1
<?xml version="1.0" encoding="iso-8859-1"?>
2
<!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
4
<chapter id="appendix">
5
<title>A Collection of Useful Tidbits</title>
8
<indexterm><primary>material</primary></indexterm>
9
<indexterm><primary>domain</primary><secondary>joining</secondary></indexterm>
10
Information presented here is considered to be either basic or well-known material that is informative
11
yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that
12
the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps
13
different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical,
14
as shown in the example given below.
18
<title>Joining a Domain: Windows 200x/XP Professional</title>
21
<indexterm><primary>joining a domain</primary></indexterm>
22
Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security.
23
This section steps through the process for making a Windows 200x/XP Professional machine a
24
member of a Domain Security environment. It should be noted that this process is identical
25
when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC.
29
<title>Steps to Join a Domain</title>
32
Click <guimenu>Start</guimenu>.
36
Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>.
40
The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel.
41
See <link linkend="swxpp001"></link>.
42
<figure id="swxpp001"><imagefile>wxpp001</imagefile><title>The General Panel.</title></figure>
46
Click the <guimenu>Computer Name</guimenu> tab.
47
This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>,
48
and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>.
52
Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
53
Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
54
See <link linkend="swxpp004"></link>.
55
<figure id="swxpp004"><imagefile>wxpp004</imagefile><title>The Computer Name Panel.</title></figure>
59
Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP.
60
We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>.
61
<figure id="swxpp006"><imagefile>wxpp006</imagefile><title>The Computer Name Changes Panel</title></figure>
65
Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button.
69
This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>.
70
<figure id="swxpp007"><imagefile>wxpp007</imagefile><title>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</title></figure>
74
Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password)
75
of a domain administrative account that has the rights to add machines to the domain.
79
Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
80
<figure id="swxpp008"><imagefile>wxpp008</imagefile><title>Computer Name Changes &smbmdash; User name and Password Panel</title></figure>
84
Click <guimenu>OK</guimenu>.
88
The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted.
89
Joining the domain is now complete.
95
<indexterm><primary>Active Directory</primary></indexterm>
96
<indexterm><primary>DNS</primary></indexterm>
97
The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a
98
panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members
99
of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.
103
<indexterm><primary>Netlogon</primary></indexterm>
104
<indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm>
105
Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers
106
register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server
107
to find the services (like which machines are domain controllers or which machines have the Netlogon service running).
111
<indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm>
112
The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix,
113
this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to
118
The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain.
119
Where the client is a member of a Samba domain, it is preferable to leave this field blank.
123
<indexterm><primary>Group Policy</primary></indexterm>
124
According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant>
125
enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used
126
as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is
127
used only if Group Policy is disabled or unspecified.</quote>
133
<title>Samba System File Location</title>
136
<primary>default installation</primary>
137
</indexterm><indexterm>
138
<primary>/usr/local/samba</primary>
139
</indexterm><indexterm>
140
<primary>/usr/local</primary>
142
One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team
143
build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is
144
in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other
145
Open Source software that installs into the <filename>/usr/local</filename> subdirectories.
149
Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team
154
<primary>Free Standards Group</primary>
156
</indexterm><indexterm>
157
<primary>FSG</primary>
158
</indexterm><indexterm>
159
<primary>Linux Standards Base</primary>
161
</indexterm><indexterm>
162
<primary>LSB</primary>
163
</indexterm><indexterm>
164
<primary>File Hierarchy System</primary>
166
</indexterm><indexterm>
167
<primary>FHS</primary>
168
</indexterm><indexterm>
169
<primary>file locations</primary>
170
</indexterm><indexterm>
171
<primary>/etc/samba</primary>
172
</indexterm><indexterm>
173
<primary>/usr/sbin</primary>
174
</indexterm><indexterm>
175
<primary>/usr/bin</primary>
176
</indexterm><indexterm>
177
<primary>/usr/share</primary>
178
</indexterm><indexterm>
179
<primary>/usr/share/swat</primary>
180
</indexterm><indexterm>
181
<primary>/usr/lib/samba</primary>
182
</indexterm><indexterm>
183
<primary>/usr/share/samba/swat</primary>
184
</indexterm><indexterm>
185
<primary>SWAT</primary>
186
</indexterm><indexterm>
187
<primary>VFS modules</primary>
189
Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy
190
System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary
191
files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the
192
<filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the
193
<filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in
194
<filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the
195
<filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the
196
passdb backend as well as for the VFS modules.
