7
7
context of the chapter that covers it. We hope that this chapter is the medicine
8
8
that has been requested.
10
The information in this chapter is very sparse compared with the book “<span class="quote">Samba-3 by Example</span>”
11
that was written after the original version of this book was nearly complete. “<span class="quote">Samba-3 by Example</span>”
10
The information in this chapter is very sparse compared with the book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>
11
that was written after the original version of this book was nearly complete. <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>
12
12
was the result of feedback from reviewers during the final copy editing of the first edition. It
13
13
was interesting to see that reader feedback mirrored that given by the original reviewers.
14
14
In any case, a month and a half was spent in doing basic research to better understand what
15
new as well as experienced network administrators would best benefit from. The book “<span class="quote">Samba-3 by Example</span>”
15
new as well as experienced network administrators would best benefit from. The book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>
16
16
is the result of that research. What is presented in the few pages of this book is covered
17
far more comprehensively in the second edition of “<span class="quote">Samba-3 by Example</span>”. The second edition
17
far more comprehensively in the second edition of <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>. The second edition
18
18
of both books will be released at the same time.
20
So in summary, the book “<span class="quote">The Official Samba-3 HOWTO & Reference Guide</span>” is intended
21
as the equivalent of an auto mechanic's repair guide. The book “<span class="quote">Samba-3 by Example</span>” is the
20
So in summary, the book <span class="quote">“<span class="quote">The Official Samba-3 HOWTO & Reference Guide</span>”</span> is intended
21
as the equivalent of an auto mechanic's repair guide. The book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span> is the
22
22
equivalent of the driver's guide that explains how to drive the car. If you want complete network
23
23
configuration examples, go to <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by
25
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554132"></a>Features and Benefits</h2></div></div></div><p>
25
</p><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2560189"></a>Features and Benefits</h2></div></div></div><p>
26
26
Samba needs very little configuration to create a basic working system.
27
27
In this chapter we progress from the simple to the complex, for each providing
28
28
all steps and configuration file changes needed to make each work. Please note
53
53
The later example consider more complex systems that will either integrate into existing MS Windows networks
54
54
or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and
55
55
finally describes in detail a large distributed network with branch offices in remote locations.
56
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554224"></a>Worked Examples</h2></div></div></div><p>
56
</p></div><div class="sect1" title="Worked Examples"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2560282"></a>Worked Examples</h2></div></div></div><p>
57
57
The configuration examples are designed to cover everything necessary to get Samba
58
58
running. They do not cover basic operating system platform configuration, which is
59
59
clearly beyond the scope of this text.
61
61
It is also assumed that Samba has been correctly installed, either by way of installation
62
62
of the packages that are provided by the operating system vendor or through other means.
63
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2554243"></a>Standalone Server</h3></div></div></div><p>
64
<a class="indexterm" name="id2554250"></a>
63
</p><div class="sect2" title="Standalone Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2560300"></a>Standalone Server</h3></div></div></div><p>
64
<a class="indexterm" name="id2560308"></a>
65
65
A standalone server implies no more than the fact that it is not a domain controller
66
66
and it does not participate in domain control. It can be a simple, workgroup-like
67
67
server, or it can be a complex server that is a member of a domain security context.
69
69
As the examples are developed, every attempt is made to progress the system toward greater capability, just as
70
70
one might expect would happen in a real business office as that office grows in size and its needs change.
71
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p>
72
<a class="indexterm" name="id2554282"></a>
71
</p><div class="sect3" title="Anonymous Read-Only Document Server"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p>
72
<a class="indexterm" name="id2560339"></a>
73
73
The purpose of this type of server is to make available to any user
74
74
any documents or files that are placed on the shared resource. The
75
75
shared resource could be a CD-ROM drive, a CD-ROM image, or a file
77
</p><div class="itemizedlist"><ul type="disc"><li><p>
77
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
78
78
The file system share point will be <code class="filename">/export</code>.
79
</p></li><li class="listitem"><p>
80
80
All files will be owned by a user called Jack Baumbach.
