← Back to branch summary

~ubuntu-branches/ubuntu/gutsy/samba/gutsy-updates

« back to all changes in this revision

Viewing changes to docs/htmldocs/Samba3-ByExample/DomApps.html

  • Committer: Bazaar Package Importer
  • Author(s): Andrew Mitchell
  • Date: 2006-11-28 20:14:37 UTC
  • mfrom: (0.10.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20061128201437-a6x4lzlhempazocp
Tags: 3.0.23d-1ubuntu1
* Merge from debian unstable.
* Drop python2.4-samba, replace with python-samba. Added Conflicts/Replaces
  on python2.4-samba
* Drop track-connection-dos.patch, ubuntu-winbind-panic.patch, 
  ubuntu-fix-ldap.patch, ubuntu-setlocale.patch, ubuntu-setlocale-fixes.patch
* Remaining Ubuntu changes:
  - Revert Debian's installation of mount.cifs and umount.cifs as suid
  - Comment out the default [homes] shares and add more verbose comments to
    explain what they do and how they work (closes: launchpad.net/27608)
  - Add a "valid users = %S" stanza to the commented-out [homes] section, to
    show users how to restrict access to \\server\username to only username.
  - Change the (commented-out) "printer admin" example to use "@lpadmin"
    instead of "@ntadmin", since the lpadmin group is used for spool admin.
  - Alter the panic-action script to encourage users to report their
    bugs in Ubuntu packages to Ubuntu, rather than reporting to Debian.
    Modify text to more closely match the Debian script
  - Munge our init script to deal with the fact that our implementation
    (or lack thereof) of log_daemon_msg and log_progress_msg differs
    from Debian's implementation of the same (Ubuntu #19691)
  - Kept ubuntu-auxsrc.patch: some auxilliary sources (undocumented in 
    previous changelogs)
  - Set default workgroup to MSHOME

Show diffs side-by-side

added added

removed removed

Lines of Context:
docs/htmldocs/Samba3-ByExample/DomApps.html
1
 
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�12.�Integrating Additional Services</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.68.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part�III.�Reference Section"><link rel="prev" href="kerberos.html" title="Chapter�11.�Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter�13.�Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�12.�Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Reference Section</th><td width="20%" align="right">�<a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter�12.�Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2584664">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2584695">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2584795">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2584828">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2584993">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2585011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2586876">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2586936">Questions and Answers</a></span></dt></dl></div><p>
2
 
        <a class="indexterm" name="id2584615"></a>
3
 
        <a class="indexterm" name="id2584621"></a>
4
 
        <a class="indexterm" name="id2584628"></a>
5
 
        <a class="indexterm" name="id2584635"></a>
6
 
        <a class="indexterm" name="id2584642"></a>
 
1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�12.�Integrating Additional Services</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.70.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part�III.�Reference Section"><link rel="prev" href="kerberos.html" title="Chapter�11.�Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter�13.�Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�12.�Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Reference Section</th><td width="20%" align="right">�<a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter�12.�Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2620617">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2620648">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2620749">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2620782">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2620947">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2620964">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2622829">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2622889">Questions and Answers</a></span></dt></dl></div><p>
 
2
        <a class="indexterm" name="id2620568"></a>
 
3
        <a class="indexterm" name="id2620574"></a>
 
4
        <a class="indexterm" name="id2620581"></a>
 
5
        <a class="indexterm" name="id2620588"></a>
 
6
        <a class="indexterm" name="id2620595"></a>
7
7
        You've come a long way now. You have pretty much mastered Samba-3 for 
8
8
        most uses it can be put to. Up until now, you have cast Samba-3 in the leading 
9
9
        role, and where authentication was required, you have used one or another of 
14
14
        implementing Samba and Samba-supported services in a domain controlled by 
15
15
        the latest Windows authentication technologies. Let's get started  this is 
16
16
        leading edge.
17
 
        </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2584664"></a>Introduction</h2></div></div></div><p>
 
17
        </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620617"></a>Introduction</h2></div></div></div><p>
18
18
        Abmas has continued its miraculous growth; indeed, nothing seems to be able 
19
19
        to stop its diversification into multiple (and seemingly unrelated) fields. 
20
20
        Its latest acquisition is Abmas Snack Foods, a big player in the snack-food 
30
30
        You have decided to set the ball rolling by introducing Samba-3 into the network 
31
31
        gradually, taking over key services and easing the way to a full migration and, 
32
32
        therefore, integration into Abmas's existing business later.
33
 
        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584695"></a>Assignment Tasks</h3></div></div></div><p>
34
 
                <a class="indexterm" name="id2584703"></a>
35
 
                <a class="indexterm" name="id2584712"></a>
 
33
        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620648"></a>Assignment Tasks</h3></div></div></div><p>
 
34
                <a class="indexterm" name="id2620656"></a>
 
35
                <a class="indexterm" name="id2620665"></a>
36
36
                You've promised the skeptical Abmas Snack Foods management team 
37
37
                that you can show them how Samba can ease itself and other Open Source 
38
38
                technologies into their existing infrastructure and deliver sound business 
39
39
                advantages. Cost cutting is high on their agenda (a major promise of the 
40
40
                acquisition). You have chosen Web proxying and caching as your proving ground.
41
41
                </p><p>
42
 
