33
33
features, and yet he had happy users. Months later he was still adding
34
34
new innovations. He always asked the users if a
35
35
particular feature was what they wanted. He asked his boss for a raise
36
and got it. He often told me, “<span class="quote">Always keep a few new tricks up your
37
sleeves for when you need them.</span>” Was he smart? You decide. Let's
36
and got it. He often told me, <span class="quote">“<span class="quote">Always keep a few new tricks up your
37
sleeves for when you need them.</span>”</span> Was he smart? You decide. Let's
38
38
get on with our next exercise.
39
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555462"></a>Introduction</h2></div></div></div><p>
39
</p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2561519"></a>Introduction</h2></div></div></div><p>
40
40
Abmas Accounting has grown. Mr. Meany likes you and says he knew you
41
41
were the right person for the job. That's why he asked you to install the
42
42
new server. The past few months have been hard work. You advised Mr. Meany
80
80
Mr. Meany also asked if it would be possible for one of the staff to manage
81
81
user accounts from the Windows desktop. That person will be responsible for
83
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555545"></a>Dissection and Discussion</h2></div></div></div><p>
83
</p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2561602"></a>Dissection and Discussion</h2></div></div></div><p>
84
84
What are the key requirements in this business example? A quick review indicates
86
</p><div class="itemizedlist"><ul type="disc"><li><p>
86
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
87
87
Scalability, from 52 to over 100 users in 12 months
88
</p></li><li class="listitem"><p>
89
89
Mobile computing capability
90
<a class="indexterm" name="id2555566"></a>
90
<a class="indexterm" name="id2561623"></a>
91
</p></li><li class="listitem"><p>
92
92
Improved reliability and usability
93
</p></li><li class="listitem"><p>
94
94
Easier administration
95
95
</p></li></ul></div><p>
96
96
In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
97
97
(as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>).
99
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555593"></a>Technical Issues</h3></div></div></div><p>
100
<a class="indexterm" name="id2555600"></a>
101
<a class="indexterm" name="id2555606"></a>
102
<a class="indexterm" name="id2555613"></a>
103
<a class="indexterm" name="id2555619"></a>
104
<a class="indexterm" name="id2555625"></a>
99
</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2561650"></a>Technical Issues</h3></div></div></div><p>
100
<a class="indexterm" name="id2561657"></a>
101
<a class="indexterm" name="id2561664"></a>
102
<a class="indexterm" name="id2561670"></a>
103
<a class="indexterm" name="id2561676"></a>
104
<a class="indexterm" name="id2561682"></a>
105
105
It is time to implement a domain security environment. You will use the <code class="constant">
106
106
smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to
107
107
run DNS at this time, but the system will use WINS. The domain name will be <code class="constant">
166
166
Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
167
167
supplied with antivirus software? Above all, demonstrate good purchase value and remember
168
168
to make your users happy.
169
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555812"></a>Implementation</h2></div></div></div><p>
170
<a class="indexterm" name="id2555820"></a>
169
</p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2561869"></a>Implementation</h2></div></div></div><p>
170
<a class="indexterm" name="id2561877"></a>
171
171
In this example, the assumption is made that this server is being configured from a clean start.
172
172
The alternate approach could be to demonstrate the migration of the system that is documented
173
173
in <a class="link" href="simple.html#AcctgNet" title="Implementation">“Implementation”</a> to meet the new requirements. The decision to treat this case, as with
175
175
the migration steps from the information provided in <a class="link" href="ntmigration.html" title="Chapter�9.�Migrating NT4 Domain to Samba-3">“Migrating NT4 Domain to Samba-3”</a>.
176
176
Additionally, a fresh installation makes the example easier to follow.
178
<a class="indexterm" name="id2555846"></a>
178
<a class="indexterm" name="id2561903"></a>
179
179
Each user will be given a home directory on the UNIX system, which will be available as a private
180
180
share. Two additional shares will be created, one for the accounting department and the other for
181
181
the financial services department. Network users will be given access to these shares by way
182
182
of group membership.