200
<primary>/var/lib/samba</primary>
201
</indexterm><indexterm>
202
<primary>/var/log/samba</primary>
203
</indexterm><indexterm>
204
<primary>run-time control files</primary>
206
Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in
207
the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename>
211
When Samba is built and installed using the default Samba Team process, all files are located under the
212
<filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns.
216
<primary>smbd</primary>
217
<secondary>location of files</secondary>
219
One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location
220
of all files called <command>smbd</command>. Here is an example:
222
&rootprompt; find / -name smbd -print
224
You can find the location of the configuration files by running:
226
&rootprompt; /path-to-binary-file/smbd -b | more
231
SWATDIR: /usr/share/samba/swat
232
CONFIGFILE: /etc/samba/smb.conf
233
LOGFILEBASE: /var/log/samba
234
LMHOSTSFILE: /etc/samba/lmhosts
235
LIBDIR: /usr/lib/samba
237
LOCKDIR: /var/lib/samba
238
PIDDIR: /var/run/samba
239
SMB_PASSWD_FILE: /etc/samba/smbpasswd
240
PRIVATE_DIR: /etc/samba
243
If you wish to locate the Samba version, just run:
245
&rootprompt; /path-to-binary-file/smbd -V
251
Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
252
by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
253
executing:<indexterm>
254
<primary>rpm</primary>
257
&rootprompt; rpm -qa | grep samba
260
samba3-winbind-3.0.20-1
262
samba3-python-3.0.20-1
263
samba3-utils-3.0.20-1
265
samba3-client-3.0.20-1
266
samba3-cifsmount-3.0.20-1
268
<primary>package names</primary>
270
The package names, of course, vary according to how the vendor, or the binary package builder, prepared them.
276
<title>Starting Samba</title>
279
<primary>daemon</primary>
281
Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
282
An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there
283
are three daemons, two of which are needed as a minimum.
287
The Samba server is made up of the following daemons:
290
<example id="ch12SL">
291
<title>A Useful Samba Control Script for SUSE Linux</title>
295
# Script to start/stop samba
296
# Locate this in /sbin as a file called 'samba'
300
if [ z$1 == 'z' ]; then
301
echo $0 - No arguments given; must be start or stop.
305
if [ $1 == 'start' ]; then
311
if [ $1 == 'stop' ]; then
316
if [ $1 == 'restart' ]; then
330
<varlistentry><term>nmbd</term>
332
<indexterm><primary>smbd</primary></indexterm>
333
<indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
334
This daemon handles all name registration and resolution requests. It is the primary vehicle involved
335
in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
336
be the first command started as part of the Samba startup process.
340
<varlistentry><term>smbd</term>
342
<indexterm><primary>nmbd</primary></indexterm>
343
<indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
344
This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
345
manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
349
<varlistentry><term>winbindd</term>
351
<indexterm><primary>winbindd</primary></indexterm>
352
<indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
353
This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
354
Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
355
&smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
356
parameters. If they are not found, <command>winbindd</command> bails out and refuses to start.
362
When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
363
integration into the platform as a whole. Please refer to your operating system platform administration manuals for
364
specific information pertaining to correct management of Samba startup.
367
<example id="ch12RHscript">
368
<title>A Sample Samba Control Script for Red Hat Linux</title>
372
# chkconfig: 345 81 35
373
# description: Starts and stops the Samba smbd and nmbd daemons \
374
# used to provide SMB network services.
376
# Source function library.
377
. /etc/rc.d/init.d/functions
378
# Source networking configuration.
379
. /etc/sysconfig/network
380
# Check that networking is up.
381
[ ${NETWORKING} = "no" ] && exit 0
382
CONFIG=/etc/samba/smb.conf
383
# Check that smb.conf exists.
384
[ -f $CONFIG ] || exit 0
386
# See how we were called.
389
echo -n "Starting SMB services: "
390
daemon smbd -D; daemon nmbd -D; echo;
391
touch /var/lock/subsys/smb
394
echo -n "Shutting down SMB services: "
395
smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
396
for pid in $smbdpids; do
399
killproc nmbd -TERM; rm -f /var/lock/subsys/smb
403
status smbd; status nmbd;
406
echo -n "Restarting SMB services: "
411
echo "Usage: smb {start|stop|restart|status}"
418
<primary>samba control script</primary>
420
SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently
421
executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory
422
<filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be
423
owned by user root and group root, and set so that only root can execute it.