                <a class="indexterm" name="id2584730"></a>
43
 
                <a class="indexterm" name="id2584737"></a>
 
42
                <a class="indexterm" name="id2620683"></a>
 
43
                <a class="indexterm" name="id2620690"></a>
44
44
                Abmas Snack Foods has several thousand users housed at its head office 
45
45
                and multiple regional offices, plants, and warehouses. A high proportion of 
46
46
                the business's work is done online, so Internet access for most of these 
50
50
                the team soon discovered proxying and caching. In fact, they became one of 
51
51
                the earliest commercial users of Microsoft ISA.
52
52
                </p><p>
53
 
                <a class="indexterm" name="id2584757"></a>
54
 
                <a class="indexterm" name="id2584764"></a>
55
 
                <a class="indexterm" name="id2584771"></a>
 
53
                <a class="indexterm" name="id2620711"></a>
 
54
                <a class="indexterm" name="id2620718"></a>
 
55
                <a class="indexterm" name="id2620724"></a>
56
56
                The team is not happy with ISA. Because it never lived up to its marketing promises, 
57
57
                it underperformed and had reliability problems. You have pounced on the opportunity 
58
58
                to show what Open Source can do. The one thing they do like, however, is ISA's 
63
63
                </p><p>
64
64
                This is a hands-on exercise. You build software applications so
65
65
                that you obtain the functionality Abmas needs.
66
 
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2584795"></a>Dissection and Discussion</h2></div></div></div><p>
 
66
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620749"></a>Dissection and Discussion</h2></div></div></div><p>
67
67
        The key requirements in this business example are straightforward. You are not required 
68
68
        to do anything new, just to replicate an existing system, not lose any existing features, 
69
69
        and improve performance. The key points are:
73
73
                Distributed system to accommodate load and geographical distribution of users
74
74
                </p></li><li><p>
75
75
                Seamless and transparent interoperability with the existing Active Directory domain
76
 
                </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584828"></a>Technical Issues</h3></div></div></div><p>
77
 
                <a class="indexterm" name="id2584836"></a>
78
 
                <a class="indexterm" name="id2584843"></a>
79
 
                <a class="indexterm" name="id2584850"></a>
80
 
                <a class="indexterm" name="id2584857"></a>
81
 
                <a class="indexterm" name="id2584864"></a>
82
 
                <a class="indexterm" name="id2584870"></a>
83
 
                <a class="indexterm" name="id2584877"></a>
84
 
                <a class="indexterm" name="id2584884"></a>
85
 
                <a class="indexterm" name="id2584891"></a>
86
 
                <a class="indexterm" name="id2584898"></a>
87
 
                <a class="indexterm" name="id2584905"></a>
88
 
                <a class="indexterm" name="id2584912"></a>
89
 
                <a class="indexterm" name="id2584921"></a><a class="indexterm" name="id2584927"></a>
 
76
                </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620782"></a>Technical Issues</h3></div></div></div><p>
 
77
                <a class="indexterm" name="id2620789"></a>
 
78
                <a class="indexterm" name="id2620796"></a>
 
79
                <a class="indexterm" name="id2620803"></a>
 
80
                <a class="indexterm" name="id2620810"></a>
 
81
                <a class="indexterm" name="id2620817"></a>
 
82
                <a class="indexterm" name="id2620824"></a>
 
83
                <a class="indexterm" name="id2620830"></a>
 
84
                <a class="indexterm" name="id2620837"></a>
 
85
                <a class="indexterm" name="id2620844"></a>
 
86
                <a class="indexterm" name="id2620851"></a>
 
87
                <a class="indexterm" name="id2620858"></a>
 
88
                <a class="indexterm" name="id2620865"></a>
 
89
                <a class="indexterm" name="id2620874"></a><a class="indexterm" name="id2620880"></a>
90
90
                Functionally, the user's Internet Explorer requests a browsing session with the 
91
91
                Squid proxy, for which it offers its AD authentication token. Squid hands off 
92
92
                the authentication request to the Samba-3 authentication helper application
107
107
                        Configuring, compiling, and then installing the supporting Samba-3 components
108
108
                        </p></li><li><p>
109
109
                        Tying it all together
110
 
                        </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584993"></a>Political Issues</h3></div></div></div><p>
 
110
                        </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620947"></a>Political Issues</h3></div></div></div><p>
111
111
                You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 
112
112
                you fail. For you to gain the trust of your newly acquired IT people, it is essential that your 
113
113
                solution does everything the old one did, but does it better in every way. Only then 
114
114
                will the entrenched positions consider taking up your new way of doing things on a 
115
115
                wider scale.
116
 
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2585011"></a>Implementation</h2></div></div></div><p>
117
 
        <a class="indexterm" name="id2585019"></a>
 
116
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620964"></a>Implementation</h2></div></div></div><p>
 
117
        <a class="indexterm" name="id2620972"></a>
118
118
        First, your system needs to be prepared and in a known good state to proceed. This consists 
119
119
        of making sure that everything the system depends on is present and that everything that could 
120
120
        interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3 
121
121
        packages and updating them if necessary. If conflicting packages of these programs are installed, 
122
122
        they must be removed.
123
123
        </p><p>
124
 
        <a class="indexterm" name="id2585036"></a>
 
124
        <a class="indexterm" name="id2620989"></a>
125
125
        The following packages should be available on your Red Hat Linux system:
126
126
        </p><div class="itemizedlist"><ul type="disc"><li><p>
127
 
                <a class="indexterm" name="id2585051"></a>
128
 
                <a class="indexterm" name="id2585058"></a>
 
127
                <a class="indexterm" name="id2621004"></a>
 
128
                <a class="indexterm" name="id2621011"></a>
129
129
                krb5-libs
130
130
                </p></li><li><p>
131
131
                krb5-devel
136
136
                </p></li><li><p>
137
137
                pam_krb5
138
138
                </p></li></ul></div><p>
139
 