81
81
Jack's login name will be <span class="emphasis"><em>jackb</em></span>. His password will be
82
82
<span class="emphasis"><em>m0r3pa1n</em></span> of course, that's just the example we are
83
83
using; do not use this in a production environment because
84
84
all readers of this document will know it.
85
</p></li></ul></div><div class="procedure"><a name="id2554326"></a><p class="title"><b>Procedure�2.1.�Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example�2.1.�Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554452"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554462"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2554472"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2554491"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2554502"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2554512"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554522"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
85
</p></li></ul></div><div class="procedure" title="Procedure�2.1.�Installation Procedure: Read-Only Server"><a name="id2560383"></a><p class="title"><b>Procedure�2.1.�Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example�2.1.�Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560509"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2560519"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2560530"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2560548"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2560559"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2560569"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560580"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
86
86
Add user to system (with creation of the user's home directory):
87
87
</p><pre class="screen">
88
88
<code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
90
</p></li><li class="step" title="Step 2"><p>
91
91
Create directory, and set permissions and ownership:
92
92
</p><pre class="screen">
93
93
<code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
94
94
<code class="prompt">root# </code><strong class="userinput"><code>chmod u+rwx,g+rx,o+rx /export</code></strong>
95
95
<code class="prompt">root# </code><strong class="userinput"><code>chown jackb.users /export</code></strong>
97
</p></li><li class="step" title="Step 3"><p>
98
98
Copy the files that should be shared to the <code class="filename">/export</code>
100
</p></li><li class="step" title="Step 4"><p>
101
101
Install the Samba configuration file (<code class="filename">/etc/samba/smb.conf</code>)
102
102
as shown in <a class="link" href="FastStart.html#anon-example" title="Example�2.1.�Anonymous Read-Only Server Configuration">Anonymous Read-Only Server Configuration</a>.
103
</p></li><li class="step" title="Step 5"><p>
104
104
Test the configuration file by executing the following command:
105
105
</p><pre class="screen">
106
106
<code class="prompt">root# </code><strong class="userinput"><code>testparm</code></strong>
139
</p></li><li class="step" title="Step 6"><p>
140
140
Start Samba using the method applicable to your operating system platform. The method that
141
141
should be used is platform dependent. Refer to <a class="link" href="compiling.html#startingSamba" title="Starting the smbd nmbd and winbindd">Starting Samba</a>
142
142
for further information regarding the starting of Samba.
143
</p></li><li class="step" title="Step 7"><p>
144
144
Configure your MS Windows client for workgroup <span class="emphasis"><em>MIDEARTH</em></span>,
145
145
set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
146
146
then open Windows Explorer and visit the Network Neighborhood.
151
151
</p></li></ol></div><p>
152
152
The information above (following # Global parameters) provides the complete
153
153
contents of the <code class="filename">/etc/samba/smb.conf</code> file.
154
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2554659"></a>Anonymous Read-Write Document Server</h4></div></div></div><p>
155
<a class="indexterm" name="id2554667"></a>
154
</p></div><div class="sect3" title="Anonymous Read-Write Document Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2560716"></a>Anonymous Read-Write Document Server</h4></div></div></div><p>
155
<a class="indexterm" name="id2560724"></a>
156
156
We should view this configuration as a progression from the previous example.
157
157
The difference is that shared access is now forced to the user identity of jackb
158
158
and to the primary group jackb belongs to. One other refinement we can make is to
169
169
instead of to <span class="emphasis"><em>User Unknown</em></span>.
171
171
The complete, modified <code class="filename">smb.conf</code> file is as shown in <a class="link" href="FastStart.html#anon-rw" title="Example�2.2.�Modified Anonymous Read-Write smb.conf">“Modified Anonymous Read-Write smb.conf”</a>.