427
<primary>startup script</primary>
429
A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>.
430
This file could be located in the directory <filename>/etc/rc.d</filename> and can be called
431
<filename>samba</filename>. A similar startup script is required to control <command>winbind</command>.
432
If you want to find more information regarding startup scripts please refer to the packaging section of
433
the Samba source code distribution tarball. The packaging files for each platform include a
434
startup control file.
440
<title>DNS Configuration Files</title>
443
The following files are common to all DNS server configurations. Rather than repeat them multiple times, they
444
are presented here for general reference.
448
<title>The Forward Zone File for the Loopback Adaptor</title>
451
The forward zone file for the loopback address never changes. An example file is shown
452
in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a
453
physical interface on the machine itself is routed to the loopback adaptor. This is
454
a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor
455
is called <constant>localhost</constant>.
458
<example id="loopback">
459
<title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title>
477
<title>The Reverse Zone File for the Loopback Adaptor</title>
480
The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/>
481
is necessary so that references to the address <constant>127.0.0.1</constant> can be
482
resolved to the correct name of the interface.
485
<example id="dnsloopy">
486
<title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title>
489
@ IN SOA localhost. root.localhost. (
501
<example id="roothint">
502
<title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title>
504
; This file is made available by InterNIC under anonymous FTP as
505
; file /domain/named.root
506
; on server FTP.INTERNIC.NET
507
; last update: Nov 5, 2002. Related version of root zone: 2002110501
508
; formerly NS.INTERNIC.NET
509
. 3600000 IN NS A.ROOT-SERVERS.NET.
510
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
511
; formerly NS1.ISI.EDU
512
. 3600000 NS B.ROOT-SERVERS.NET.
513
B.ROOT-SERVERS.NET. 3600000 A 128.9.0.107
515
. 3600000 NS C.ROOT-SERVERS.NET.
516
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
517
; formerly TERP.UMD.EDU
518
. 3600000 NS D.ROOT-SERVERS.NET.
519
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
520
; formerly NS.NASA.GOV
521
. 3600000 NS E.ROOT-SERVERS.NET.
522
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
523
; formerly NS.ISC.ORG
524
. 3600000 NS F.ROOT-SERVERS.NET.
525
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
526
; formerly NS.NIC.DDN.MIL
527
. 3600000 NS G.ROOT-SERVERS.NET.
528
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
529
; formerly AOS.ARL.ARMY.MIL
530
. 3600000 NS H.ROOT-SERVERS.NET.
531
H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
532
; formerly NIC.NORDU.NET
533
. 3600000 NS I.ROOT-SERVERS.NET.
534
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
535
; operated by VeriSign, Inc.
536
. 3600000 NS J.ROOT-SERVERS.NET.
537
J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
538
; housed in LINX, operated by RIPE NCC
539
. 3600000 NS K.ROOT-SERVERS.NET.
540
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
542
. 3600000 NS L.ROOT-SERVERS.NET.
543
L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
544
; housed in Japan, operated by WIDE
545
. 3600000 NS M.ROOT-SERVERS.NET.
546
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
553
<title>DNS Root Server Hint File</title>
556
The content of the root hints file as shown in <link linkend="roothint"/> changes slowly over time.
557
Periodically this file should be updated from the source shown. Because
558
of its size, this file is located at the end of this chapter.
565
<sect1 id="altldapcfg">
566
<title>Alternative LDAP Database Initialization</title>
569
<primary>LDAP</primary>
570
<secondary>database</secondary>
571
</indexterm><indexterm>
572
<primary>LDAP</primary>
573
<secondary>initial configuration</secondary>
575
The following procedure may be used as an alternative means of configuring
576
the initial LDAP database. Many administrators prefer to have greater control
577
over how system files get configured.