184
<a class="indexterm" name="id2555861"></a>
184
<a class="indexterm" name="id2561918"></a>
185
185
UNIX group membership is the primary mechanism by which Windows Domain users will be granted
186
186
rights and privileges within the Windows environment.
188
<a class="indexterm" name="id2555875"></a>
188
<a class="indexterm" name="id2561932"></a>
189
189
The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved
190
190
by setting the sticky bit (set UID/GID) on the top-level directories.
191
</p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure�2.1.�Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id2555930"></a><p class="title"><b>Procedure�2.1.�Server Installation Steps</b></p><ol type="1"><li><p>
191
</p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure�2.1.�Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure�2.1.�Server Installation Steps"><a name="id2561987"></a><p class="title"><b>Procedure�2.1.�Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
192
192
Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>.
194
<a class="indexterm" name="id2555951"></a>
193
</p></li><li class="step" title="Step 2"><p>
194
<a class="indexterm" name="id2562008"></a>
195
195
Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>.
196
196
The printers are network attached, so there should be entries for the
197
197
network printers also. An example <code class="filename">/etc/hosts</code> file is shown here:
202
202
192.168.1.11 hplj4
205
</p></li><li class="step" title="Step 3"><p>
206
206
Install the Samba-3 binary RPM from the Samba-Team FTP site.
207
</p></li><li class="step" title="Step 4"><p>
208
208
Install the ISC DHCP server using the UNIX/Linux system tools available to you.
210
<a class="indexterm" name="id2556002"></a>
211
<a class="indexterm" name="id2556008"></a>
212
<a class="indexterm" name="id2556014"></a>
213
<a class="indexterm" name="id2556020"></a>
209
</p></li><li class="step" title="Step 5"><p>
210
<a class="indexterm" name="id2562059"></a>
211
<a class="indexterm" name="id2562065"></a>
212
<a class="indexterm" name="id2562071"></a>
213
<a class="indexterm" name="id2562078"></a>
214
214
Because Samba will be operating over two network interfaces and clients on each side
215
215
may want to be able to reach clients on the other side, it is imperative that IP forwarding
216
216
is enabled. Use the system tool of your choice to enable IP forwarding. In the
233
233
Retype new SMB password: XXXXXXX
234
234
<code class="prompt">root# </code>
236
<a class="indexterm" name="id2556109"></a>
236
<a class="indexterm" name="id2562166"></a>
237
237
This is the Windows Domain Administrator password. Never delete this account from
238
238
the password backend after Windows Domain Groups have been initialized. If you delete
239
239
this account, your system is crippled. You cannot restore this account,
240
240
and your Samba server can no longer be administered.
242
<a class="indexterm" name="id2556126"></a>
241
</p></li><li class="step" title="Step 8"><p>
242
<a class="indexterm" name="id2562184"></a>
243
243
Create the username map file to permit the <code class="constant">root</code> account to be called
244
244
<code class="constant">Administrator</code> from the Windows network environment. To do this, create
245
245
the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
321
321
System Operators (S-1-5-32-549) -> -1
322
322
Users (S-1-5-32-545) -> -1
325
<a class="indexterm" name="id2556273"></a>
326
<a class="indexterm" name="id2556280"></a>
327
<a class="indexterm" name="id2556288"></a>
324
</p></li><li class="step" title="Step 10"><p>
325
<a class="indexterm" name="id2562330"></a>
326
<a class="indexterm" name="id2562337"></a>
327
<a class="indexterm" name="id2562345"></a>
328
328
For each user who needs to be given a Windows Domain account, make an entry in the
329
329
<code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
330
330
Use the system tool of your choice to create the UNIX system accounts, and use the Samba
331
331
<code class="literal">smbpasswd</code> program to create the Domain user accounts.
