indexterm>
    1691 <indexterm><primary>tdbsam databases</primary></indexterm>
    1692 Beginning with Samba 3.0.23 it is no longer possible to specify use of mulitple passdb backends. Earlier
    1693 versions of Samba-3 made it possible to specify multiple password backends, and even multiple
    1694 backends of the same type. The multiple passdb backend capability caused many problems with name to SID and
    1695 SID to name ID resolution.  The Samba team wrestled with the challenges and decided that this feature needed
    1696 to be removed.
    1697 </para>
    16981645
    16991646        <sect2>
    … …  
    21172064dc: quenya
    21182065o: Quenya Org Network
    2119 description: The Samba-3 Network LDAP Example
     2066description: The Samba Network LDAP Example
    21202067
    21212068# Organizational Role for Directory Management
    … …  
    21942141<indexterm><primary>secrets.tdb</primary></indexterm>
    21952142                Before Samba can access the LDAP server, you need to store the LDAP admin password
    2196                 in the Samba-3 <filename>secrets.tdb</filename> database by:
     2143                in the Samba <filename>secrets.tdb</filename> database by:
    21972144<indexterm><primary>smbpasswd</primary></indexterm>
    21982145<screen>
    … …  
    23242271<indexterm><primary>Domain Groups</primary></indexterm>
    23252272<indexterm><primary>ADS</primary></indexterm>
    2326                         In Samba-3, the group management system is based on POSIX
     2273                        In Samba, the group management system is based on POSIX
    23272274                        groups. This means that Samba makes use of the posixGroup ObjectClass.
    23282275                        For now, there is no NT-like group system management (global and local
    2329                         groups). Samba-3 knows only about <constant>Domain Groups</constant>
    2330                         and, unlike MS Windows 2000 and Active Directory, Samba-3 does not
     2276                        groups). Samba knows only about <constant>Domain Groups</constant>
     2277                        and, unlike MS Windows 2000 and Active Directory, Samba does not
    23312278                        support nested groups.
    23322279                        </para>
    … …  
    25912538
    25922539                <para>
    2593                 Samba-3 and later can update the non-Samba (LDAP) password stored with an account. When
     2540                Samba and later can update the non-Samba (LDAP) password stored with an account. When
    25942541                using pam_ldap, this allows changing both UNIX and Windows passwords at once.
    25952542                </para>
    … …  
    26592606
    26602607        </sect2>
    2661 
    2662         <sect2>
    2663         <title>Configuration of <parameter>auth methods</parameter></title>
    2664 
    2665         <para>
    2666         When explicitly setting an <smbconfoption name="auth methods"/> parameter,
    2667         <parameter>guest</parameter> must be specified as the first entry on the line &smbmdash;
    2668         for example, <smbconfoption name="auth methods">guest sam</smbconfoption>.
    2669         </para>
    2670 
    2671         </sect2>
    2672 
    26732608</sect1>
    26742609