581
<title>Initialization of the LDAP Database</title>
584
<primary>LDIF</primary>
585
</indexterm><indexterm>
586
<primary>Domain Groups</primary>
587
<secondary>well-known</secondary>
588
</indexterm><indexterm>
589
<primary>SID</primary>
591
The first step to get the LDAP server ready for action is to create the LDIF file from
592
which the LDAP database will be preloaded. This is necessary to create the containers
593
into which the user, group, and other accounts are written. It is also necessary to
594
preload the well-known Windows NT Domain Groups, as they must have the correct SID so
595
that they can be recognized as special NT Groups by the MS Windows clients.
598
<procedure id="ldapinit">
599
<title>LDAP Directory Pre-Load Steps</title>
602
Create a directory in which to store the files you use to generate
603
the LDAP LDIF file for your system. Execute the following:
605
&rootprompt; mkdir /etc/openldap/SambaInit
606
&rootprompt; chown root:root /etc/openldap/SambaInit
607
&rootprompt; chmod 700 /etc/openldap/SambaInit
612
Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>,
613
and <link linkend="sbehap-ldapreconfc"/> into the directory
614
<filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are,
615
respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file.
619
Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory
620
<filename>/etc/openldap/SambaInit/.</filename> These two files are
621
parts A and B, respectively, of the <filename>init-ldif.pat</filename> file.
625
Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following:
627
&rootprompt; sh SMBLDAP-ldif-preconfig.sh
629
How do you wish to refer to your organization?
631
Black Tire Company, Inc.
633
How would you like your organization name to appear?
634
Your organization name is: My Organization
635
Enter a new name is this is not what you want, press Enter to Continue.
636
Name [My Organization]: Abmas Inc.
638
Samba Config File Location [/etc/samba/smb.conf]:
639
Enter a new full path or press Enter to continue.
640
Samba Config File Location [/etc/samba/smb.conf]:
641
Domain Name: MEGANET2
642
Domain SID: S-1-5-21-3504140859-1010554828-2431957765
644
The name of your Internet domain is now needed in a special format
645
as follows, if your domain name is mydomain.org, what we need is
646
the information in the form of:
649
If your fully qualified hostname is: snoopy.bazaar.garagesale.net
650
where "snoopy" is the name of the machine,
651
Then the information needed is:
652
Domain ID: garagesale
655
Found the following domain name: abmas.biz
656
I think the bit we are looking for might be: abmas
657
Enter the domain name or press Enter to continue:
659
The top level organization name I will use is: biz
660
Enter the top level org name or press Enter to continue:
663
This creates a file called <filename>MEGANET2.ldif</filename>.
667
It is now time to preload the LDAP database with the following
670
&rootprompt; slapadd -v -l MEGANET2.ldif
671
added: "dc=abmas,dc=biz" (00000001)
672
added: "cn=Manager,dc=abmas,dc=biz" (00000002)
673
added: "ou=People,dc=abmas,dc=biz" (00000003)
674
added: "ou=Computers,dc=abmas,dc=biz" (00000004)
675
added: "ou=Groups,dc=abmas,dc=biz" (00000005)
676
added: "ou=Domains,dc=abmas,dc=biz" (00000006)
677
added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007)
678
added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008)
679
added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009)
680
added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a)
682
You should verify that the account information was correctly loaded by executing:
686
objectClass: dcObject
687
objectClass: organization
690
description: Posix and Samba LDAP Identity Database
691
structuralObjectClass: organization
692
entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474
693
creatorsName: cn=manager,dc=abmas,dc=biz
694
modifiersName: cn=manager,dc=abmas,dc=biz
695
createTimestamp: 20031217055747Z
696
modifyTimestamp: 20031217055747Z
697
entryCSN: 2003121705:57:47Z#0x0001#0#0000
700
dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
701
objectClass: posixGroup
702
objectClass: sambaGroupMapping
705
sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
707
displayName: Domain Users
708
description: Domain Users
709
structuralObjectClass: posixGroup
710
entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474
711
creatorsName: cn=manager,dc=abmas,dc=biz
712
modifiersName: cn=manager,dc=abmas,dc=biz
713
createTimestamp: 20031217055747Z
714
modifyTimestamp: 20031217055747Z
715
entryCSN: 2003121705:57:47Z#0x000a#0#0000
720
Your LDAP database is ready for testing. You can now start the LDAP server
721
using the system tool for your Linux operating system. For SUSE Linux, you can
724
&rootprompt; rcldap start
729
It is now a good idea to validate that the LDAP server is running correctly.