172
</p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example�2.2.�Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554766"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554777"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2554787"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2554806"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2554816"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2554827"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id2554837"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2554848"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554858"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2554870"></a>Anonymous Print Server</h4></div></div></div><p>
173
<a class="indexterm" name="id2554878"></a>
172
</p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example�2.2.�Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560824"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2560834"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2560844"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2560863"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2560874"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2560884"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id2560894"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2560905"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560915"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" title="Anonymous Print Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2560928"></a>Anonymous Print Server</h4></div></div></div><p>
173
<a class="indexterm" name="id2560935"></a>
174
174
An anonymous print server serves two purposes:
175
</p><div class="itemizedlist"><ul type="disc"><li><p>
175
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
176
176
It allows printing to all printers from a single location.
177
</p></li><li class="listitem"><p>
178
178
It reduces network traffic congestion due to many users trying
179
179
to access a limited number of printers.
180
180
</p></li></ul></div><p>
187
187
In this configuration, it is undesirable to present the Add Printer Wizard, and we do
188
188
not want to have automatic driver download, so we disable it in the following
189
189
configuration. <a class="link" href="FastStart.html#anon-print" title="Example�2.3.�Anonymous Print Server smb.conf">“Anonymous Print Server smb.conf”</a> is the resulting <code class="filename">smb.conf</code> file.
190
</p><div class="example"><a name="anon-print"></a><p class="title"><b>Example�2.3.�Anonymous Print Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554955"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554965"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id2554975"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id2554986"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2554996"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555007"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2555018"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2555036"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2555047"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2555057"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555068"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555078"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555088"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>
190
</p><div class="example"><a name="anon-print"></a><p class="title"><b>Example�2.3.�Anonymous Print Server smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561012"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2561022"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id2561033"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id2561043"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561054"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561064"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561075"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561094"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2561104"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561115"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561125"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561135"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561146"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>
191
191
The above configuration is not ideal. It uses no smart features, and it deliberately
192
192
presents a less than elegant solution. But it is basic, and it does print. Samba makes
193
193
use of the direct printing application program interface that is provided by CUPS.
199
199
the parameter <em class="parameter"><code>printcap name</code></em> must be set to something other than
200
200
CUPS. In such case, it could be set to the name of any file that contains a list
201
201
of printers that should be made available to Windows clients.
202
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
202
</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
203
203
Windows users will need to install a local printer and then change the print
204
204
to device after installation of the drivers. The print to device can then be set to
205
205
the network printer on this machine.
207
207
Make sure that the directory <code class="filename">/var/spool/samba</code> is capable of being used
208
208
as intended. The following steps must be taken to achieve this:
209
</p><div class="itemizedlist"><ul type="disc"><li><p>
209
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
210
210
The directory must be owned by the superuser (root) user and group:
211
211
</p><pre class="screen">
212
212
<code class="prompt">root# </code><strong class="userinput"><code>chown root.root /var/spool/samba</code></strong>
214
</p></li><li class="listitem"><p>
215
215
Directory permissions should be set for public read-write with the
216
216
sticky bit set as shown:
217
217
</p><pre class="screen">
220
220
The purpose of setting the sticky bit is to prevent who does not own the temporary print file
221
221
from being able to take control of it with the potential for devious misuse.
222
</p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
223
<a class="indexterm" name="id2555198"></a>
224
<a class="indexterm" name="id2555207"></a>
222
</p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
223
<a class="indexterm" name="id2561256"></a>
224
<a class="indexterm" name="id2561264"></a>
225
225
On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
226
226
intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
227
227
it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
228
228
handler in the <code class="filename">/etc/mime.conv</code> and <code class="filename">/etc/mime.types</code>
229
files. Refer to <a class="link" href="CUPS-printing.html#cups-raw" title="Explicitly Enable raw Printing for application/octet-stream">“Explicitly Enable raw Printing for application/octet-stream”</a>.
230
</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2555235"></a>Secure Read-Write File and Print Server</h4></div></div></div><p>
229
files. Refer to <a class="link" href="CUPS-printing.html#cups-raw" title="Explicitly Enable “raw” Printing for application/octet-stream">“Explicitly Enable raw Printing for application/octet-stream”</a>.
230
</p></div></div><div class="sect3" title="Secure Read-Write File and Print Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2561292"></a>Secure Read-Write File and Print Server</h4></div></div></div><p>
231
231
We progress now from simple systems to a server that is slightly more complex.