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Printing.xml

    r740 r988  
    283283        show add printer wizard = Yes
    284284        os2 driver map =
    285         printer admin =
    286285        min print space = 0
    287286        max print jobs = 1000
    … …  
    405404        show add printer wizard = Yes
    406405        os2 driver map =
    407         printer admin =
    408406        min print space = 0
    409407        max print jobs = 1000
    … …  
    481479<smbconfoption name="show add printer wizard">yes</smbconfoption>
    482480<smbconfoption name="printcap name">/etc/printcap</smbconfoption>
    483 <smbconfoption name="printer admin">@ntadmin, root</smbconfoption>
    484481<smbconfoption name="max print jobs">100</smbconfoption>
    485482<smbconfoption name="lpq cache time">20</smbconfoption>
    … …  
    499496<smbconfoption name="comment">Printer with Restricted Access</smbconfoption>
    500497<smbconfoption name="path">/var/spool/samba_my_printer</smbconfoption>
    501 <smbconfoption name="printer admin">kurt</smbconfoption>
    502498<smbconfoption name="browseable">yes</smbconfoption>
    503499<smbconfoption name="printable">yes</smbconfoption>
    … …  
    569565                The <smbconfoption name="printing"/> parameter is normally a service-level parameter. Since it is included
    570566                here in the <smbconfsection name="[global]"/> section, it will take effect for all printer shares that are not
    571                 defined differently. Samba-3 no longer supports the SOFTQ printing system.
     567                defined differently. Samba no longer supports the SOFTQ printing system.
    572568                </para></caution>
    573569        </listitem></varlistentry>
    … …  
    625621        </para></listitem></varlistentry>
    626622
    627         <varlistentry><term><smbconfoption name="printer admin">@ntadmin </smbconfoption></term>
    628                 <listitem><para>
    629 <indexterm><primary>add drivers</primary></indexterm>
    630 <indexterm><primary>/etc/group</primary></indexterm>
    631 <indexterm><primary>printer share</primary></indexterm>
    632 <indexterm><primary>set printer properties</primary></indexterm>
    633                 Members of the ntadmin group should be able to add drivers and set printer properties
    634                 (<constant>ntadmin</constant> is only an example name; it needs to be a valid UNIX group name); root is
    635                 implicitly always a <smbconfoption name="printer admin"/>. The <literal>@</literal> sign precedes group names
    636                 in the <filename>/etc/group</filename>. A printer admin can do anything to printers via the remote
    637                 administration interfaces offered by MS-RPC (see <link linkend="cups-msrpc">Printing Developments Since
    638                 Samba-2.2</link>).  In larger installations, the <smbconfoption name="printer admin"/> parameter is normally a
    639                 per-share parameter. This permits different groups to administer each printer share.
    640         </para></listitem></varlistentry>
    641 
    642623        <varlistentry><term><smbconfoption name="lpq cache time">20 </smbconfoption></term>
    643624                <listitem><para>
    … …  
    787768                Sets the spooling area for this printer to a directory other than the default. It is not
    788769                necessary to set it differently, but the option is available.
    789                 </para></listitem>
    790         </varlistentry>
    791 
    792         <varlistentry><term><smbconfoption name="printer admin">kurt </smbconfoption></term>
    793                 <listitem><para>
    794                 The printer admin definition is different for this explicitly defined printer share from the general
    795                 <smbconfsection name="[printers]"/> share. It is not a requirement; we did it to show that it is possible.
    796770                </para></listitem>
    797771        </varlistentry>
    … …  
    11191093<indexterm><primary>ADS</primary></indexterm>
    11201094<indexterm><primary>LDAP</primary></indexterm>
    1121 A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP).
     1095A benefit of updating is that Samba is able to publish its printers to Active Directory (or LDAP).
    11221096</para>
    11231097
    … …  
    12241198<indexterm><primary>ACLs</primary></indexterm>
    12251199        These parameters, including the <parameter>printer driver file</parameter> parameter,
    1226         are now removed and cannot be used in installations of Samba-3. The share name
     1200        are now removed and cannot be used in installations of Samba. The share name
    12271201        <smbconfsection name="[print$]"/> is now used for the location of downloadable printer
    12281202        drivers. It is taken from the <smbconfsection name="[print$]"/> service created
    … …  
    12571231<smbconfblock>
    12581232<smbconfsection name="[global]"/>
    1259 <smbconfcomment>members of the ntadmin group should be able to add drivers and set</smbconfcomment>
    1260 <smbconfcomment>printer properties. root is implicitly always a 'printer admin'.</smbconfcomment>
    1261 <smbconfoption name="printer admin">@ntadmin</smbconfoption>
    12621233<smbconfcomment>...</smbconfcomment>
    12631234
    … …  
    13591330                update files on the share. Normally, you will want to name only administrative-level user
    13601331                account in this setting. Check the file system permissions to make sure these accounts
    1361                 can copy files to the share. If this is a non-root account, then the account should also
    1362                 be mentioned in the global <smbconfoption name="printer admin"/>
    1363                 parameter. See the &smb.conf; man page for more information on configuring file shares.
     1332                can copy files to the share.
    13641333                </para></listitem>
    13651334        </varlistentry>
    … …  
    14041373                The account used to connect to the Samba host must have a UID of 0 (i.e., a root account).
    14051374                </para></listitem>
    1406 
    1407                 <listitem><para>
    1408                 The account used to connect to the Samba host must be named in the <emphasis>printer admin</emphasis> list.
    1409                 </para></listitem>
    14101375        </itemizedlist>
    14111376
    … …  
    14961461Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we
    14971462assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure
    1498 your connection is, in fact, set up as a user with <smbconfoption name="printer admin"/>
    1499 privileges (if in doubt, use <command>smbstatus</command> to check for this). If you wish to install
     1463your connection is, in fact, set up as a user with printer administrator privileges
     1464(if in doubt, use <command>smbstatus</command> to check for this). If you wish to install
    15001465printer drivers for client operating systems other than <application>Windows NT x86</application>,
    15011466you will need to use the <guilabel>Sharing</guilabel> tab of the printer properties dialog.
    … …  
    15031468
    15041469<para>
    1505 Assuming you have connected with an administrative (or root) account (as named by the
    1506 <smbconfoption name="printer admin"/> parameter), you will also be able to modify
     1470Assuming you have connected with an administrative (or root) account, you will also be able to modify
    15071471other printer properties such as ACLs and default device settings using this dialog. For the default
    15081472device settings, please consider the advice given further in <link linkend="inst-rpc">Installing
    … …  
    21052069
    21062070<para>
    2107 Replace root, if needed, by another valid <smbconfoption name="printer admin"/> user as given in
     2071Replace root, if needed, by another valid printer administrator user as given in
    21082072the definition. Should you already be connected as a different user, you will get an error message. There
    21092073is no easy way to get rid of that connection, because Windows does not seem to know a concept of logging
    … …  
    22052169
    22062170<para>
    2207 Be aware that a valid device mode can only be initiated by a <smbconfoption name="printer admin"/> or root
     2171Be aware that a valid device mode can only be initiated by a printer administrator or root
    22082172(the reason should be obvious). Device modes can be correctly set only by executing the printer driver program
    22092173itself. Since Samba cannot execute this Win32 platform driver code, it sets this field initially to NULL
    … …  
    23162280
    23172281<sect2>
    2318 <title>Always Make First Client Connection as root or <quote>printer admin</quote></title>
     2282<title>Always Make First Client Connection as root or printer administrator</title>
    23192283
    23202284<para>
    23212285After you installed the driver on the Samba server (in its <smbconfsection name="[print$]"/> share), you
    23222286should always make sure that your first client installation completes correctly. Make it a habit for yourself
    2323 to build the very first connection from a client as <smbconfoption name="printer admin"/>. This is to make
     2287to build the very first connection from a client as a printer administrator"/>. This is to make
    23242288sure that:
    23252289</para>
    … …  
    23552319You will be prompted for <constant>root</constant>'s Samba password; type it, wait a few seconds, click on
    23562320<guibutton>Printing Defaults</guibutton>, and proceed to set the job options that should be used as defaults
    2357 by all clients. Alternatively, instead of root you can name one other member of the <smbconfoption
    2358 name="printer admin"/> from the setting.
     2321by all clients. Alternatively, instead of root you can give one other member printer adminadministrator
     2322privileges.
    23592323</para>
    23602324
    … …  
    24592423arrived at with steps C.1 through C.6 will permanently save any settings which will then become the defaults
    24602424for new users. If you want all clients to have the same defaults, you need to conduct these steps as
    2461 administrator (<smbconfoption name="printer admin"/>) before a client downloads the driver (the clients can
     2425administrator before a client downloads the driver (the clients can
    24622426later set their own per-user defaults by following procedures A or B above). Windows 200x/XP allow per-user
    24632427default settings and the ones the administrator gives them before they set up their own. The parents of the
    … …  
    26032567        <listitem><para>
    26042568        The connected user is able to successfully execute an <command>OpenPrinterEx(\\server)</command> with
    2605         administrative privileges (i.e., root or <smbconfoption name="printer admin"/>).
     2569        administrative privileges (i.e., root or a printer administrator).
    26062570        </para>
    26072571
    … …  
    31943158        <listitem><para>
    31953159        An existing <filename>printers.def</filename> file (the one specified in the now removed parameter
    3196         <parameter>printer driver file</parameter>) will no longer work with Samba-3. In 3.0, smbd attempts
     3160        <parameter>printer driver file</parameter>) will no longer work with Samba. In 3.0, smbd attempts
    31973161        to locate Windows 9x/Me driver files for the printer in <smbconfsection name="[print$]"/>
    31983162        and additional settings in the TDB and only there; if it fails, it will <emphasis>not</emphasis>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Problems.xml

    r414 r988  
    220220<itemizedlist>
    221221
    222 <listitem><para>See how Scott Merrill simulates a BDC behavior at
    223        <ulink noescape="1" url="http://www.skippy.net/linux/smb-howto.html">
    224        http://www.skippy.net/linux/smb-howto.html</ulink>. </para></listitem>
    225 
    226222<listitem><para>FTP site for older SMB specs,
    227223       <ulink noescape="1" url="ftp://ftp.microsoft.com/developr/drg/CIFS/">