730
Execute the following:
732
&rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
736
# base <dc=abmas,dc=biz> with scope sub
737
# filter: (ObjectClass=*)
743
objectClass: dcObject
744
objectClass: organization
747
description: Posix and Samba LDAP Identity Database
749
# domusers, Groups, abmas.biz
750
dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
751
objectClass: posixGroup
752
objectClass: sambaGroupMapping
755
sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
757
displayName: Domain Users
758
description: Domain Users
767
Your LDAP server is ready for creation of additional accounts.
773
<example id="sbehap-ldapreconfa">
774
<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title>
778
# This script prepares the ldif LDAP load file only
784
# The name of my organization
785
ORGNAME="My Organization"
787
# My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets"
788
INETDOMAIN="my-domain"
790
# In the above case, md domain is: buckets.org, TLDORG="org"
793
# This is the Samba Domain/Workgroup Name
794
DOMNAME="MYWORKGROUP"
802
How do you wish to refer to your organization?
805
Black Tire Company, Inc.
808
How would you like your organization name to appear?
812
echo "Your organization name is: $ORGNAME"
814
echo "Enter a new name or, press Enter to Continue."
819
<example id="sbehap-ldapreconfb">
820
<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title>
822
echo -e -n "Name [$ORGNAME]: "
825
if [ ! -z "$name" ]; then
829
sed "s/ORGNAME/${ORGNAME}/g" < $file > $file.tmp1
831
# Try to find smb.conf
833
if [ -e /usr/local/samba/lib/smb.conf ]; then
834
CONF=/usr/local/samba/lib/smb.conf
835
elif [ -e /etc/samba/smb.conf ]; then
836
CONF=/etc/samba/smb.conf
839
echo "Samba Config File Location [$CONF]: "
841
echo "Enter a new full path or press Enter to continue."
843
echo -n "Samba Config File Location [$CONF]: "
845
if [ ! -z "$name" ]; then
850
# Find the name of our Domain/Workgroup
851
DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=`
852
echo Domain Name: $DOMNAME
855
sed "s/DOMNAME/${DOMNAME}/g" < $file.tmp1 > $file.tmp2
857
DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"`
858
echo Domain SID: $DOMSID
860
sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1
864
<example id="sbehap-ldapreconfc">
865
<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title>
868
The name of your Internet domain is now needed in a special format
869
as follows, if your domain name is mydomain.org, what we need is
870
the information in the form of:
874
If your fully qualified hostname is: snoopy.bazaar.garagesale.net
875
where "snoopy" is the name of the machine,
876
Then the information needed is:
877
Domain ID: garagesale
881
INETDOMAIN=`hostname -d | cut -f1 -d.`
882
echo Found the following domain name: `hostname -d`
883
echo "I think the bit we are looking for might be: $INETDOMAIN"
885
echo -n "Enter the domain name or press Enter to continue: "
887
if [ ! -z $domnam ]; then
891
sed "s/INETDOMAIN/${INETDOMAIN}/g" < $file.tmp1 > $file.tmp2
892
TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"`
893
echo "The top level organization name I will use is: ${TLDORG}"
895
echo -n "Enter the top level org name or press Enter to continue: "
897
if [ ! -z $domnam ]; then
900
sed "s/TLDORG/${TLDORG}/g" < $file.tmp2 > $DOMNAME.ldif
906
<example id="sbehap-ldifpata">
907
<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title>
909
dn: dc=INETDOMAIN,dc=TLDORG
910
objectClass: dcObject
911
objectClass: organization
914
description: Posix and Samba LDAP Identity Database
916
dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG
917
objectClass: organizationalRole
919
description: Directory Manager
921
dn: ou=People,dc=INETDOMAIN,dc=TLDORG
923
objectClass: organizationalUnit
926
dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG
928
objectClass: organizationalUnit
931
dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG
933
objectClass: organizationalUnit
936
dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG
938
objectClass: organizationalUnit
941
dn: ou=Domains,dc=INETDOMAIN,dc=TLDORG