333
<a class="indexterm" name="id2556313"></a>
334
<a class="indexterm" name="id2556319"></a>
335
<a class="indexterm" name="id2556325"></a>
333
<a class="indexterm" name="id2562370"></a>
334
<a class="indexterm" name="id2562376"></a>
335
<a class="indexterm" name="id2562382"></a>
336
336
There are a number of tools for user management under UNIX, such as
337
337
<code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom
338
338
tools. With the tool of your choice, create a home directory for each user.
339
</p></li><li class="step" title="Step 11"><p>
340
340
Using the preferred tool for your UNIX system, add each user to the UNIX groups created
341
341
previously, as necessary. File system access control will be based on UNIX group membership.
342
</p></li><li class="step" title="Step 12"><p>
343
343
Create the directory mount point for the disk subsystem that is mounted to provide
344
344
data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code>
345
345
file is <code class="filename">/data</code>. Format the file system as required, mount the formatted
346
346
file system partition using <code class="literal">mount</code>,
347
347
and make the appropriate changes in <code class="filename">/etc/fstab</code>.
348
</p></li><li class="step" title="Step 13"><p>
349
349
Create the top-level file storage directories are follows:
350
350
</p><pre class="screen">
351
351
<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs}
357
357
Each department is responsible for creating its own directory structure within its
358
358
share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>.
359
359
The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>.
360
</p></li><li class="step" title="Step 14"><p>
361
361
Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
362
362
Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
363
363
This allows the CUPS spooler to print using raw mode protocols.
364
<a class="indexterm" name="id2556469"></a>
365
<a class="indexterm" name="id2556475"></a>
367
<a class="indexterm" name="id2556488"></a>
368
<a class="indexterm" name="id2556496"></a>
364
<a class="indexterm" name="id2562526"></a>
365
<a class="indexterm" name="id2562532"></a>
366
</p></li><li class="step" title="Step 15"><p>
367
<a class="indexterm" name="id2562545"></a>
368
<a class="indexterm" name="id2562553"></a>
369
369
Configure the CUPS Print Queues as follows:
370
370
</p><pre class="screen">
371
371
<code class="prompt">root# </code> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
372
372
<code class="prompt">root# </code> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
373
373
<code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E
375
<a class="indexterm" name="id2556527"></a>
375
<a class="indexterm" name="id2562584"></a>
376
376
This creates the necessary print queues with no assigned print filter.
378
<a class="indexterm" name="id2556541"></a>
379
<a class="indexterm" name="id2556547"></a>
380
<a class="indexterm" name="id2556554"></a>
377
</p></li><li class="step" title="Step 16"><p>
378
<a class="indexterm" name="id2562598"></a>
379
<a class="indexterm" name="id2562604"></a>
380
<a class="indexterm" name="id2562611"></a>
381
381
Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line:
382
382
</p><pre class="screen">
383
383
application/octet-stream application/vnd.cups-raw 0 -
386
<a class="indexterm" name="id2556578"></a>
385
</p></li><li class="step" title="Step 17"><p>
386
<a class="indexterm" name="id2562635"></a>
387
387
Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
388
388
</p><pre class="screen">
389
389
application/octet-stream
392
<a class="indexterm" name="id2556601"></a>
391
</p></li><li class="step" title="Step 18"><p>
392
<a class="indexterm" name="id2562658"></a>
393
393
Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the
394
394
contents as shown in <a class="link" href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>.