233
233
Our new server will require a public data storage area in which only authenticated
250
250
it is not necessary to enter it into the configuration file. Note that the guest backend is
251
251
added to the list of active passdb backends no matter whether it specified directly in Samba configuration
253
</p><div class="procedure"><a name="id2555305"></a><p class="title"><b>Procedure�2.2.�Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example�2.4.�Secure Office Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2555400"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2555411"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id2555421"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2555431"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555442"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2555453"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2555472"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2555482"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2555492"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2555503"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2555522"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2555532"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2555542"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2555553"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2555563"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2555582"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2555592"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2555603"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2555613"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2555624"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555634"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555644"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555655"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
254
<a class="indexterm" name="id2555316"></a>
253
</p><div class="procedure" title="Procedure�2.2.�Installing the Secure Office Server"><a name="id2561362"></a><p class="title"><b>Procedure�2.2.�Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example�2.4.�Secure Office Server smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561458"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2561468"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id2561478"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561489"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561499"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561510"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2561529"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2561539"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2561550"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561560"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2561579"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2561589"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2561600"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561610"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2561621"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561639"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2561650"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561660"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561671"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2561681"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561691"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561702"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561712"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
254
<a class="indexterm" name="id2561373"></a>
255
255
Add all users to the operating system:
256
256
</p><pre class="screen">
257
257
<code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
258
258
<code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Mary Orville" -m -g users -p secret maryo</code></strong>
259
259
<code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Amed Sehkah" -m -g users -p secret ameds</code></strong>
261
</p></li><li class="step" title="Step 2"><p>
262
262
Configure the Samba <code class="filename">smb.conf</code> file as shown in <a class="link" href="FastStart.html#OfficeServer" title="Example�2.4.�Secure Office Server smb.conf">“Secure Office Server smb.conf”</a>.
263
</p></li><li class="step" title="Step 3"><p>
264
264
Initialize the Microsoft Windows password database with the new users:
265
265
</p><pre class="screen">
266
266
<code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a root</code></strong>
283
283
Reenter smb password: <strong class="userinput"><code>mysecret</code></strong>
284
284
Added user ameds.
286
</p></li><li class="step" title="Step 4"><p>
287
287
Install printer using the CUPS Web interface. Make certain that all
288
288
printers that will be shared with Microsoft Windows clients are installed
289
289
as raw printing devices.
290
</p></li><li class="step" title="Step 5"><p>
291
291
Start Samba using the operating system administrative interface.
292
292
Alternately, this can be done manually by executing:
293
<a class="indexterm" name="id2555775"></a>
294
<a class="indexterm" name="id2555781"></a>
295
<a class="indexterm" name="id2555788"></a>
296
<a class="indexterm" name="id2555796"></a>
293
<a class="indexterm" name="id2561832"></a>
294
<a class="indexterm" name="id2561839"></a>
295
<a class="indexterm" name="id2561845"></a>
296
<a class="indexterm" name="id2561853"></a>
297
297
</p><pre class="screen">
298
298
<code class="prompt">root# </code><strong class="userinput"><code> nmbd; smbd;</code></strong>
300
300
Both applications automatically execute as daemons. Those who are paranoid about
301
301
maintaining control can add the <code class="constant">-D</code> flag to coerce them to start
302
302
up in daemon mode.
303
</p></li><li class="step" title="Step 6"><p>
304
304
Configure the <code class="filename">/export</code> directory:
305
305
</p><pre class="screen">
306
306
<code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
307
307
<code class="prompt">root# </code><strong class="userinput"><code>chown maryo.users /export</code></strong>
308
308
<code class="prompt">root# </code><strong class="userinput"><code>chmod u=rwx,g=rwx,o-rwx /export</code></strong>
310
</p></li><li class="step" title="Step 7"><p>
311
311
Check that Samba is running correctly:
312
312
</p><pre class="screen">
313
313
<code class="prompt">root# </code><strong class="userinput"><code>smbclient -L localhost -U%</code></strong>
358
358
By now you should be getting the hang of configuration basics. Clearly, it is time to
359
359
explore slightly more complex examples. For the remainder of this chapter we abbreviate
360
360
instructions, since there are previous examples.