943
objectClass: organizationalUnit
946
dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG
947
objectClass: sambaDomain
948
sambaDomainName: DOMNAME
950
sambaAlgorithmicRidBase: 1000
951
structuralObjectClass: sambaDomain
955
<example id="sbehap-ldifpatb">
956
<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title>
958
dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG
959
objectClass: posixGroup
960
objectClass: sambaGroupMapping
965
displayName: Domain Admins
966
description: Domain Administrators
968
dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG
969
objectClass: posixGroup
970
objectClass: sambaGroupMapping
975
displayName: Domain Guests
976
description: Domain Guests Users
978
dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG
979
objectClass: posixGroup
980
objectClass: sambaGroupMapping
985
displayName: Domain Users
986
description: Domain Users
993
<title>The LDAP Account Manager</title>
996
<indexterm><primary>LAM</primary></indexterm>
997
<indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm>
998
<indexterm><primary>PHP</primary></indexterm>
999
<indexterm><primary>unencrypted</primary></indexterm>
1000
<indexterm><primary>SSL</primary></indexterm>
1001
<indexterm><primary>Posix</primary></indexterm>
1002
<indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm>
1003
The LDAP Account Manager (LAM) is an application suite that has been written in PHP.
1004
LAM can be used with any Web server that has PHP4 support. It connects to the LDAP
1005
server either using unencrypted connections or via SSL/TLS. LAM can be used to manage
1006
Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines
1011
LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink>
1012
home page and from its mirror sites. LAM has been released under the GNU GPL version 2.
1013
The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter
1018
<indexterm><primary>PHP4</primary></indexterm>
1019
<indexterm><primary>OpenLDAP</primary></indexterm>
1020
<indexterm><primary>Perl</primary></indexterm>
1025
<listitem><para>A web server that will work with PHP4.</para></listitem>
1026
<listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem>
1027
<listitem><para>OpenLDAP 2.0 or later.</para></listitem>
1028
<listitem><para>A Web browser that supports CSS.</para></listitem>
1029
<listitem><para>Perl.</para></listitem>
1030
<listitem><para>The gettext package.</para></listitem>
1031
<listitem><para>mcrypt + mhash (optional).</para></listitem>
1032
<listitem><para>It is also a good idea to install SSL support.</para></listitem>
1036
LAM is a useful tool that provides a simple Web-based device that can be used to
1037
manage the contents of the LDAP directory to:
1038
<indexterm><primary>organizational units</primary></indexterm>
1039
<indexterm><primary>operating profiles</primary></indexterm>
1040
<indexterm><primary>account policies</primary></indexterm>
1044
<listitem><para>Display user/group/host and Domain entries.</para></listitem>
1045
<listitem><para>Manage entries (Add/Delete/Edit).</para></listitem>
1046
<listitem><para>Filter and sort entries.</para></listitem>
1047
<listitem><para>Store and use multiple operating profiles.</para></listitem>
1048
<listitem><para>Edit organizational units (OUs).</para></listitem>
1049
<listitem><para>Upload accounts from a file.</para></listitem>
1050
<listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem>
1054
When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba
1055
user, group, and windows domain member machine accounts.
1059
<indexterm><primary>default password</primary></indexterm>
1060
<indexterm><primary>secure connections</primary></indexterm>
1061
<indexterm><primary>LAM</primary></indexterm>
1062
<indexterm><primary>SSL</primary></indexterm>
1063
The default password is <quote>lam.</quote> It is highly recommended that you use only
1064
an SSL connection to your Web server for all remote operations involving LAM. If you
1065
want secure connections, you must configure your Apache Web server to permit connections
1066
to LAM using only SSL.