        <a class="indexterm" name="id2585088"></a>
 
139
        <a class="indexterm" name="id2621041"></a>
140
140
        In the case of SUSE Linux, these packages are called:
141
141
        </p><div class="itemizedlist"><ul type="disc"><li><p>
142
142
                heimdal-lib
143
143
                </p></li><li><p>
144
144
                heimdal-devel
145
145
                </p></li><li><p>
146
 
                <a class="indexterm" name="id2585112"></a>
 
146
                <a class="indexterm" name="id2621066"></a>
147
147
                heimdal
148
148
                </p></li><li><p>
149
149
                pam_krb5
152
152
        them from the vendor's installation media. Follow the administrative guide
153
153
        for your Linux system to ensure that the packages are correctly updated.
154
154
        </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
155
 
        <a class="indexterm" name="id2585138"></a>
156
 
        <a class="indexterm" name="id2585145"></a>
157
 
        <a class="indexterm" name="id2585151"></a>
 
155
        <a class="indexterm" name="id2621091"></a>
 
156
        <a class="indexterm" name="id2621098"></a>
 
157
        <a class="indexterm" name="id2621105"></a>
158
158
        If the requirement is for interoperation with MS Windows Server 2003, it
159
159
        will be necessary to ensure that you are using MIT Kerberos version 1.3.1
160
160
        or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires
161
161
        updating.
162
162
        </p><p>
163
 
        <a class="indexterm" name="id2585165"></a>
164
 
        <a class="indexterm" name="id2585172"></a>
 
163
        <a class="indexterm" name="id2621118"></a>
 
164
        <a class="indexterm" name="id2621125"></a>
165
165
        Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise
166
166
        Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version.
167
167
        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p>
168
 
        <a class="indexterm" name="id2585195"></a>
 
168
        <a class="indexterm" name="id2621148"></a>
169
169
        If Samba and/or Squid RPMs are installed, they should be updated. You can 
170
170
        build both from source.
171
171
        </p><p>
172
 
        <a class="indexterm" name="id2585206"></a>
173
 
        <a class="indexterm" name="id2585213"></a>
174
 
        <a class="indexterm" name="id2585220"></a>
 
172
        <a class="indexterm" name="id2621160"></a>
 
173
        <a class="indexterm" name="id2621166"></a>
 
174
        <a class="indexterm" name="id2621173"></a>
175
175
        Locating the packages to be un-installed can be achieved by running:
176
176
</p><pre class="screen">
177
177
<code class="prompt">root# </code> rpm -qa | grep -i samba
181
181
</p><pre class="screen">
182
182
<code class="prompt">root# </code> rpm -e samba-common
183
183
</pre><p>
184
 
        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2585260"></a>Kerberos Configuration</h3></div></div></div><p>
185
 
        <a class="indexterm" name="id2585268"></a>
186
 
        <a class="indexterm" name="id2585275"></a>
187
 
        <a class="indexterm" name="id2585284"></a>
188
 
        <a class="indexterm" name="id2585290"></a>
 
184
        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621213"></a>Kerberos Configuration</h3></div></div></div><p>
 
185
        <a class="indexterm" name="id2621221"></a>
 
186
        <a class="indexterm" name="id2621228"></a>
 
187
        <a class="indexterm" name="id2621237"></a>
 
188
        <a class="indexterm" name="id2621244"></a>
189
189
        The systems Kerberos installation must be configured to communicate with 
190
190
        your primary Active Directory server (ADS KDC).
191
191
        </p><p>
193
193
        although the current default Red Hat MIT version 1.2.7 gives acceptable results 
194
194
        unless you are using Windows 2003 servers.
195
195
        </p><p>
196
 
        <a class="indexterm" name="id2585310"></a>
197
 
        <a class="indexterm" name="id2585316"></a>
198
 
        <a class="indexterm" name="id2585323"></a>
199
 
        <a class="indexterm" name="id2585330"></a>
200
 
        <a class="indexterm" name="id2585337"></a>
201
 
        <a class="indexterm" name="id2585346"></a>
202
 
        <a class="indexterm" name="id2585352"></a>
 
196
        <a class="indexterm" name="id2621263"></a>
 
197
        <a class="indexterm" name="id2621269"></a>
 
198
        <a class="indexterm" name="id2621276"></a>
 
199
        <a class="indexterm" name="id2621283"></a>
 
200
        <a class="indexterm" name="id2621290"></a>
 
201
        <a class="indexterm" name="id2621299"></a>
 
202
        <a class="indexterm" name="id2621305"></a>
203
203
        Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 
204
204
        file in order to work correctly. All ADS domains automatically create SRV records in the 
205
205
        DNS zone <code class="constant">Kerberos.REALM.NAME</code> for each KDC in the realm. Since both 
207
207
        automatically find the KDCs. In addition, <code class="filename">krb5.conf</code> allows 
208
208
        specifying only a single KDC, even if there is more than one. Using the DNS lookup 
209
209
        allows the KRB5 libraries to use whichever KDCs are available.
210
 
        </p><div class="procedure"><a name="id2585386"></a><p class="title"><b>Procedure�12.1.�Kerberos Configuration Steps</b></p><ol type="1"><li><p>
211
 
                <a class="indexterm" name="id2585398"></a>
 
210
        </p><div class="procedure"><a name="id2621340"></a><p class="title"><b>Procedure�12.1.�Kerberos Configuration Steps</b></p><ol type="1"><li><p>
 