361
</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555984"></a>Domain Member Server</h3></div></div></div><p>
362
<a class="indexterm" name="id2555992"></a>
361
</p></div></div><div class="sect2" title="Domain Member Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2562042"></a>Domain Member Server</h3></div></div></div><p>
362
<a class="indexterm" name="id2562049"></a>
363
363
In this instance we consider the simplest server configuration we can get away with
364
364
to make an accounting department happy. Let's be warned, the users are accountants and they
365
365
do have some nasty demands. There is a budget for only one server for this department.
390
390
file area for each member of her team that is private to that person, but she wants full
391
391
access to all areas. Users must have a private home share for personal work-related files
392
392
and for materials not related to departmental operations.
393
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2556059"></a>Example Configuration</h4></div></div></div><p>
393
</p><div class="sect3" title="Example Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2562116"></a>Example Configuration</h4></div></div></div><p>
394
394
The server <span class="emphasis"><em>valinor</em></span> will be a member server of the company domain.
395
395
Accounting will have only a local server. User accounts will be on the domain controllers,
396
396
as will desktop profiles and all network policy files.
397
</p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example�2.5.�Member Server smb.conf (Globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556132"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2556143"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id2556153"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2556163"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2556174"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556184"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556195"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2556206"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2556216"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556227"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example�2.6.�Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2556260"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2556271"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2556281"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556292"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id2556310"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id2556322"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id2556332"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2556342"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2556353"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2556372"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2556382"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id2556392"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2556411"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2556422"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2556432"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2556442"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2556453"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556463"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556474"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556484"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
397
</p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example�2.5.�Member Server smb.conf (Globals)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562190"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2562200"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id2562210"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2562221"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2562231"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562242"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562253"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562263"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562273"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562284"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example�2.6.�Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2562318"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2562328"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2562339"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562349"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id2562368"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id2562379"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id2562389"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2562400"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2562410"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2562429"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2562439"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id2562450"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2562469"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2562479"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2562489"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2562500"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2562510"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562521"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562531"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562541"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
398
398
Do not add users to the UNIX/Linux server; all of this will run off the
400
</p></li><li class="step" title="Step 2"><p>
401
401
Configure <code class="filename">smb.conf</code> according to <a class="link" href="FastStart.html#fast-member-server" title="Example�2.5.�Member Server smb.conf (Globals)">Member server smb.conf
402
402
(globals)</a> and <a class="link" href="FastStart.html#fast-memberserver-shares" title="Example�2.6.�Member Server smb.conf (Shares and Services)">Member server smb.conf (shares
403
403
and services)</a>.
405
<a class="indexterm" name="id2556501"></a>
404
</p></li><li class="step" title="Step 3"><p>
405
<a class="indexterm" name="id2562558"></a>
406
406
Join the domain. Note: Do not start Samba until this step has been completed!
407
407
</p><pre class="screen">
408
408
<code class="prompt">root# </code><strong class="userinput"><code>net rpc join -Uroot%'bigsecret'</code></strong>
409
409
Joined domain MIDEARTH.
411
</p></li><li class="step" title="Step 4"><p>
412
412
Make absolutely certain that you disable (shut down) the <code class="literal">nscd</code>
413
413
daemon on any system on which <code class="literal">winbind</code> is configured to run.
414
</p></li><li class="step" title="Step 5"><p>
415
415
Start Samba following the normal method for your operating system platform.