1069
<procedure id="sbehap-laminst">
1070
<title>Apache Configuration Steps for LAM</title>
1073
Extract the LAM package by untarring it as shown here:
1075
&rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz
1077
Alternatively, install the LAM DEB for your system using the following command:
1079
&rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb
1084
Copy the extracted files to the document root directory of your Web server.
1085
For example, on SUSE Linux Enterprise Server 9, copy to the
1086
<filename>/srv/www/htdocs</filename> directory.
1090
<indexterm><primary>file permissions</primary></indexterm>
1091
Set file permissions using the following commands:
1093
&rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam
1094
&rootprompt; chmod 755 /srv/www/htdocs/lam/sess
1095
&rootprompt; chmod 755 /srv/www/htdocs/lam/tmp
1096
&rootprompt; chmod 755 /srv/www/htdocs/lam/config
1097
&rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl
1102
<indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm>
1103
Using your favorite editor create the following <filename>config.cfg</filename>
1104
LAM configuration file:
1106
&rootprompt; cd /srv/www/htdocs/lam/config
1107
&rootprompt; cp config.cfg_sample config.cfg
1108
&rootprompt; vi config.cfg
1110
<indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm>
1111
<indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm>
1112
An example file is shown in <link linkend="lamcfg"/>.
1113
This is the minimum configuration that must be completed. The LAM profile
1114
file can be created using a convenient wizard that is part of the LAM
1115
configuration suite.
1119
Start your Web server then, using your Web browser, connect to
1120
<ulink url="http://localhost/lam">LAM</ulink> URL. Click on the
1121
the <parameter>Configuration Login</parameter> link then click on the
1122
Configuration Wizard link to begin creation of the default profile so that
1123
LAM can connect to your LDAP server. Alternately, copy the
1124
<filename>lam.conf_sample</filename> file to a file called
1125
<filename>lam.conf</filename> then, using your favorite editor,
1126
change the settings to match local site needs.
1131
<indexterm><primary>pitfalls</primary></indexterm>
1132
An example of a working file is shown here in <link linkend="lamconf"/>.
1133
This file has been stripped of comments to keep the size small. The comments
1134
and help information provided in the profile file that the wizard creates
1135
is very useful and will help many administrators to avoid pitfalls.
1136
Your configuration file obviously reflects the configuration options that
1137
are preferred at your site.
1141
<indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm>
1142
It is important that your LDAP server is running at the time that LAM is
1143
being configured. This permits you to validate correct operation.
1144
An example of the LAM login screen is provided in <link linkend="lam-login"/>.
1147
<figure id="lam-login">
1148
<title>The LDAP Account Manager Login Screen</title>
1149
<imagefile scale="50">lam-login</imagefile>
1153
<indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm>
1154
The LAM configuration editor has a number of options that must be managed correctly.
1155
An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>.
1156
It is important that you correctly set the minimum and maximum UID/GID values that are
1157
permitted for use at your site. The default values may not be compatible with a need to
1158
modify initial default account values for well-known Windows network users and groups.
1159
The best work-around is to temporarily set the minimum values to zero (0) to permit
1160
the initial settings to be made. Do not forget to reset these to sensible values before
1161
using LAM to add additional users and groups.
1164
<figure id="lam-config">
1165
<title>The LDAP Account Manager Configuration Screen</title>
1166
<imagefile scale="50">lam-config</imagefile>
1170
<indexterm><primary>PDF</primary></indexterm>
1171
LAM has some nice, but unusual features. For example, one unexpected feature in most application
1172
screens permits the generation of a PDF file that lists configuration information. This is a well
1173
thought out facility. This option has been edited out of the following screen shots to conserve
1178
<indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm>
1179
When you log onto LAM the opening screen drops you right into the user manager as shown in
1180
<link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility
1181
to be used immediately. The editing of an existing user, as with the addition of a new user,
1182
is easy to follow and very clear in both layout and intent. It is a simple matter to edit
1183
generic settings, UNIX specific parameters, and then Samba account requirements. Each step
1184
involves clicking a button that intuitively drives you through the process. When you have
1185
finished editing simply press the <guimenu>Final</guimenu> button.