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-ProfileMgmt.xml

    r414 r988  
    11751175
    11761176<para>
    1177 With Samba-3, you can have a global profile setting in &smb.conf;, and you can override this by
     1177With Samba, you can have a global profile setting in &smb.conf;, and you can override this by
    11781178per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </para>
    11791179

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-RightsAndPriviliges.xml

    r740 r988  
    111111<indexterm><primary>privileges</primary></indexterm>
    112112<indexterm><primary>manage privileges</primary></indexterm>
    113 Currently, the rights supported in Samba-3 are listed in <link linkend="rp-privs"/>.
     113Currently, the rights supported in Samba are listed in <link linkend="rp-privs"/>.
    114114The remainder of this chapter explains how to manage and use these privileges on Samba servers.
    115115</para>
    … …  
    334334<indexterm><primary>administrative rights</primary></indexterm>
    335335<indexterm><primary>printers admin</primary></indexterm>
    336                 This privilege operates identically to the <smbconfoption name="printer admin"/>
    337                 option in the &smb.conf; file (see section 5 man page for &smb.conf;)
    338                 except that it is a global right (not on a per-printer basis).
    339                 Eventually the smb.conf option will be deprecated and administrative
    340                 rights to printers will be controlled exclusively by this right and
    341                 the security descriptor associated with the printer object in the
    342                 <filename>ntprinters.tdb</filename> file.
     336                Administrative rights to printers are only controlled exclusively
     337                by this right and the security descriptor associated with the
     338                printer object in the registry.
    343339                </para></listitem>
    344340        </varlistentry>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-ServerType.xml