395
</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example�2.2.�Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id2556633"></a><pre class="screen">
395
</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example�2.2.�Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id2562690"></a><pre class="screen">
396
396
default-lease-time 86400;
397
397
max-lease-time 172800;
398
398
default-lease-time 86400;
436
436
subnet 127.0.0.0 netmask 255.0.0.0 {
438
438
</pre></div></div><p><br class="example-break">
439
</p></li><li class="step" title="Step 19"><p>
440
440
Use the standard system tool to start Samba and CUPS and configure them to start
441
441
automatically at every system reboot. For example,
443
<a class="indexterm" name="id2556677"></a>
444
<a class="indexterm" name="id2556683"></a>
445
<a class="indexterm" name="id2556690"></a>
446
<a class="indexterm" name="id2556696"></a>
447
<a class="indexterm" name="id2556702"></a>
443
<a class="indexterm" name="id2562734"></a>
444
<a class="indexterm" name="id2562740"></a>
445
<a class="indexterm" name="id2562747"></a>
446
<a class="indexterm" name="id2562753"></a>
447
<a class="indexterm" name="id2562759"></a>
448
448
</p><pre class="screen">
449
449
<code class="prompt">root# </code> chkconfig dhcp on
450
450
<code class="prompt">root# </code> chkconfig smb on
453
453
<code class="prompt">root# </code> /etc/rc.d/init.d/smb restart
454
454
<code class="prompt">root# </code> /etc/rc.d/init.d/cups restart
457
<a class="indexterm" name="id2556752"></a>
458
<a class="indexterm" name="id2556759"></a>
459
<a class="indexterm" name="id2556767"></a>
460
<a class="indexterm" name="id2556773"></a>
461
<a class="indexterm" name="id2556780"></a>
462
<a class="indexterm" name="id2556786"></a>
456
</p></li><li class="step" title="Step 20"><p>
457
<a class="indexterm" name="id2562810"></a>
458
<a class="indexterm" name="id2562816"></a>
459
<a class="indexterm" name="id2562824"></a>
460
<a class="indexterm" name="id2562830"></a>
461
<a class="indexterm" name="id2562837"></a>
462
<a class="indexterm" name="id2562843"></a>
463
463
Configure the name service switch (NSS) to handle WINS-based name resolution.
464
464
Since this system does not use a DNS server, it is safe to remove this option from
465
465
the NSS configuration. Edit the <code class="filename">/etc/nsswitch.conf</code> file so that
467
467
</p><pre class="screen">
468
468
hosts: files wins
470
</p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example�2.3.�Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556844"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2556854"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2556866"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2556876"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2556887"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2556898"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2556908"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556919"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556931"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556942"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556953"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556965"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556976"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556988"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2556999"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2557009"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2557020"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557030"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557041"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557051"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example�2.4.�Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557091"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557102"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557112"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557123"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557141"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2557152"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557162"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557173"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557183"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557193"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557212"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557223"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557234"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557244"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2557263"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557273"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2557284"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557294"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2557313"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557324"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2557334"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557345"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557356"></a>Validation</h3></div></div></div><p>
470
</p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example�2.3.�Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562901"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2562911"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2562923"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2562933"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2562944"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2562955"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2562965"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562976"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2562988"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2562999"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2563010"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2563022"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2563033"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2563045"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2563056"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2563066"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2563077"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563087"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563098"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563108"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example�2.4.�Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2563148"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2563159"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2563169"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2563180"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2563198"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2563209"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2563219"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563230"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563240"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563250"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2563269"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2563280"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2563291"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2563301"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2563320"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2563330"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2563341"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2563351"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2563370"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2563381"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2563391"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2563402"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id2563413"></a>Validation</h3></div></div></div><p>
471
471
Does everything function as it ought? That is the key question at this point.
472
472
Here are some simple steps to validate your Samba server configuration.
473
</p><div class="procedure"><a name="id2557368"></a><p class="title"><b>Procedure�2.2.�Validation Steps</b></p><ol type="1"><li><p>
474
<a class="indexterm" name="id2557378"></a>
473
</p><div class="procedure" title="Procedure�2.2.�Validation Steps"><a name="id2563425"></a><p class="title"><b>Procedure�2.2.�Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
474
<a class="indexterm" name="id2563435"></a>
475
475
If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba
476
476
to refuse to start. The first step should always be to validate the contents
477
477
of this file by running:
517
517
Ignoring unknown parameter "dogbert"
519
519
Clear away all errors before proceeding, and start or restart samba as necessary.