211
                <a class="indexterm" name="id2621351"></a>
212
212
                If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it
213
213
                to have the contents shown in <a href="DomApps.html#ch10-krb5conf" title="Example�12.1.�Kerberos Configuration  File: /etc/krb5.conf">???</a>. The final fully qualified path for this file 
214
214
                should be <code class="filename">/etc/krb5.conf</code>.
215
215
                </p></li><li><p>
216
 
                <a class="indexterm" name="id2585433"></a>
217
 
                <a class="indexterm" name="id2585440"></a>
218
 
                <a class="indexterm" name="id2585446"></a>
219
 
                <a class="indexterm" name="id2585453"></a>
220
 
                <a class="indexterm" name="id2585460"></a>
221
 
                <a class="indexterm" name="id2585467"></a>
222
 
                <a class="indexterm" name="id2585474"></a>
223
 
                <a class="indexterm" name="id2585480"></a>
224
 
                <a class="indexterm" name="id2585487"></a>
225
 
                <a class="indexterm" name="id2585496"></a>
226
 
                <a class="indexterm" name="id2585503"></a>
227
 
                <a class="indexterm" name="id2585510"></a>
228
 
                <a class="indexterm" name="id2585516"></a>
 
216
                <a class="indexterm" name="id2621386"></a>
 
217
                <a class="indexterm" name="id2621393"></a>
 
218
                <a class="indexterm" name="id2621400"></a>
 
219
                <a class="indexterm" name="id2621406"></a>
 
220
                <a class="indexterm" name="id2621413"></a>
 
221
                <a class="indexterm" name="id2621420"></a>
 
222
                <a class="indexterm" name="id2621427"></a>
 
223
                <a class="indexterm" name="id2621434"></a>
 
224
                <a class="indexterm" name="id2621440"></a>
 
225
                <a class="indexterm" name="id2621449"></a>
 
226
                <a class="indexterm" name="id2621456"></a>
 
227
                <a class="indexterm" name="id2621463"></a>
 
228
                <a class="indexterm" name="id2621470"></a>
229
229
                The following gotchas often catch people out. Kerberos is case sensitive. Your realm must
230
230
                be in UPPERCASE, or you will get an error: &#8220;<span class="quote">Cannot find KDC for requested realm while getting
231
231
                initial credentials</span>&#8221;.  Kerberos is picky about time synchronization. The time
241
241
                NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error
242
242
                when you try to join the realm.
243
243
                </p></li><li><p>
244
 
                <a class="indexterm" name="id2585561"></a>
 
244
                <a class="indexterm" name="id2621514"></a>
245
245
                You are now ready to test your installation by issuing the command:
246
246
</p><pre class="screen">
247
247
<code class="prompt">root# </code> kinit [USERNAME@REALM]
253
253
Password for ADMINISTRATOR@LONDON.ABMAS.BIZ: 
254
254
</pre><p>
255
255
                Make sure that your password is accepted by the Active Directory KDC.
256
 
                </p></li></ol></div><div class="example"><a name="ch10-krb5conf"></a><p class="title"><b>Example�12.1.�Kerberos Configuration  File: <code class="filename">/etc/krb5.conf</code></b></p><pre class="screen">
 
256
                </p></li></ol></div><div class="example"><a name="ch10-krb5conf"></a><p class="title"><b>Example�12.1.�Kerberos Configuration  File: <code class="filename">/etc/krb5.conf</code></b></p><div class="example-contents"><pre class="screen">
257
257
[libdefaults]
258
258
        default_realm = LONDON.ABMAS.BIZ
259
259
 
261
261
        LONDON.ABMAS.BIZ = {
262
262
        kdc = w2k3s.london.abmas.biz
263
263
        }
264
 
</pre></div><p><a class="indexterm" name="id2585626"></a>
 
264
</pre></div></div><br class="example-break"><p><a class="indexterm" name="id2621579"></a>
265
265
        The command
266
266
</p><pre class="screen">
267
267
<code class="prompt">root# </code> klist -e 
268
268
</pre><p>
269
269
        shows the Kerberos tickets cached by the system.
270
 
        </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2585649"></a>Samba Configuration</h4></div></div></div><p>
271
 
        <a class="indexterm" name="id2585656"></a>
 
270
        </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2621602"></a>Samba Configuration</h4></div></div></div><p>
 
271
        <a class="indexterm" name="id2621610"></a>
272
272
        Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 
273
273
        has the necessary components to interface with Active Directory.
274
 
        </p><div class="procedure"><a name="id2585667"></a><p class="title"><b>Procedure�12.2.�Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>
275
 
                <a class="indexterm" name="id2585679"></a>
276
 
                <a class="indexterm" name="id2585686"></a>
277
 
                <a class="indexterm" name="id2585693"></a>
278
 
                <a class="indexterm" name="id2585700"></a>
279
 
                <a class="indexterm" name="id2585706"></a>
 
274
        </p><div class="procedure"><a name="id2621620"></a><p class="title"><b>Procedure�12.2.�Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>
 
275
                <a class="indexterm" name="id2621632"></a>
 
276
                <a class="indexterm" name="id2621639"></a>
 
277
                <a class="indexterm" name="id2621646"></a>
 
278
                <a class="indexterm" name="id2621653"></a>
 
279
                <a class="indexterm" name="id2621660"></a>
280
280
                Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team
281
281
                <a href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team
282
282
                RPMs for Red Hat Fedora Linux contain the <span><strong class="command">ntlm_auth</strong></span> tool
283
283
                needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use.
284
284
                </p><p>
285
 