    r414 r988  
    6565        <listitem><para>
    6666        <indexterm><primary>domain</primary><secondary>controller</secondary></indexterm>
    67         Samba-3 can replace an MS Windows NT4 domain controller.
     67        Samba can replace an MS Windows NT4 domain controller.
    6868        </para></listitem>
    6969
    7070        <listitem><para>
    7171        <indexterm><primary>active directory</primary></indexterm>
    72         Samba-3 offers excellent interoperability with MS Windows NT4-style
     72        Samba offers excellent interoperability with MS Windows NT4-style
    7373        domains as well as natively with Microsoft Active Directory domains.
    7474        </para></listitem>
    … …  
    7676        <listitem><para>
    7777        <indexterm><primary>interdomain</primary><secondary>trustrs</secondary></indexterm>
    78         Samba-3 permits full NT4-style interdomain trusts.
     78        Samba permits full NT4-style interdomain trusts.
    7979        </para></listitem>
    8080
    … …  
    8989        <indexterm><primary>account</primary><secondary>database</secondary><tertiary>backends</tertiary></indexterm>
    9090        <indexterm><primary>encrypted</primary></indexterm>
    91         Samba-3 permits use of multiple concurrent account database backends.
     91        Samba permits use of multiple account database backends.
    9292        (Encrypted passwords that are stored in the account database are in
    9393        formats that are unique to Windows networking).
    … …  
    9797        <indexterm><primary>replicated</primary></indexterm>
    9898        The account database backends can be distributed
    99         and replicated using multiple methods. This gives Samba-3
     99        and replicated using multiple methods. This gives Samba
    100100        greater flexibility than MS Windows NT4 and in many cases a
    101101        significantly higher utility than Active Directory domains
    … …  
    178178<indexterm><primary>security modes</primary></indexterm>
    179179<indexterm><primary>user-level</primary></indexterm>
    180 <indexterm><primary>share-level</primary></indexterm>
    181 In the SMB/CIFS networking world, there are only two types of security: <emphasis>user-level</emphasis> and
    182 <emphasis>share level</emphasis>. We refer to these collectively as <emphasis>security levels</emphasis>.  In
    183 implementing these two security levels, Samba provides flexibilities that are not available with MS Windows
    184 NT4/200x servers. In fact, Samba implements <emphasis>share-level</emphasis> security only one way, but has
    185 four ways of implementing <emphasis>user-level</emphasis> security. Collectively, we call the Samba
     180Samba has three ways of implementing <emphasis>user-level</emphasis> security. Collectively, we call the Samba
    186181implementations of the security levels <emphasis>security modes</emphasis>. They are known as
    187 <emphasis>share</emphasis>, <emphasis>user</emphasis>, <emphasis>domain</emphasis>, <emphasis>ADS</emphasis>,
    188 and <emphasis>server</emphasis> modes.  They are documented in this chapter.
    189 </para>
    190 
    191 <para>
    192 An SMB server informs the client, at the time of a session setup, the security level the server is running.
    193 There are two options: share-level and user-level. Which of these two the client receives affects the way the
    194 client then tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba
    195 server does security. This may sound strange, but it fits in with the client/server approach of SMB.  In SMB
    196 everything is initiated and controlled by the client, and the server can only tell the client what is
    197 available and whether an action is allowed.
     182<emphasis>user</emphasis>, <emphasis>domain</emphasis> and
     183<emphasis>ADS</emphasis> modes.  They are documented in this chapter.
    198184</para>
    199185
    … …  
    268254
    269255</sect2>
    270 <sect2>
    271 <title>Share-Level Security</title>
    272 
    273 <para>
    274 <indexterm><primary>share-level</primary></indexterm>
    275 <indexterm><primary>mount</primary></indexterm>
    276 In share-level security, the client authenticates itself separately for each share. It sends a password along
    277 with each tree connection request (share mount), but it does not explicitly send a username with this
    278 operation. The client expects a password to be associated with each share, independent of the user. This means
    279 that Samba has to work out what username the client probably wants to use,
    280 because the username is not explicitly sent to the SMB server. Some commercial SMB servers such as NT actually associate passwords directly with shares
    281 in share-level security, but Samba always uses the UNIX authentication scheme where it is a username/password
    282 pair that is authenticated, not a share/password pair.
    283 </para>
    284 
    285 <para>
    286 To understand the MS Windows networking parallels, think in terms of MS Windows 9x/Me where you can create a
    287 shared folder that provides read-only or full access, with or without a password.
    288 </para>
    289 
    290 <para>
    291 Many clients send a session setup request even if the server is in share-level security. They normally send a valid
    292 username but no password. Samba records this username in a list of possible usernames. When the client then
    293 issues a tree connection request, it also adds to this list the name of the share they try to connect to (useful for
    294 home directories) and any users listed in the <smbconfoption name="user"/> parameter in the &smb.conf; file.
    295 The password is then checked in turn against these possible usernames. If a match is found, then the client is
    296 authenticated as that user.
    297 </para>
    298 
    299 <para>
    300 <indexterm><primary>name service switch</primary><see>NSS</see></indexterm>
    301 <indexterm><primary>/etc/passwd</primary></indexterm>
    302 <indexterm><primary>nsswitch.conf</primary></indexterm>
    303 Where the list of possible user names is not provided, Samba makes a UNIX system call to find the user
    304 account that has a password that matches the one provided from the standard account database. On a system that
    305 has no name service switch (NSS) facility, such lookups will be from the <filename>/etc/passwd</filename>
    306 database. On NSS enabled systems, the lookup will go to the libraries that have been specified in the
    307 <filename>nsswitch.conf</filename> file. The entries in that file in which the libraries are specified are:
    308 <screen>
    309 passwd: files nis ldap
    310 shadow: files nis ldap
    311 group: files nis ldap
    312 </screen>
    313 <indexterm><primary>/etc/passwd</primary></indexterm>
    314 <indexterm><primary>/etc/group</primary></indexterm>
    315 <indexterm><primary>NIS</primary></indexterm>
    316 In the example shown here (not likely to be used in practice) the lookup will check
    317 <filename>/etc/passwd</filename> and <filename>/etc/group</filename>, if not found it will check NIS, then
    318 LDAP.
    319 </para>
    320 
    321 <sect3>
    322 <title>Example Configuration</title>
    323 
    324 <para>
    325 The &smb.conf; parameter that sets share-level security is:
    326 </para>
    327 
    328 <para><smbconfblock>
    329 <smbconfoption name="security">share</smbconfoption>
    330 </smbconfblock></para>
    331 
    332 </sect3>
    333 </sect2>
    334 
    335256<sect2>
    336257<title>Domain Security Mode (User-Level Security)</title>
    … …  
    419340
    420341<procedure>
    421         <step><para>On the MS Windows NT domain controller, using
    422         the Server Manager, add a machine account for the Samba server.
    423         </para></step>
    424 
    425342        <step><para>On the UNIX/Linux system execute:</para>
    426343       
    … …  
    428345                </step>
    429346</procedure>
    430 
    431 <note><para>
    432 <indexterm><primary>smbpasswd</primary></indexterm>
    433 Samba-2.2.4 and later Samba 2.2.x series releases can autojoin a Windows NT4-style domain just by executing:
    434 <screen>
    435 &rootprompt;<userinput>smbpasswd -j <replaceable>DOMAIN_NAME</replaceable> -r <replaceable>PDC_NAME</replaceable> \
    436          -U Administrator%<replaceable>password</replaceable></userinput>
    437 </screen>
    438 <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
    439 Samba-3 can do the same by executing:
    440 <screen>
    441 &rootprompt;<userinput>net rpc join -U Administrator%<replaceable>password</replaceable></userinput>
    442 </screen>
    443 It is not necessary with Samba-3 to specify the <replaceable>DOMAIN_NAME</replaceable> or the
    444 <replaceable>PDC_NAME</replaceable>, as it figures this out from the &smb.conf; file settings.
    445 </para></note>
    446347
    447348<para>
    … …  
    482383<indexterm><primary>ADS</primary></indexterm>
    483384<indexterm><primary>native mode</primary></indexterm>
    484 Both Samba-2.2, and Samba-3 can join an Active Directory domain using NT4 style RPC based security.  This is
     385Samba can join an Active Directory domain using NT4 style RPC based security.  This is
    485386possible if the domain is run in native mode. Active Directory in native mode perfectly allows NT4-style
    486387domain members. This is contrary to popular belief.
    … …  
    488389
    489390<para>
    490 If you are using Active Directory, starting with Samba-3 you can join as a native AD member. Why would you
     391If you are using Active Directory, starting with Samba you can join as a native AD member. Why would you
    491392want to do that?  Your security policy might prohibit the use of NT-compatible authentication protocols. All
    492393your machines are running Windows 2000 and above and all use Kerberos. In this case, Samba, as an NT4-style
    … …  
    523424Please refer to <link linkend="domain-member">Domain Membership</link>, and <link linkend="ads-member">Samba
    524425ADS Domain Membership</link> for more information regarding this configuration option.
    525 </para>
    526 
    527 </sect3>
    528 </sect2>
    529 