521
<a class="indexterm" name="id2557458"></a>
522
<a class="indexterm" name="id2557464"></a>
523
<a class="indexterm" name="id2557470"></a>
524
<a class="indexterm" name="id2557476"></a>
520
</p></li><li class="step" title="Step 2"><p>
521
<a class="indexterm" name="id2563515"></a>
522
<a class="indexterm" name="id2563521"></a>
523
<a class="indexterm" name="id2563527"></a>
524
<a class="indexterm" name="id2563533"></a>
525
525
Check that the Samba server is running:
526
526
</p><pre class="screen">
527
527
<code class="prompt">root# </code> ps ax | grep mbd
566
566
of browsing the server from a Windows client to obtain a list of shares on the server.
567
567
The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and
568
568
a <code class="constant">NULL</code> password.
570
<a class="indexterm" name="id2557578"></a>
571
<a class="indexterm" name="id2557584"></a>
572
<a class="indexterm" name="id2557590"></a>
569
</p></li><li class="step" title="Step 4"><p>
570
<a class="indexterm" name="id2563635"></a>
571
<a class="indexterm" name="id2563641"></a>
572
<a class="indexterm" name="id2563647"></a>
573
573
Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
574
574
The easiest way to do this is to ping the printer name. Immediately after the ping response
575
575
has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer
605
605
65387 blocks of size 65536. 28590 blocks available
608
</p></li></ol></div></div><div class="procedure"><a name="id2557699"></a><p class="title"><b>Procedure�2.3.�Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>
608
</p></li></ol></div></div><div class="procedure" title="Procedure�2.3.�Windows XP Professional Client Configuration"><a name="id2563756"></a><p class="title"><b>Procedure�2.3.�Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
609
609
Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
610
610
All clients use DHCP for TCP/IP protocol stack configuration.
611
<a class="indexterm" name="id2557717"></a>
612
<a class="indexterm" name="id2557723"></a>
611
<a class="indexterm" name="id2563774"></a>
612
<a class="indexterm" name="id2563780"></a>
613
613
DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>.
614
</p></li><li class="step" title="Step 2"><p>
615
615
Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator
616
616
username <code class="constant">root</code> and the SMB password you assigned to this account.
617
617
A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
618
618
a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter�15.�A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>.
619
619
Reboot the machine as prompted and then log on using a Domain User account.
620
</p></li><li class="step" title="Step 3"><p>
621
621
Verify on each client that the machine called <code class="constant">SLEETH</code>
622
622
is visible in <span class="guimenu">My Network Places</span>, that it is
623
623
possible to connect to it and see the shares <span class="guimenuitem">accounts</span>
624
624
and <span class="guimenuitem">finsvcs</span>,
625
625
and that it is possible to open that share to reveal its contents.
626
</p></li><li class="step" title="Step 4"><p>
627
627
Instruct all users to log onto the workstation using their assigned username and password.
628
</p></li><li class="step" title="Step 5"><p>
629
629
Install a printer on each using the following steps:
630
</p><div class="procedure"><ol type="1"><li><p>
630
</p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 5.1"><p>
631
631
Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
632
632
Ensure that <span class="guimenuitem">Local printer</span> is selected.
633
</p></li><li class="step" title="Step 5.2"><p>
634
634
Click <span class="guibutton">Next</span>. In the
635
635
<span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
636
636
In the <span class="guimenuitem">Printers:</span> panel, select the printer called
637
637
<code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>.
638
</p></li><li class="step" title="Step 5.3"><p>
639
639
In the <span class="guimenuitem">Available ports:</span> panel, select
640
640
<code class="constant">FILE:</code>. Accept the default printer name by clicking
641
<span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a
642
test page?</span>”, click <span class="guimenuitem">No</span>. Click
641
<span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a
642
test page?</span>”</span>, click <span class="guimenuitem">No</span>. Click
643
643
<span class="guibutton">Finish</span>.