                <a class="indexterm" name="id2585733"></a>
286
 
                <a class="indexterm" name="id2585740"></a>
 
285
                <a class="indexterm" name="id2621686"></a>
 
286
                <a class="indexterm" name="id2621693"></a>
287
287
                The necessary, validated RPM packages for SUSE Linux may be obtained from
288
288
                the <a href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that
289
289
                is located in Germany. All SerNet RPMs are validated, have the necessary
293
293
                Using your favorite editor, change the <code class="filename">/etc/samba/smb.conf</code>
294
294
                file so it has contents similar to the example shown in <a href="DomApps.html#ch10-smbconf" title="Example�12.2.�Samba Configuration  File: /etc/samba/smb.conf">???</a>.
295
295
                </p></li><li><p>
296
 
                <a class="indexterm" name="id2585791"></a>
297
 
                <a class="indexterm" name="id2585798"></a>
298
 
                <a class="indexterm" name="id2585805"></a>i
299
 
                <a class="indexterm" name="id2585816"></a>
300
 
                <a class="indexterm" name="id2585823"></a>
 
296
                <a class="indexterm" name="id2621744"></a>
 
297
                <a class="indexterm" name="id2621751"></a>
 
298
                <a class="indexterm" name="id2621758"></a>i
 
299
                <a class="indexterm" name="id2621769"></a>
 
300
                <a class="indexterm" name="id2621776"></a>
301
301
                Next you need to create a computer account in the Active Directory. 
302
302
                This sets up the trust relationship needed for other clients to 
303
303
                authenticate to the Samba server with an Active Directory Kerberos ticket. 
307
307
<code class="prompt">root# </code> net ads join -U administrator%vulcon
308
308
</pre><p>
309
309
                </p></li><li><p>
310
 
                <a class="indexterm" name="id2585857"></a>
311
 
                <a class="indexterm" name="id2585864"></a>
312
 
                <a class="indexterm" name="id2585871"></a>
313
 
                <a class="indexterm" name="id2585877"></a>
314
 
                <a class="indexterm" name="id2585884"></a>
 
310
                <a class="indexterm" name="id2621810"></a>
 
311
                <a class="indexterm" name="id2621817"></a>
 
312
                <a class="indexterm" name="id2621824"></a>
 
313
                <a class="indexterm" name="id2621831"></a>
 
314
                <a class="indexterm" name="id2621838"></a>
315
315
                Your new Samba binaries must be started in the standard manner as is applicable
316
316
                to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands:
317
317
</p><pre class="screen">
320
320
<code class="prompt">root# </code> winbindd -B
321
321
</pre><p>
322
322
                </p></li><li><p>
323
 
                <a class="indexterm" name="id2585925"></a>
324
 
                <a class="indexterm" name="id2585932"></a>
325
 
                <a class="indexterm" name="id2585941"></a>
326
 
                <a class="indexterm" name="id2585948"></a>
327
 
                <a class="indexterm" name="id2585955"></a>
 
323
                <a class="indexterm" name="id2621878"></a>
 
324
                <a class="indexterm" name="id2621885"></a>
 
325
                <a class="indexterm" name="id2621894"></a>
 
326
                <a class="indexterm" name="id2621901"></a>
 
327
                <a class="indexterm" name="id2621908"></a>
328
328
                We now need to test that Samba is communicating with the Active 
329
329
                Directory domain; most specifically, we want to see whether winbind 
330
330
                is enumerating users and groups. Issue the following commands:
357
357
</pre><p>
358
358
                This enumerates all the groups in your Active Directory tree.
359
359
                </p></li><li><p>
360
 
                <a class="indexterm" name="id2586019"></a>
361
 
                <a class="indexterm" name="id2586026"></a>
 
360
                <a class="indexterm" name="id2621972"></a>
 
361
                <a class="indexterm" name="id2621979"></a>
362
362
                Squid uses the <span><strong class="command">ntlm_auth</strong></span> helper build with Samba-3.
363
363
                You may test <span><strong class="command">ntlm_auth</strong></span> with the command:
364
364
</p><pre class="screen">
370
370
<code class="prompt">root# </code> NT_STATUS_OK: Success (0x0)
371
371
</pre><p>
372
372
                </p></li><li><p>
373
 
                <a class="indexterm" name="id2586078"></a>
374
 
                <a class="indexterm" name="id2586085"></a>
375
 
                <a class="indexterm" name="id2586092"></a>
376
 
                <a class="indexterm" name="id2586098"></a>
377
 
                <a class="indexterm" name="id2586105"></a>
378
 
                <a class="indexterm" name="id2586112"></a>
379
 
                <a class="indexterm" name="id2586119"></a>
380
 
                <a class="indexterm" name="id2586126"></a>
 
373
                <a class="indexterm" name="id2622031"></a>
 
374
                <a class="indexterm" name="id2622038"></a>
 
375
                <a class="indexterm" name="id2622045"></a>
 
376
                <a class="indexterm" name="id2622052"></a>
 
377
                <a class="indexterm" name="id2622059"></a>
 
378
                <a class="indexterm" name="id2622065"></a>
 
379
                <a class="indexterm" name="id2622072"></a>
 
380
                <a class="indexterm" name="id2622079"></a>
381
381
                The <span><strong class="command">ntlm_auth</strong></span> helper, when run from a command line as the user 
382
382
                &#8220;<span class="quote">root</span>&#8221;, authenticates against your Active Directory domain (with 
383
383
                the aid of winbind). It manages this by reading from the winbind privileged pipe. 
395
395
<code class="prompt">root# </code> chgrp squid /var/lib/samba/winbindd_privileged
396
396
<code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged
397
397
</pre><p>
398
 