    530 <sect2>
    531 <title>Server Security (User Level Security)</title>
    532 
    533 <para>
    534 Server security mode is left over from the time when Samba was not capable of acting
    535 as a domain member server. It is highly recommended not to use this feature. Server
    536 security mode has many drawbacks that include:
    537 </para>
    538 
    539 <itemizedlist>
    540         <listitem><para>Potential account lockout on MS Windows NT4/200x password servers.</para></listitem>
    541         <listitem><para>Lack of assurance that the password server is the one specified.</para></listitem>
    542         <listitem><para>Does not work with Winbind, which is particularly needed when storing profiles remotely.</para></listitem>
    543         <listitem><para>This mode may open connections to the password server and keep them open for extended periods.</para></listitem>
    544         <listitem><para>Security on the Samba server breaks badly when the remote password server suddenly shuts down.</para></listitem>
    545         <listitem><para>With this mode there is NO security account in the domain that the password server belongs to for the Samba server.</para></listitem>
    546 </itemizedlist>
    547 
    548 <para>
    549 <indexterm><primary>session setup</primary></indexterm>
    550 <indexterm><primary>SMB</primary></indexterm>
    551 In server security mode the Samba server reports to the client that it is in user-level security. The client
    552 then does a session setup as described earlier.  The Samba server takes the username/password that the client
    553 sends and attempts to log into the <smbconfoption name="password server"/> by sending exactly the same
    554 username/password that it got from the client. If that server is in user-level security and accepts the
    555 password, then Samba accepts the client's connection. This parameter allows the Samba server to use another
    556 SMB server as the <smbconfoption name="password server"/>.
    557 </para>
    558 
    559 <para>
    560 <indexterm><primary>security level</primary></indexterm>
    561 <indexterm><primary>encryption</primary></indexterm>
    562 You should also note that at the start of all this, when the server tells the client
    563 what security level it is in, it also tells the client if it supports encryption. If it
    564 does, it supplies the client with a random cryptkey. The client will then send all
    565 passwords in encrypted form. Samba supports this type of encryption by default.
    566 </para>
    567 
    568 <para>
    569 The parameter <smbconfoption name="security">server</smbconfoption> means that Samba reports to clients that
    570 it is running in <emphasis>user mode</emphasis> but actually passes off all authentication requests to another
    571 user mode server. This requires an additional parameter <smbconfoption name="password server"/> that points to
    572 the real authentication server.  The real authentication server can be another Samba server, or it can be a
    573 Windows NT server, the latter being natively capable of encrypted password support.
    574 </para>
    575 
    576 <note><para>
    577 <indexterm><primary>password server</primary></indexterm>
    578 <indexterm><primary>workgroup</primary></indexterm>
    579 When Samba is running in <emphasis>server security mode</emphasis>, it is essential that the parameter
    580 <emphasis>password server</emphasis> is set to the precise NetBIOS machine name of the target authentication
    581 server. Samba cannot determine this from NetBIOS name lookups because the choice of the target authentication
    582 server is arbitrary and cannot be determined from a domain name. In essence, a Samba server that is in
    583 <emphasis>server security mode</emphasis> is operating in what used to be known as workgroup mode.
    584 </para></note>
    585 
    586 <sect3>
    587 <title>Example Configuration</title>
    588 <para><emphasis>
    589 Using MS Windows NT as an Authentication Server
    590 </emphasis></para>
    591 
    592 <para>
    593 This method involves the additions of the following parameters in the &smb.conf; file:
    594 </para>
    595 
    596 <para><smbconfblock>
    597 <smbconfoption name="encrypt passwords">Yes</smbconfoption>
    598 <smbconfoption name="security">server</smbconfoption>
    599 <smbconfoption name="password server">"NetBIOS_name_of_a_DC"</smbconfoption>
    600 </smbconfblock></para>
    601 
    602 
    603 <para>
    604 There are two ways of identifying whether or not a username and password pair is valid.
    605 One uses the reply information provided as part of the authentication messaging
    606 process, the other uses just an error code.
    607 </para>
    608 
    609 <para>
    610 <indexterm><primary>bogus</primary></indexterm>
    611 <indexterm><primary>lockout</primary></indexterm>
    612 The downside of this mode of configuration is that for security reasons Samba
    613 will send the password server a bogus username and a bogus password, and if the remote
    614 server fails to reject the bogus username and password pair, then an alternative mode of
    615 identification or validation is used. Where a site uses password lockout, after a
    616 certain number of failed authentication attempts, this will result in user lockouts.
    617 </para>
    618 
    619 <para>
    620 Use of this mode of authentication requires a standard UNIX account for the user.
    621 This account can be blocked to prevent logons by non-SMB/CIFS clients.
    622426</para>
    623427
    … …  
    691495<?latex \newpage ?>
    692496<smbconfblock>
    693 <smbconfoption name="password level"><replaceable>integer</replaceable></smbconfoption>
    694497<smbconfoption name="username level"><replaceable>integer</replaceable></smbconfoption>
    695498</smbconfblock>
    … …  
    706509However, passwords on UNIX systems often make use of mixed-case characters.  This means that in order for a
    707510user on a Windows 9x/Me client to connect to a Samba server using clear-text authentication, the
    708 <smbconfoption name="password level"/> must be set to the maximum number of uppercase letters that
    709 <emphasis>could</emphasis> appear in a password. Note that if the Server OS uses the traditional DES version
    710 of crypt(), a <smbconfoption name="password level"/> of 8 will result in case-insensitive passwords as seen
    711 from Windows users. This will also result in longer login times because Samba has to compute the permutations
    712 of the password string and try them one by one until a match is located (or all combinations fail).
     511password must be in lower case.
    713512</para>
    714513
    … …  
    739538
    740539<sect2>
    741 <title>What Makes Samba a Server?</title>
    742 
    743 <para>
    744 To some, the nature of the Samba security mode is obvious, but entirely
    745 wrong all the same. It is assumed that <smbconfoption name="security">server</smbconfoption> means that Samba
    746 will act as a server. Not so! This setting means that Samba will <emphasis>try</emphasis>
    747 to use another SMB server as its source for user authentication alone.
    748 </para>
    749 
    750 <para>
    751 Samba is a server regardless of which security mode is chosen. When Samba is used outside of a domain security
    752 context, it is best to leave the security mode at the default setting. By default Samba-3 uses user-mode
    753 security.
    754 </para>
    755 
    756 </sect2>
    757 
    758 <sect2>
    759540<title>What Makes Samba a Domain Controller?</title>
    760541
    … …  
    779560</sect2>
    780561
    781 
    782 <sect2>
    783 <title>Constantly Losing Connections to Password Server</title>
    784 
    785 <para><quote>
    786 Why does server_validate() simply give up rather than re-establish its connection to the
    787 password server?  Though I am not fluent in the SMB protocol, perhaps the cluster server
    788 process passes along to its client workstation the session key it receives from the password
    789 server, which means the password hashes submitted by the client would not work on a subsequent
    790 connection whose session key would be different. So server_validate() must give up.
    791 </quote></para>
    792 
    793 <para>
    794 Indeed. That's why <smbconfoption name="security">server</smbconfoption>
    795 is at best a nasty hack. Please use <smbconfoption name="security">domain</smbconfoption>;
    796 <smbconfoption name="security">server</smbconfoption> mode is also known as pass-through authentication.
    797 </para>
    798 
    799 </sect2>
    800 
    801 <sect2>
    802 <title>Stand-alone Server is converted to Domain Controller &smbmdash; Now User accounts don't work</title>
    803 
    804 <para><quote>
    805 When I try to log in to the DOMAIN, the eventlog shows <emphasis>tried credentials DOMAIN/username; effective
    806 credentials SERVER/username</emphasis>
    807 </quote></para>
    808 
    809 <para>
    810 Usually this is due to a user or machine account being created before the Samba server is configured to be a
    811 domain controller. Accounts created before the server becomes a domain controller will be
    812 <emphasis>local</emphasis> accounts and authenticated as what looks like a member in the SERVER domain, much
    813 like local user accounts in Windows 2000 and later.  Accounts created after the Samba server becomes a domain
    814 controller will be <emphasis>domain</emphasis> accounts and will be authenticated as a member of the DOMAIN
    815 domain.
    816 </para>
    817 
    818 <para>
    819 This can be verified by issuing the command <command>pdbedit -L -v username</command>.  If this reports DOMAIN
    820 then the account is a domain account, if it reports SERVER then the account is a local account.
    821 </para>
    822 
    823 <para>
    824 The easiest way to resolve this is to remove and recreate the account; however this may cause problems with
    825 established user profiles. You can also use <command>pdbedit -u username -I DOMAIN</command>. You may also
    826 need to change the User SID and Primary Group SID to match the domain.
    827 </para>
    828 
    829 </sect2>
    830 
    831562</sect1>
    832563