644
</p></li><li class="step" title="Step 5.4"><p>
645
645
You may be prompted for the name of a file to print to. If so, close the
646
646
dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>.
647
</p></li><li class="step" title="Step 5.5"><p>
648
648
In the <span class="guimenuitem">Network</span> panel, enter the name of
649
649
the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>.
650
650
Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
651
</p></li><li class="step" title="Step 5.6"><p>
652
652
Repeat the printer installation steps above for the HP LaserJet 6 printer
653
653
as well as for the QMS Magicolor XXXX laser printer.
654
</p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558004"></a>Notebook Computers: A Special Case</h3></div></div></div><p>
654
</p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id2564061"></a>Notebook Computers: A Special Case</h3></div></div></div><p>
655
655
As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
656
656
Professional systems. This is the preferred solution to provide continuity of work for notebook users
657
657
so that absence from the office network environment does not become a barrier to productivity.
661
661
transparently access network resources as if logged onto the domain itself. There are some trade-offs
662
662
that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
663
663
configuration somewhat.
664
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558030"></a>Key Points Learned</h3></div></div></div><p>
664
</p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id2564087"></a>Key Points Learned</h3></div></div></div><p>
665
665
In this network design and implementation exercise, you created a Windows NT4-style Domain
666
666
Controller using Samba-3.0.20. Following these guidelines, you experienced
667
667
and implemented several important aspects of Windows networking. In the next chapter,
668
668
you build on the experience. These are the highlights from this chapter:
669
</p><div class="itemizedlist"><ul type="disc"><li><p>
670
<a class="indexterm" name="id2558050"></a>
669
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
670
<a class="indexterm" name="id2564107"></a>
671
671
You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
672
672
network configuration settings from this server.
674
<a class="indexterm" name="id2558063"></a>
673
</p></li><li class="listitem"><p>
674
<a class="indexterm" name="id2564120"></a>
675
675
You created a Windows Domain Controller. You were able to use the network logon service
676
676
and successfully joined Windows 200x/XP Professional clients to the Domain.
678
<a class="indexterm" name="id2558076"></a>
677
</p></li><li class="listitem"><p>
678
<a class="indexterm" name="id2564134"></a>
679
679
You created raw print queues in the CUPS printing system. You maintained a simple
680
680
printing system so that all users can share centrally managed printers. You installed
681
681
native printer drivers on the Windows clients.
682
</p></li><li class="listitem"><p>
683
683
You experienced the benefits of centrally managed user accounts on the server.
684
</p></li><li class="listitem"><p>
685
685
You offered Mobile notebook users a solution that allows them to continue to work
686
686
while away from the office and not connected to the corporate network.
687
</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558104"></a>Questions and Answers</h2></div></div></div><p>
687
</p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564161"></a>Questions and Answers</h2></div></div></div><p>
688
688
Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
690
</p><div class="qandaset"><dl><dt>1. <a href="small.html#id2558117">
690
</p><div class="qandaset" title="Frequently Asked Questions"><a name="id2564172"></a><dl><dt>1. <a href="small.html#id2564174">
691
691
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
692
</a></dt><dt>2. <a href="small.html#id2558144">
692
</a></dt><dt>2. <a href="small.html#id2564201">
693
693
Are there any DHCP server configuration parameters in the /etc/dhcpd.conf
694
694
that should be noted in particular?
695
</a></dt><dt>3. <a href="small.html#id2558175">
695
</a></dt><dt>3. <a href="small.html#id2564232">
696
696
Is it possible to create a Windows Domain account that is specifically called Administrator?
697
</a></dt><dt>4. <a href="small.html#id2558211">
697
</a></dt><dt>4. <a href="small.html#id2564268">
698
698
Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?