416
416
If you wish to do this manually, execute as root:
417
<a class="indexterm" name="id2556553"></a>
418
<a class="indexterm" name="id2556559"></a>
419
<a class="indexterm" name="id2556566"></a>
420
<a class="indexterm" name="id2556572"></a>
421
<a class="indexterm" name="id2556580"></a>
422
<a class="indexterm" name="id2556589"></a>
417
<a class="indexterm" name="id2562610"></a>
418
<a class="indexterm" name="id2562617"></a>
419
<a class="indexterm" name="id2562623"></a>
420
<a class="indexterm" name="id2562629"></a>
421
<a class="indexterm" name="id2562638"></a>
422
<a class="indexterm" name="id2562646"></a>
423
423
</p><pre class="screen">
424
424
<code class="prompt">root# </code><strong class="userinput"><code>nmbd; smbd; winbindd;</code></strong>
426
</p></li><li class="step" title="Step 6"><p>
427
427
Configure the name service switch (NSS) control file on your system to resolve user and group names
428
428
via winbind. Edit the following lines in <code class="filename">/etc/nsswitch.conf</code>:
429
429
</p><pre class="programlisting">
480
480
<code class="prompt">root# </code><strong class="userinput"><code>chmod ug=rwxS,o=x /export/{spytfull,public}</code></strong>
481
481
<code class="prompt">root# </code><strong class="userinput"><code>chown maryo.Accounts /export/{spytfull,public}</code></strong>
483
</p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2556827"></a>Domain Controller</h3></div></div></div><p>
484
<a class="indexterm" name="id2556835"></a>
483
</p></li></ol></div></div></div><div class="sect2" title="Domain Controller"><div class="titlepage"><div><div><h3 class="title"><a name="id2562885"></a>Domain Controller</h3></div></div></div><p>
484
<a class="indexterm" name="id2562892"></a>
485
485
For the remainder of this chapter the focus is on the configuration of domain control.
486
486
The examples that follow are for two implementation strategies. Remember, our objective is
487
487
to create a simple but working solution. The remainder of this book should help to highlight
513
513
The tdbsam authentication backend provides no facility to replicate
514
514
the contents of the database, except by external means (i.e., there is no self-contained protocol
515
515
in Samba-3 for Security Account Manager database [SAM] replication).
516
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
516
</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
517
517
If you need more than one domain controller, do not use a tdbsam authentication backend.
518
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2556907"></a>Example: Engineering Office</h4></div></div></div><p>
518
</p></div><div class="sect3" title="Example: Engineering Office"><div class="titlepage"><div><div><h4 class="title"><a name="id2562964"></a>Example: Engineering Office</h4></div></div></div><p>
519
519
The engineering office network server we present here is designed to demonstrate use
520
520
of the new tdbsam password backend. The tdbsam
521
521
facility is new to Samba-3. It is designed to provide many user and machine account controls
522
522
that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
523
</p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example�2.7.�Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556977"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2556987"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2556997"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2557008"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2557018"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id2557029"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id2557041"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557052"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557063"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557075"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557087"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id2557107"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id2557123"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557134"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2557144"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557155"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557165"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2557176"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557186"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557196"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2557207"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2557217"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example�2.8.�Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557251"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557261"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557271"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557282"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557305"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2557315"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557326"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2557336"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2557346"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557357"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557367"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2557386"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2557397"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2557408"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id2557419"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557441"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557452"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2557463"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2557474"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557484"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td># shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2557512"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2557523"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2557534"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557544"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
523
</p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example�2.7.�Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2563034"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2563044"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2563055"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2563065"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2563076"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id2563087"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id2563098"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563109"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563120"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563132"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563144"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id2563165"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id2563180"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2563191"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2563202"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2563212"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563223"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2563233"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563243"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563254"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2563264"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2563275"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example�2.8.�Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2563308"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2563318"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2563329"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2563339"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2563362"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2563373"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2563383"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2563393"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2563404"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563414"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563425"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2563443"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2563454"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2563466"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id2563476"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2563499"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2563510"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2563521"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2563531"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563542"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td># shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2563569"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2563580"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2563591"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2563602"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