                </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2586201"></a>NSS Configuration</h4></div></div></div><p>
399
 
        <a class="indexterm" name="id2586209"></a>
400
 
        <a class="indexterm" name="id2586215"></a>
401
 
        <a class="indexterm" name="id2586222"></a>
 
398
                </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2622154"></a>NSS Configuration</h4></div></div></div><p>
 
399
        <a class="indexterm" name="id2622162"></a>
 
400
        <a class="indexterm" name="id2622168"></a>
 
401
        <a class="indexterm" name="id2622175"></a>
402
402
        For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
403
403
        </p><p>
404
404
        Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown
405
405
        in <a href="DomApps.html#ch10-etcnsscfg" title="Example�12.3.�NSS Configuration File Extract  File: /etc/nsswitch.conf">???</a>.
406
 
        </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example�12.2.�Samba Configuration  File: <code class="filename">/etc/samba/smb.conf</code></b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2586281"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2586293"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2586306"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2586319"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2586332"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586345"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2586362"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2586379"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2586396"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2586413"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586426"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586439"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example�12.3.�NSS Configuration File Extract  File: <code class="filename">/etc/nsswitch.conf</code></b></p><pre class="screen">
 
406
        </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example�12.2.�Samba Configuration  File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2622234"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2622247"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2622260"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2622272"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2622285"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2622298"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2622316"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2622333"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2622350"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2622366"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2622379"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2622392"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example�12.3.�NSS Configuration File Extract  File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">
407
407
passwd: files winbind
408
408
shadow: files
409
409
group: files winbind
410
 
</pre></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2586479"></a>Squid Configuration</h4></div></div></div><p>
411
 
        <a class="indexterm" name="id2586487"></a>
412
 
        <a class="indexterm" name="id2586494"></a>
 
410
</pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2622432"></a>Squid Configuration</h4></div></div></div><p>
 
411
        <a class="indexterm" name="id2622440"></a>
 
412
        <a class="indexterm" name="id2622447"></a>
413
413
        Squid must be configured correctly to interact with the Samba-3 
414
414
        components that handle Active Directory authentication.
415
 
        </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586509"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2586514"></a><p class="title"><b>Procedure�12.3.�Squid Configuration Steps</b></p><ol type="1"><li><p>
416
 
                <a class="indexterm" name="id2586526"></a>
417
 
                <a class="indexterm" name="id2586533"></a>
418
 
                <a class="indexterm" name="id2586540"></a>
 
415
        </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622462"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2622468"></a><p class="title"><b>Procedure�12.3.�Squid Configuration Steps</b></p><ol type="1"><li><p>
 
416
                <a class="indexterm" name="id2622479"></a>
 
417
                <a class="indexterm" name="id2622486"></a>
 
418
                <a class="indexterm" name="id2622494"></a>
419
419
                If your Linux distribution is SUSE Linux 9, the version of Squid 
420
420
                supplied is already enabled to use the winbind helper agent. You
421
421
                can therefore omit the steps that would build the Squid binary
422
422
                programs.
423
423
                </p></li><li><p>
424
 
                <a class="indexterm" name="id2586558"></a>
425
 
                <a class="indexterm" name="id2586564"></a>
426
 
                <a class="indexterm" name="id2586571"></a>
427
 
                <a class="indexterm" name="id2586578"></a>
428
 
                <a class="indexterm" name="id2586585"></a>
 
424
                <a class="indexterm" name="id2622511"></a>
 
425
                <a class="indexterm" name="id2622518"></a>
 
426
                <a class="indexterm" name="id2622524"></a>
 
427
                <a class="indexterm" name="id2622531"></a>
 
428
                <a class="indexterm" name="id2622538"></a>
429
429
                Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 
430
430
                add a system user <code class="constant">squid</code> and a system group 
431
431
                <code class="constant">squid</code> if they are not set up already (if the default 
433
433
                <code class="constant">squid</code> user in <code class="filename">/etc/passwd</code> 
434
434
                and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already.
435
435
                </p></li><li><p>
436
 
                <a class="indexterm" name="id2586632"></a>
437
 
                <a class="indexterm" name="id2586639"></a>
 
436
                <a class="indexterm" name="id2622586"></a>
 
437
                <a class="indexterm" name="id2622592"></a>
438
438
                You now need to change the permissions on Squid's <code class="constant">var</code>
439
439
                directory.  Enter the following command:
440
440
</p><pre class="screen">
441
441
<code class="prompt">root# </code> chown -R squid /var/cache/squid
442
442
</pre><p>
443
443
                </p></li><li><p>
444
 
                <a class="indexterm" name="id2586670"></a>
445
 
                <a class="indexterm" name="id2586677"></a>
 
444
                <a class="indexterm" name="id2622623"></a>
 
445
                <a class="indexterm" name="id2622630"></a>
446
446
                Squid must also have control over its logging. Enter the following commands:
447
447
</p><pre class="screen">
448
448
<code class="prompt">root# </code> chown -R chown squid:squid /var/log/squid
456
456
<code class="prompt">root# </code> chmod 770 /var/cache/squid
457
457
</pre><p>
458
458
                </p></li><li><p>
459
 