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-StandAloneServer.xml

    r414 r988  
    288288<smbconfoption name="comment">All Printers</smbconfoption>
    289289<smbconfoption name="path">/var/spool/samba</smbconfoption>
    290 <smbconfoption name="printer admin">root</smbconfoption>
    291290<smbconfoption name="guest ok">Yes</smbconfoption>
    292291<smbconfoption name="printable">Yes</smbconfoption>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Support.xml

    r414 r988  
    7777        url="https://lists.samba.org/mailman/">web</ulink> site. The public mailing list that can be used to obtain
    7878        free, user contributed, support is called the <literal>samba</literal> list. The email address for this list
    79         is at <literal>mail:samba@samba.org</literal>.  Information regarding the Samba IRC channels may be found on
     79        is at <literal>mail:samba@lists.samba.org</literal>.  Information regarding the Samba IRC channels may be found on
    8080        the Samba <ulink url="http://www.samba.org/samba.irc.html">IRC</ulink> web page.
    8181        </para>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-TheNetCommand.xml

    r414 r988  
    1717<indexterm><primary>command-line</primary></indexterm>
    1818<indexterm><primary>scripted control</primary></indexterm>
    19 The <command>net</command> command is one of the new features of Samba-3 and is an attempt to provide a useful
     19The <command>net</command> command is one of the new features of Samba and is an attempt to provide a useful
    2020tool for the majority of remote management operations necessary for common tasks. The <command>net</command>
    2121tool is flexible by design and is intended for command-line use as well as for scripted control application.
    … …  
    3838
    3939<para>
    40 A Samba-3 administrator cannot afford to gloss over this chapter because to do so will almost certainly cause
     40A Samba administrator cannot afford to gloss over this chapter because to do so will almost certainly cause
    4141the infliction of self-induced pain, agony, and desperation. Be warned: this is an important chapter.
    4242</para>
    … …  
    5252<indexterm><primary>DMS</primary></indexterm>
    5353<indexterm><primary>authentication</primary></indexterm>
    54         The tasks that follow the installation of a Samba-3 server, whether standalone or domain member, of a
     54        The tasks that follow the installation of a Samba server, whether standalone or domain member, of a
    5555        domain controller (PDC or BDC) begins with the need to create administrative rights. Of course, the
    5656        creation of user and group accounts is essential for both a standalone server and a PDC.
    … …  
    8484<indexterm><primary>trust accounts</primary></indexterm>
    8585<indexterm><primary>net</primary></indexterm>
    86         UNIX systems that are hosting a Samba-3 server that is running as a member (PDC, BDC, or DMS) must have
     86        UNIX systems that are hosting a Samba server that is running as a member (PDC, BDC, or DMS) must have
    8787        a machine security account in the domain authentication database (or directory). The creation of such
    8888        security (or trust) accounts is also handled using the <command>net</command> command.
    … …  
    108108<indexterm><primary>man pages</primary></indexterm>
    109109        The overall picture should be clear now: the <command>net</command> command plays a central role
    110         on the Samba-3 stage. This role will continue to be developed. The inclusion of this chapter is
     110        on the Samba stage. This role will continue to be developed. The inclusion of this chapter is
    111111        evidence of its importance, one that has grown in complexity to the point that it is no longer considered
    112112        prudent to cover its use fully in the online UNIX man pages.
    … …  
    166166<indexterm><primary>local</primary><secondary>groups</secondary></indexterm>
    167167<indexterm><primary>domain user accounts</primary></indexterm>
    168         Samba-3 recognizes two types of groups: <emphasis>domain groups</emphasis> and <emphasis>local
     168        Samba recognizes two types of groups: <emphasis>domain groups</emphasis> and <emphasis>local
    169169        groups</emphasis>. Domain groups can contain (have as members) only domain user accounts. Local groups
    170170        can contain local users, domain users, and domain groups as members.
    … …  
    10701070
    10711071        <para>
    1072         A Samba-3 server that is a Windows ADS domain member can execute the following command to detach from the
     1072        A Samba server that is a Windows ADS domain member can execute the following command to detach from the
    10731073        domain:
    10741074<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>leave</tertiary></indexterm>
    … …  
    17611761
    17621762        <para>
    1763         When Samba-3 is used within an MS Windows ADS environment, printers shared via Samba will not be browseable
     1763        When Samba is used within an MS Windows ADS environment, printers shared via Samba will not be browseable
    17641764        until they have been published to the ADS domain. Information regarding published printers may be obtained
    17651765        from the ADS server by executing the <command>net ads print info</command> command following this syntax:

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Unicode.xml

    r746 r988  
    3939<indexterm><primary>codepages</primary></indexterm>
    4040Samba-2.x supported a single locale through a mechanism called
    41 <emphasis>codepages</emphasis>. Samba-3 is destined to become a truly transglobal
     41<emphasis>codepages</emphasis>. Samba is destined to become a truly transglobal
    4242file- and printer-sharing platform.
    4343</para>
    … …  
    422422
    423423                        <para>
    424                         To use CAP encoding on Samba-3, you should use the unix charset parameter and VFS
     424                        To use CAP encoding on Samba, you should use the unix charset parameter and VFS
    425425                        as in <link linkend="vfscap-intl">the VFS CAP smb.conf file</link>.
    426426                        </para>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-VFS.xml

    r746 r988  
    3535<indexterm><primary>GNU/Linux</primary></indexterm>
    3636If not supplied with your platform distribution binary Samba package, you may have problems compiling these
    37 modules, as shared libraries are compiled and linked in different ways on different systems. They currently
    38 have been tested against GNU/Linux and IRIX.
     37modules, as shared libraries are compiled and linked in different ways on different systems.
    3938</para>
    4039
    … …  
    128127
    129128        <para>
    130         This module allows the default quota values, in the windows explorer GUI, to be stored on a Samba-3 server.
     129        This module allows the default quota values, in the windows explorer GUI, to be stored on a Samba server.
    131130        The challenge is that linux filesystems only store quotas for users and groups, but no default quotas.
    132131        </para>
    … …  
    558557        At the time of this writing, not much testing has been done.  I tested the shadow copy VFS module with a
    559558        specific scenario which was not deployed in a production environment, but more as a proof of concept.  The
    560         scenario involved a Samba-3 file server on Debian Sarge with an XFS file system and LVM1.  I do NOT recommend
     559        scenario involved a Samba file server on Debian Sarge with an XFS file system and LVM1.  I do NOT recommend
    561560        you use this as a solution without doing your own due diligence with regard to all the components presented
    562561        here.  That said, following is an basic outline of how I got things going.