524
524
A working PDC configuration using the tdbsam
525
525
password backend can be found in <a class="link" href="FastStart.html#fast-engoffice-global" title="Example�2.7.�Engineering Office smb.conf (globals)">Engineering Office smb.conf
526
526
(globals)</a> together with <a class="link" href="FastStart.html#fast-engoffice-shares" title="Example�2.8.�Engineering Office smb.conf (shares and services)">Engineering Office smb.conf
527
527
(shares and services)</a>:
528
<a class="indexterm" name="id2556948"></a>
528
<a class="indexterm" name="id2563005"></a>
529
</p></li><li class="step" title="Step 2"><p>
530
530
Create UNIX group accounts as needed using a suitable operating system tool:
531
531
</p><pre class="screen">
532
532
<code class="prompt">root# </code><strong class="userinput"><code>groupadd ntadmins</code></strong>
534
534
<code class="prompt">root# </code><strong class="userinput"><code>groupadd engineers</code></strong>
535
535
<code class="prompt">root# </code><strong class="userinput"><code>groupadd qateam</code></strong>
537
</p></li><li class="step" title="Step 3"><p>
538
538
Create user accounts on the system using the appropriate tool
539
539
provided with the operating system. Make sure all user home directories
540
540
are created also. Add users to groups as required for access control
541
541
on files, directories, printers, and as required for use in the Samba
544
<a class="indexterm" name="id2557627"></a>
545
<a class="indexterm" name="id2557635"></a>
543
</p></li><li class="step" title="Step 4"><p>
544
<a class="indexterm" name="id2563684"></a>
545
<a class="indexterm" name="id2563693"></a>
546
546
Assign each of the UNIX groups to NT groups by executing this shell script
547
547
(You could name the script <code class="filename">initGroups.sh</code>):
548
548
</p><pre class="screen">
570
570
</p></li></ol></div><p>
571
571
The above configuration provides a functional PDC
572
572
system to which must be added file shares and printers as required.
573
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2557706"></a>A Big Organization</h4></div></div></div><p>
573
</p></div><div class="sect3" title="A Big Organization"><div class="titlepage"><div><div><h4 class="title"><a name="id2563764"></a>A Big Organization</h4></div></div></div><p>
574
574
In this section we finally get to review in brief a Samba-3 configuration that
575
575
uses a Lightweight Directory Access (LDAP)-based authentication backend. The
576
576
main reasons for this choice are to provide the ability to host primary
577
577
and Backup Domain Control (BDC), as well as to enable a higher degree of
578
578
scalability to meet the needs of a very distributed environment.
579
</p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2557721"></a>The Primary Domain Controller</h5></div></div></div><p>
579
</p><div class="sect4" title="The Primary Domain Controller"><div class="titlepage"><div><div><h5 class="title"><a name="id2563779"></a>The Primary Domain Controller</h5></div></div></div><p>
580
580
This is an example of a minimal configuration to run a Samba-3 PDC
581
581
using an LDAP authentication backend. It is assumed that the operating system
582
582
has been correctly configured.
587
587
distributions tend to install the Idealx scripts in the
588
588
<code class="filename">/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</code> directory.
589
589
Idealx scripts version <code class="constant">smbldap-tools-0.9.1</code> are known to work well.
590
</p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example�2.9.�LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2557948"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2557958"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2557969"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2557980"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2557991"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2558001"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2558013"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id2558024"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558036"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558047"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558059"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558072"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2558083"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2558095"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2558106"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558117"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2558127"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558138"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558148"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2558159"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558169"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558179"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558190"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558202"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558213"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558224"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558235"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558246"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2558256"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558267"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558277"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558288"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
590
</p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example�2.9.�LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2564005"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2564016"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2564026"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2564037"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2564048"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2564059"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564070"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id2564082"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564093"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564105"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564116"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564129"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564141"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564152"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2564163"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564174"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2564185"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564195"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564206"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2564216"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564226"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564237"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564248"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564259"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564270"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564281"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564292"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564303"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2564314"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564324"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564334"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564345"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
591
591
Obtain from the Samba sources <code class="filename">~/examples/LDAP/samba.schema</code>
592
592
and copy it to the <code class="filename">/etc/openldap/schema/</code> directory.
593
</p></li><li class="step" title="Step 2"><p>
594
594
Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
595
595
The <code class="filename">/etc/openldap/slapd.conf</code> file.