                <a class="indexterm" name="id2586737"></a>
 
459
                <a class="indexterm" name="id2622690"></a>
460
460
                The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 
461
461
                <a href="DomApps.html#etcsquidcfg" title="Example�12.4.�Squid Configuration File Extract  /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">???</a> and <a href="DomApps.html#etcsquid2" title="Example�12.5.�Squid Configuration File extract  File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">???</a>.
462
462
                </p></li><li><p>
463
 
                <a class="indexterm" name="id2586771"></a>
 
463
                <a class="indexterm" name="id2622725"></a>
464
464
                You must create Squid's cache directories before it may be run.  Enter the following command: 
465
465
</p><pre class="screen">
466
466
<code class="prompt">root# </code> squid -z
471
471
</p><pre class="screen">
472
472
<code class="prompt">root# </code> squid
473
473
</pre><p>
474
 
                </p></li></ol></div><div class="example"><a name="etcsquidcfg"></a><p class="title"><b>Example�12.4.�Squid Configuration File Extract  <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</b></p><pre class="screen">
 
474
                </p></li></ol></div><div class="example"><a name="etcsquidcfg"></a><p class="title"><b>Example�12.4.�Squid Configuration File Extract  <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</b></p><div class="example-contents"><pre class="screen">
475
475
        cache_effective_user squid
476
476
        cache_effective_group squid
477
 
</pre></div><div class="example"><a name="etcsquid2"></a><p class="title"><b>Example�12.5.�Squid Configuration File extract  File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</b></p><pre class="screen">
 
477
</pre></div></div><br class="example-break"><div class="example"><a name="etcsquid2"></a><p class="title"><b>Example�12.5.�Squid Configuration File extract  File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</b></p><div class="example-contents"><pre class="screen">
478
478
        auth_param ntlm program /usr/bin/ntlm_auth \
479
479
                                --helper-protocol=squid-2.5-ntlmssp
480
480
        auth_param ntlm children 5
487
487
        auth_param basic credentialsttl 2 hours
488
488
        acl AuthorizedUsers proxy_auth REQUIRED
489
489
        http_access allow all AuthorizedUsers
490
 
</pre></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586876"></a>Key Points Learned</h3></div></div></div><p>
491
 
                <a class="indexterm" name="id2586884"></a>
492
 
                <a class="indexterm" name="id2586891"></a>
493
 
                <a class="indexterm" name="id2586898"></a>
494
 
                <a class="indexterm" name="id2586905"></a>
495
 
                <a class="indexterm" name="id2586916"></a>
 
490
</pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622829"></a>Key Points Learned</h3></div></div></div><p>
 
491
                <a class="indexterm" name="id2622837"></a>
 
492
                <a class="indexterm" name="id2622844"></a>
 
493
                <a class="indexterm" name="id2622851"></a>
 
494
                <a class="indexterm" name="id2622858"></a>
 
495
                <a class="indexterm" name="id2622869"></a>
496
496
                Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft
497
497
                Windows clients use, even when accessing traditional services such as Web browsers. Depending 
498
498
                on whom you discuss this with, this is either good or bad. No matter how you might evaluate this,
499
499
                the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over
500
500
                the cookie-based authentication regime used by all competing browsers. It is Samba's implementation
501
501
                of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter.
502
 
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2586936"></a>Questions and Answers</h2></div></div></div><p>
503
 
        <a class="indexterm" name="id2586944"></a>
504
 
        <a class="indexterm" name="id2586951"></a>
505
 
        <a class="indexterm" name="id2586958"></a>
506
 
        <a class="indexterm" name="id2586965"></a>
 
502
                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622889"></a>Questions and Answers</h2></div></div></div><p>
 
503
        <a class="indexterm" name="id2622897"></a>
 
504
        <a class="indexterm" name="id2622904"></a>
 
505
        <a class="indexterm" name="id2622911"></a>
 
506
        <a class="indexterm" name="id2622918"></a>
507
507
        The development of the <span><strong class="command">ntlm_auth</strong></span> module was first discussed in many Open Source circles
508
508
        in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of 
509
509
        <span><strong class="command">ntlm_auth</strong></span> during one of the late developer meetings that took place. Since that time, the 
522
522
        You would be well-advised to recognize that all cache-intensive proxying solutions demand a lot of memory.
523
523
        Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 
524
524
        out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk.
525
 
        </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id2587042">
 
525
        </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id2622995">
526
526
                What does Samba have to do with Web proxy serving?
527
 
                </a></dt><dt> <a href="DomApps.html#id2587216">
 
527
                </a></dt><dt> <a href="DomApps.html#id2623161">
528
528
                What other services does Samba provide?
529
 
                </a></dt><dt> <a href="DomApps.html#id2587360">
 
529
                </a></dt><dt> <a href="DomApps.html#id2623305">
530
530
                Does use of Samba (ntlm_auth) improve the performance of Squid?
531
 
                </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2587042"></a><a name="id2587044"></a><b></b></td><td align="left" valign="top"><p>
 
531
                </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2622995"></a><a name="id2622998"></a></td><td align="left" valign="top"><p>
532
532
                What does Samba have to do with Web proxy serving?
533
 