699
</a></dt><dt>5. <a href="small.html#id2558250">
699
</a></dt><dt>5. <a href="small.html#id2564307">
700
700
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
701
701
root access. How can we do this?
702
</a></dt><dt>6. <a href="small.html#id2558289">
702
</a></dt><dt>6. <a href="small.html#id2564346">
703
703
Why must I map Windows Domain Groups to UNIX groups?
704
</a></dt><dt>7. <a href="small.html#id2558325">
704
</a></dt><dt>7. <a href="small.html#id2564382">
705
705
I deleted my root account and now I cannot add it back! What can I do?
706
</a></dt><dt>8. <a href="small.html#id2558393">
706
</a></dt><dt>8. <a href="small.html#id2564450">
707
707
When I run net groupmap list, it reports a group called Administrators
708
708
as well as Domain Admins. What is the difference between them?
709
</a></dt><dt>9. <a href="small.html#id2558437">
709
</a></dt><dt>9. <a href="small.html#id2564494">
710
710
What is the effect of changing the name of a Samba server or of changing the Domain name?
711
</a></dt><dt>10. <a href="small.html#id2558487">
711
</a></dt><dt>10. <a href="small.html#id2564544">
712
712
How can I manage user accounts from my Windows XP Professional workstation?
713
</a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2558117"></a><a name="id2558119"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>
713
</a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id2564174"></a><a name="id2564176"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>
714
714
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
715
715
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
716
716
First and foremost, portability. It means that notebook users can move between
728
728
with the WINS server, and then instructs the client to first query the WINS server when a
729
729
NetBIOS machine name needs to be resolved to an IP Address. This configuration
730
730
results in far lower UDP broadcast traffic than would be the case if WINS was not used.
731
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558175"></a><a name="id2558177"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>
731
</p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id2564232"></a><a name="id2564234"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>
732
732
Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>?
733
733
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
734
734
You can surely create a Windows Domain account called <code class="constant">Administrator</code>. It is also
735
735
possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
736
736
necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX
737
737
account called <code class="constant">root</code>.
738
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558211"></a><a name="id2558213"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>
738
</p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id2564268"></a><a name="id2564270"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>
739
739
Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0?
740
740
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
741
741
The Windows Domain <code class="constant">Administrator</code> account is the most privileged account that
754
754
(or the equivalent <code class="constant">wheel</code> on some UNIX systems) that has a GID of 0.
755
755
This must be the primary GID of the account of the user who is a member of the Windows <code class="constant">
756
756
Domain Admins</code> account.
757
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558289"></a><a name="id2558291"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>
757
</p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id2564346"></a><a name="id2564348"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>
758
758
Why must I map Windows Domain Groups to UNIX groups?
759
759
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
760
760
Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
761
761
has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
762
762
<span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>.
763
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558325"></a><a name="id2558328"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>
763
</p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id2564382"></a><a name="id2564385"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>
764
764
I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do?
765
765
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
766
766
This is a nasty problem. Fortunately, there is a solution.
767
</p><div class="procedure"><ol type="1"><li><p>
767
</p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
768
768
Back up your existing configuration files in case you need to restore them.
769
</p></li><li class="step" title="Step 2"><p>
770
770
Rename the <code class="filename">group_mapping.tdb</code> file.
771
</p></li><li class="step" title="Step 3"><p>
772
772
Use the <code class="literal">smbpasswd</code> to add the root account.
773
</p></li><li class="step" title="Step 4"><p>
774
774
Restore the <code class="filename">group_mapping.tdb</code> file.
775
</p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558393"></a><a name="id2558395"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>
775
</p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id2564450"></a><a name="id2564452"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>
776
776
When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span>
777
777
as well as <span class="guimenu">Domain Admins</span>. What is the difference between them?
778
778
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
added
removed
docs/htmldocs/Samba3-ByExample/small.html