596
<a class="indexterm" name="id2557790"></a>
596
<a class="indexterm" name="id2563848"></a>
597
597
<span style="color: red"><title>Example slapd.conf File</title></span>
598
598
</p><pre class="screen">
599
599
# Note commented out lines have been removed
660
660
userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
661
661
# The password for above is 'mordonL8'
663
</p></li><li class="step" title="Step 4"><p>
664
664
Load the initial data above into the LDAP database:
665
665
</p><pre class="screen">
666
666
<code class="prompt">root# </code><strong class="userinput"><code>slapadd -v -l initdb.ldif</code></strong>
668
</p></li><li class="step" title="Step 5"><p>
669
669
Start the LDAP server using the appropriate tool or method for
670
670
the operating system platform on which it is installed.
671
</p></li><li class="step" title="Step 6"><p>
672
672
Install the Idealx script files in the <code class="filename">/usr/local/sbin</code> directory,
673
673
then configure the smbldap_conf.pm file to match your system configuration.
674
</p></li><li class="step" title="Step 7"><p>
675
675
The <code class="filename">smb.conf</code> file that drives this backend can be found in example <a class="link" href="FastStart.html#fast-ldap" title="Example�2.9.�LDAP backend smb.conf for PDC">LDAP backend smb.conf for PDC</a>. Add additional stanzas
677
</p></li><li class="step" title="Step 8"><p>
678
678
Add the LDAP password to the <code class="filename">secrets.tdb</code> file so Samba can update
679
679
the LDAP database:
680
680
</p><pre class="screen">
681
681
<code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -w mordonL8</code></strong>
683
</p></li><li class="step" title="Step 9"><p>
684
684
Add users and groups as required. Users and groups added using Samba tools
685
685
will automatically be added to both the LDAP backend and the operating
686
686
system as required.
687
</p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2558338"></a>Backup Domain Controller</h5></div></div></div><p>
687
</p></li></ol></div></div><div class="sect4" title="Backup Domain Controller"><div class="titlepage"><div><div><h5 class="title"><a name="id2564396"></a>Backup Domain Controller</h5></div></div></div><p>
688
688
<a class="link" href="FastStart.html#fast-bdc" title="Example�2.10.�Remote LDAP BDC smb.conf">“Remote LDAP BDC smb.conf”</a> shows the example configuration for the BDC. Note that
689
689
the <code class="filename">smb.conf</code> file does not specify the smbldap-tools scripts they are
690
690
not needed on a BDC. Add additional stanzas for shares and printers as required.
691
</p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example�2.10.�Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2558410"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2558420"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2558430"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2558442"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2558452"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2558463"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2558474"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558485"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2558495"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558506"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558516"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id2558526"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558537"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2558547"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558558"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558569"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558580"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558591"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558602"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558614"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2558624"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558634"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558645"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558655"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
691
</p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example�2.10.�Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2564467"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2564477"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2564488"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2564499"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2564510"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2564520"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2564531"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564542"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2564552"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564563"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564573"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id2564584"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564594"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2564604"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564616"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564627"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564638"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564649"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564660"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564671"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2564681"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564692"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564702"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564713"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
692
692
Decide if the BDC should have its own LDAP server or not. If the BDC is to be
693
693
the LDAP server, change the following <code class="filename">smb.conf</code> as indicated. The default
694
694
configuration in <a class="link" href="FastStart.html#fast-bdc" title="Example�2.10.�Remote LDAP BDC smb.conf">Remote LDAP BDC smb.conf</a>
695
695
uses a central LDAP server.
696
</p></li><li class="step" title="Step 2"><p>
697
697
Configure the NETLOGON and PROFILES directory as for the PDC in <a class="link" href="FastStart.html#fast-bdc" title="Example�2.10.�Remote LDAP BDC smb.conf">“Remote LDAP BDC smb.conf”</a>.
698
698
</p></li></ol></div></div></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="install.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="introduction.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="type.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�1.�How to Install and Test SAMBA�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Part�II.�Server Configuration Basics</td></tr></table></div></body></html>
added
removed
docs/htmldocs/Samba3-HOWTO/FastStart.html