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Winbind.xml

    r740 r988  
    590590<indexterm><primary>winbindd</primary></indexterm>
    591591<indexterm><primary>daemon</primary></indexterm>
    592 The latest version of Samba-3 includes a functioning winbindd daemon. Please refer to the <ulink
     592The latest version of Samba includes a functioning winbindd daemon. Please refer to the <ulink
    593593url="http://samba.org/">main Samba Web page</ulink>, or better yet, your closest Samba mirror site for
    594594instructions on downloading the source code.
    … …  
    634634<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
    635635PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install
    636 the <filename>pam-devel</filename> libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3
     636the <filename>pam-devel</filename> libraries that are needed to build PAM-enabled Samba. Additionally, Samba
    637637may auto-install the Winbind files into their correct locations on your system, so before you get too far down
    638638the track, be sure to check if the following configuration is really

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-WindowsClientConfig.xml

    r414 r988  
    433433<indexterm><primary>configuration wizard</primary></indexterm>
    434434                Clicking the <guimenu>Network ID</guimenu> button will launch the configuration wizard. Do not use this with
    435                 Samba-3. If you wish to change the computer name or join or leave the domain, click the <guimenu>Change</guimenu> button.
     435                Samba. If you wish to change the computer name or join or leave the domain, click the <guimenu>Change</guimenu> button.
    436436                See <link linkend="wxpp004"></link>.
    437437                <figure id="wxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure>
    … …  
    464464        <para>
    465465<indexterm><primary>root</primary></indexterm>
    466                 Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="wxpp008"></link>.
     466                Enter the name <quote>root</quote> and the root password from your Samba server. See <link linkend="wxpp008"></link>.
    467467                <figure id="wxpp008">
    468468                        <title>Computer Name Changes &smbmdash; Username and Password Panel.</title><imagefile>wxpp008</imagefile>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-msdfs.xml

    r414 r988  
    99                        <orgname>Samba Team &amp; Veritas Software</orgname>
    1010                        <address>
    11                                 <email>samba@samba.org</email>
     11                                <email>samba@lists.samba.org</email>
    1212                        </address>
    1313                </affiliation>

  • vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-preface.xml

    r414 r988  
    2727This book provides example configurations, it documents key aspects of Microsoft
    2828Windows networking, provides in-depth insight into the important configuration of
    29 Samba-3, and helps to put all of these into a useful framework.
     29Samba, and helps to put all of these into a useful framework.
    3030</para>
    3131

  • vendor/current/docs-xml/Samba3-HOWTO/index.xml

    r414 r988  
    162162        <xi:include href="TOSHARG-Backup.xml"/>
    163163        <?latex \cleardoublepage ?>
    164         <xi:include href="TOSHARG-HighAvailability.xml"/>
    165         <?latex \cleardoublepage ?>
    166164        <xi:include href="TOSHARG-LargeFile.xml"/>
    167165        <?latex \cleardoublepage ?>
    … …  
    175173
    176174        <?latex \cleardoublepage ?>
    177         <xi:include href="TOSHARG-upgrading-to-3.0.xml"/>
    178         <?latex \cleardoublepage ?>
    179175        <xi:include href="TOSHARG-NT4Migration.xml"/>
    180         <?latex \cleardoublepage ?>
    181         <xi:include href="TOSHARG-SWAT.xml"/>
    182176        <?latex \cleardoublepage ?>
    183177
    … …  
    204198        <?latex \cleardoublepage ?>
    205199        <xi:include href="TOSHARG-Compiling.xml"/>
    206         <?latex \cleardoublepage ?>
    207         <xi:include href="TOSHARG-Portability.xml"/>
    208         <?latex \cleardoublepage ?>
    209         <xi:include href="TOSHARG-Other-Clients.xml"/>
    210         <?latex \cleardoublepage ?>
    211         <xi:include href="TOSHARG-Speed.xml"/>
    212200        <?latex \cleardoublepage ?>
    213201        <xi:include href="TOSHARG-SecureLDAP.xml"/>