                </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
534
 
                <a class="indexterm" name="id2587056"></a>
535
 
                <a class="indexterm" name="id2587063"></a>
536
 
                <a class="indexterm" name="id2587070"></a>
537
 
                <a class="indexterm" name="id2587079"></a>
538
 
                <a class="indexterm" name="id2587086"></a>
 
533
                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
 
534
                <a class="indexterm" name="id2623009"></a>
 
535
                <a class="indexterm" name="id2623016"></a>
 
536
                <a class="indexterm" name="id2623023"></a>
 
537
                <a class="indexterm" name="id2623033"></a>
 
538
                <a class="indexterm" name="id2623040"></a>
539
539
                To provide transparent interoperability between Windows clients and the network services
540
540
                that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit
541
541
                of Open Source software is that it can readily be reused. The current <span><strong class="command">ntlm_auth</strong></span>
542
542
                module is basically a wrapper around authentication code from the core of the Samba project.
543
543
                </p><p>
544
 
                <a class="indexterm" name="id2587108"></a>
545
 
                <a class="indexterm" name="id2587115"></a>
546
 
                <a class="indexterm" name="id2587125"></a>
547
 
                <a class="indexterm" name="id2587134"></a>
548
 
                <a class="indexterm" name="id2587142"></a>
549
 
                <a class="indexterm" name="id2587149"></a>
550
 
                <a class="indexterm" name="id2587156"></a>
551
 
                <a class="indexterm" name="id2587163"></a>
552
 
                <a class="indexterm" name="id2587170"></a>
 
544
                <a class="indexterm" name="id2623062"></a>
 
545
                <a class="indexterm" name="id2623068"></a>
 
546
                <a class="indexterm" name="id2623078"></a>
 
547
                <a class="indexterm" name="id2623087"></a>
 
548
                <a class="indexterm" name="id2623096"></a>
 
549
                <a class="indexterm" name="id2623102"></a>
 
550
                <a class="indexterm" name="id2623109"></a>
 
551
                <a class="indexterm" name="id2623116"></a>
 
552
                <a class="indexterm" name="id2623123"></a>
553
553
                The <span><strong class="command">ntlm_auth</strong></span> module supports basic plain-text authentication and NTLMSSP 
554
554
                protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without
555
555
                the user being interrupted via his or her Windows logon credentials. This facility is available with
557
557
                There are a few open source initiatives to provide support for these protocols in the Apache Web server
558
558
                also.
559
559
                </p><p>
560
 
                <a class="indexterm" name="id2587203"></a>
 
560
                <a class="indexterm" name="id2623148"></a>
561
561
                The short answer is that by adding a wrapper around key authentication components of Samba, other
562
562
                projects (like Squid) can benefit from the labors expended in meeting user interoperability needs.
563
 
                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2587216"></a><a name="id2587218"></a><b></b></td><td align="left" valign="top"><p>
 
563
                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2623161"></a><a name="id2623164"></a></td><td align="left" valign="top"><p>
564
564
                What other services does Samba provide?
565
 
                </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
566
 
                <a class="indexterm" name="id2587230"></a>
567
 
                <a class="indexterm" name="id2587237"></a>
568
 
                <a class="indexterm" name="id2587244"></a>
569
 
                <a class="indexterm" name="id2587251"></a>
570
 
                <a class="indexterm" name="id2587257"></a>
 
565
                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
 
566
                <a class="indexterm" name="id2623175"></a>
 
567
                <a class="indexterm" name="id2623182"></a>
 
568
                <a class="indexterm" name="id2623189"></a>
 
569
                <a class="indexterm" name="id2623196"></a>
 
570
                <a class="indexterm" name="id2623202"></a>
571
571
                Samba-3 is a file and print server. The core components that provide this functionality are <span><strong class="command">smbd</strong></span>,
572
572
                <span><strong class="command">nmbd</strong></span>, and the identity resolver daemon, <span><strong class="command">winbindd</strong></span>.
573
573
                </p><p>
574
 
                <a class="indexterm" name="id2587288"></a>
575
 
                <a class="indexterm" name="id2587295"></a>
 
574
                <a class="indexterm" name="id2623233"></a>
 
575
                <a class="indexterm" name="id2623240"></a>
576
576
                Samba-3 is an SMB/CIFS client. The core component that provides this is called <span><strong class="command">smbclient</strong></span>.
577
577
                </p><p>
578
 
                <a class="indexterm" name="id2587312"></a>
579
 
                <a class="indexterm" name="id2587319"></a>
580
 
                <a class="indexterm" name="id2587326"></a>
581
 
                <a class="indexterm" name="id2587333"></a>
582
 
                <a class="indexterm" name="id2587340"></a>
 
578
                <a class="indexterm" name="id2623257"></a>
 
579
                <a class="indexterm" name="id2623264"></a>
 
580
                <a class="indexterm" name="id2623271"></a>
 
581
                <a class="indexterm" name="id2623278"></a>
 
582
                <a class="indexterm" name="id2623285"></a>
583
583
                Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.
584
584
                Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
585
585
                servers and clients. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts
586
586
                as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switch (NSS) modules
587
587
                to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial
588
588
                server products).
589
 
                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2587360"></a><a name="id2587362"></a><b></b></td><td align="left" valign="top"><p>
 
589
                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2623305"></a><a name="id2623307"></a></td><td align="left" valign="top"><p>
590
590
                Does use of Samba (<span><strong class="command">ntlm_auth</strong></span>) improve the performance of Squid?
591
 
                </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
 
591
                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
592
592
                Not really. Samba's <span><strong class="command">ntlm_auth</strong></span> module handles only authentication. It requires that
593
593
                Squid make an external call to <span><strong class="command">ntlm_auth</strong></span> and therefore actually incurs a
594
594
                little more overhead. Compared with the benefit obtained, that overhead is well worth enduring. Since