  • vendor/current/docs-xml/Samba3-HOWTO/manpages.xml

    r740 r988  
    88                <ulink url="http://www.samba.org/samba/team.html">the Samba Team</ulink>.</para>
    99
    10         <xi:include href="../manpages-3/eventlogadm.8.xml"/>
    11         <xi:include href="../manpages-3/findsmb.1.xml"/>
    12         <xi:include href="../manpages-3/idmap_ad.8.xml"/>
    13         <xi:include href="../manpages-3/idmap_ldap.8.xml"/>
    14         <xi:include href="../manpages-3/idmap_nss.8.xml"/>
    15         <xi:include href="../manpages-3/idmap_rid.8.xml"/>
    16         <xi:include href="../manpages-3/idmap_tdb.8.xml"/>
    17         <xi:include href="../manpages-3/libsmbclient.7.xml"/>
    18         <xi:include href="../manpages-3/lmhosts.5.xml"/>
    19         <xi:include href="../manpages-3/log2pcap.1.xml"/>
    20         <xi:include href="../manpages-3/net.8.xml"/>
    21         <xi:include href="../manpages-3/nmbd.8.xml"/>
    22         <xi:include href="../manpages-3/nmblookup.1.xml"/>
    23         <xi:include href="../manpages-3/ntlm_auth.1.xml"/>
    24         <xi:include href="../manpages-3/pam_winbind.8.xml"/>
    25         <xi:include href="../manpages-3/pdbedit.8.xml"/>
    26         <xi:include href="../manpages-3/profiles.1.xml"/>
    27         <xi:include href="../manpages-3/rpcclient.1.xml"/>
    28         <xi:include href="../manpages-3/smbcacls.1.xml"/>
    29         <xi:include href="../manpages-3/smbclient.1.xml"/>
    30         <xi:include href="../manpages-3/smb.conf.5.xml"/>
    31         <xi:include href="../manpages-3/smbcontrol.1.xml"/>
    32         <xi:include href="../manpages-3/smbcquotas.1.xml"/>
    33         <xi:include href="../manpages-3/smbd.8.xml"/>
    34         <xi:include href="../manpages-3/smbget.1.xml"/>
    35         <xi:include href="../manpages-3/smbgetrc.5.xml"/>
    36         <xi:include href="../manpages-3/smbpasswd.5.xml"/>
    37         <xi:include href="../manpages-3/smbpasswd.8.xml"/>
    38         <xi:include href="../manpages-3/smbsh.1.xml"/>
    39         <xi:include href="../manpages-3/smbstatus.1.xml"/>
    40         <xi:include href="../manpages-3/smbtar.1.xml"/>
    41         <xi:include href="../manpages-3/smbtree.1.xml"/>
    42         <xi:include href="../manpages-3/smbumount.8.xml"/>
    43         <xi:include href="../manpages-3/swat.8.xml"/>
    44         <xi:include href="../manpages-3/tdbbackup.8.xml"/>
    45         <xi:include href="../manpages-3/tdbdump.8.xml"/>
    46         <xi:include href="../manpages-3/tdbtool.8.xml"/>
    47         <xi:include href="../manpages-3/testparm.1.xml"/>
    48         <xi:include href="../manpages-3/wbinfo.1.xml"/>
    49         <xi:include href="../manpages-3/winbindd.8.xml"/>
    50         <xi:include href="../manpages-3/vfs_audit.8.xml"/>
    51         <xi:include href="../manpages-3/vfs_cacheprime.8.xml"/>
    52         <xi:include href="../manpages-3/vfs_cap.8.xml"/>
    53         <xi:include href="../manpages-3/vfs_catia.8.xml"/>
    54         <xi:include href="../manpages-3/vfs_commit.8.xml"/>
    55         <xi:include href="../manpages-3/vfs_default_quota.8.xml"/>
    56         <xi:include href="../manpages-3/vfs_extd_audit.8.xml"/>
    57         <xi:include href="../manpages-3/vfs_fake_perms.8.xml"/>
    58         <xi:include href="../manpages-3/vfs_full_audit.8.xml"/>
    59         <xi:include href="../manpages-3/vfs_gpfs.8.xml"/>
    60         <xi:include href="../manpages-3/vfs_netatalk.8.xml"/>
    61         <xi:include href="../manpages-3/vfs_notify_fam.8.xml"/>
    62         <xi:include href="../manpages-3/vfs_prealloc.8.xml"/>
    63         <xi:include href="../manpages-3/vfs_readahead.8.xml"/>
    64         <xi:include href="../manpages-3/vfs_readonly.8.xml"/>
    65         <xi:include href="../manpages-3/vfs_recycle.8.xml"/>
    66         <xi:include href="../manpages-3/vfs_shadow_copy.8.xml"/>
    67         <xi:include href="../manpages-3/vfstest.1.xml"/>
    68         <xi:include href="../manpages-3/wbinfo.1.xml"/>
    69         <xi:include href="../manpages-3/winbindd.8.xml"/>
     10        <xi:include href="../manpages/eventlogadm.8.xml"/>
     11        <xi:include href="../manpages/findsmb.1.xml"/>
     12        <xi:include href="../manpages/idmap_ad.8.xml"/>
     13        <xi:include href="../manpages/idmap_ldap.8.xml"/>
     14        <xi:include href="../manpages/idmap_nss.8.xml"/>
     15        <xi:include href="../manpages/idmap_rid.8.xml"/>
     16        <xi:include href="../manpages/idmap_tdb.8.xml"/>
     17        <xi:include href="../manpages/libsmbclient.7.xml"/>
     18        <xi:include href="../manpages/lmhosts.5.xml"/>
     19        <xi:include href="../manpages/log2pcap.1.xml"/>
     20        <xi:include href="../manpages/net.8.xml"/>
     21        <xi:include href="../manpages/nmbd.8.xml"/>
     22        <xi:include href="../manpages/nmblookup.1.xml"/>
     23        <xi:include href="../manpages/ntlm_auth.1.xml"/>
     24        <xi:include href="../manpages/pam_winbind.8.xml"/>
     25        <xi:include href="../manpages/pdbedit.8.xml"/>
     26        <xi:include href="../manpages/profiles.1.xml"/>
     27        <xi:include href="../manpages/rpcclient.1.xml"/>
     28        <xi:include href="../manpages/smbcacls.1.xml"/>
     29        <xi:include href="../manpages/smbclient.1.xml"/>
     30        <xi:include href="../manpages/smb.conf.5.xml"/>
     31        <xi:include href="../manpages/smbcontrol.1.xml"/>
     32        <xi:include href="../manpages/smbcquotas.1.xml"/>
     33        <xi:include href="../manpages/smbd.8.xml"/>
     34        <xi:include href="../manpages/smbget.1.xml"/>
     35        <xi:include href="../manpages/smbgetrc.5.xml"/>
     36        <xi:include href="../manpages/smbpasswd.5.xml"/>
     37        <xi:include href="../manpages/smbpasswd.8.xml"/>
     38        <xi:include href="../manpages/smbsh.1.xml"/>
     39        <xi:include href="../manpages/smbstatus.1.xml"/>
     40        <xi:include href="../manpages/smbtar.1.xml"/>
     41        <xi:include href="../manpages/smbtree.1.xml"/>
     42        <xi:include href="../manpages/smbumount.8.xml"/>
     43        <xi:include href="../manpages/swat.8.xml"/>
     44        <xi:include href="../manpages/tdbbackup.8.xml"/>
     45        <xi:include href="../manpages/tdbdump.8.xml"/>
     46        <xi:include href="../manpages/tdbtool.8.xml"/>
     47        <xi:include href="../manpages/testparm.1.xml"/>
     48        <xi:include href="../manpages/wbinfo.1.xml"/>
     49        <xi:include href="../manpages/winbindd.8.xml"/>
     50        <xi:include href="../manpages/vfs_audit.8.xml"/>
     51        <xi:include href="../manpages/vfs_cacheprime.8.xml"/>
     52        <xi:include href="../manpages/vfs_cap.8.xml"/>
     53        <xi:include href="../manpages/vfs_catia.8.xml"/>
     54        <xi:include href="../manpages/vfs_commit.8.xml"/>
     55        <xi:include href="../manpages/vfs_default_quota.8.xml"/>
     56        <xi:include href="../manpages/vfs_extd_audit.8.xml"/>
     57        <xi:include href="../manpages/vfs_fake_perms.8.xml"/>
     58        <xi:include href="../manpages/vfs_full_audit.8.xml"/>
     59        <xi:include href="../manpages/vfs_gpfs.8.xml"/>
     60        <xi:include href="../manpages/vfs_netatalk.8.xml"/>
     61        <xi:include href="../manpages/vfs_prealloc.8.xml"/>
     62        <xi:include href="../manpages/vfs_readahead.8.xml"/>
     63        <xi:include href="../manpages/vfs_readonly.8.xml"/>
     64        <xi:include href="../manpages/vfs_recycle.8.xml"/>
     65        <xi:include href="../manpages/vfs_shadow_copy.8.xml"/>
     66        <xi:include href="../manpages/vfstest.1.xml"/>
     67        <xi:include href="../manpages/wbinfo.1.xml"/>
     68        <xi:include href="../manpages/winbindd.8.xml"/>
    7069
    7170</reference>
Note: See TracChangeset for help on using the changeset viewer.