1188
<figure id="lam-user">
1189
<title>The LDAP Account Manager User Edit Screen</title>
1190
<imagefile scale="50">lam-users</imagefile>
1194
The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen
1195
for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/>
1196
shows a sub-screen from the group editor that permits users to be assigned secondary group
1200
<figure id="lam-group">
1201
<title>The LDAP Account Manager Group Edit Screen</title>
1202
<imagefile scale="50">lam-groups</imagefile>
1205
<figure id="lam-group-mem">
1206
<title>The LDAP Account Manager Group Membership Edit Screen</title>
1207
<imagefile scale="50">lam-group-members</imagefile>
1211
<indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm>
1212
The final screen presented here is one that you should not normally need to use. Host accounts will
1213
be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/>
1214
will, in most cases, not be used.
1217
<figure id="lam-host">
1218
<title>The LDAP Account Manager Host Edit Screen</title>
1219
<imagefile scale="50">lam-hosts</imagefile>
1223
One aspect of LAM that may annoy some users is the way it forces certain conventions on
1224
the administrator. For example, LAM does not permit the creation of Windows user and group
1225
accounts that contain spaces even though the underlying UNIX/Linux
1226
operating system may exhibit no problems with them. Given the propensity for using upper-case
1227
characters and spaces (particularly in the default Windows account names) this may cause
1228
some annoyance. For the rest, LAM is a very useful administrative tool.
1232
The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features
1233
(e.g., logon hours). The new plugin-based architecture also allows management of much more different
1234
account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another
1235
important point is the tree view which allows browsing and editing LDAP objects directly.
1238
<example id="lamcfg">
1239
<title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title>
1241
# password to add/delete/rename configuration profiles
1244
# default profile, without ".conf"
1249
<example id="lamconf">
1250
<title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title>
1252
ServerURL: ldap://massive.abmas.org:389
1253
Admins: cn=Manager,dc=abmas,dc=biz
1255
usersuffix: ou=People,dc=abmas,dc=biz
1256
groupsuffix: ou=Groups,dc=abmas,dc=biz
1257
hostsuffix: ou=Computers,dc=abmas,dc=biz
1258
domainsuffix: ou=Domains,dc=abmas,dc=biz
1265
userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber
1266
grouplistAttributes: #cn;#gidNumber;#memberUID;#description
1267
hostlistAttributes: #cn;#description;#uidNumber;#gidNumber
1269
defaultLanguage: en_GB:ISO-8859-1:English (Great Britain)
1281
<title>IDEALX Management Console</title>
1284
IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive
1285
web-based management interface for UNIX and Linux systems.
1289
The Samba toolset is the first console developped for IMC. It offers a simple and ergonomic
1290
interface for managing a Samba domain controler. The goal is to give Linux administrators who
1291
need to manage production Samba servers an effective, intuitive and consistent management
1292
experience. An IMC screenshot of the user management tool is shown in <link linkend="imcidealx"/>.
1295
<figure id="imcidealx">
1296
<title>The IMC Samba User Account Screen</title>
1297
<imagefile scale="40">imc-usermanager2</imagefile>
1301
IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC,
1302
but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language.
1306
For further information regarding IMC refer to the web <ulink url="http://imc.sourceforge.net/">site.</ulink>
1307
Prebuilt RPM packages are also <ulink url="http://imc.sourceforge.net/download.html">available.</ulink>
1312
<sect1 id="ch12-SUIDSGID">
1313
<title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title>
1315
<indexterm><primary>SUID</primary></indexterm>
1316
<indexterm><primary>SGID</primary></indexterm>
1318
The setting of the SUID/SGID bits on the file or directory permissions flag has particular
1319
consequences. If the file is executable and the SUID bit is set, it executes with the privilege
1320
of (with the UID of) the owner of the file. For example, if you are logged onto a system as
1321
a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned
1322
by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is
1323
executed as if you had logged in as the user <constant>root</constant> and then executed the file.
1324
The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the
1325
use of that executable file.
1329
The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it
1330
applies the privilege to the UNIX group setting. In other words, the file executes with the force
1331
of capability of the group.
1335
When the SUID/SGID permissions are set on a directory, all files that are created within that directory
1336
are automatically given the ownership of the SUID user and the SGID group, as per the ownership
1337
of the directory in which the file is created. This means that the system level <command>create()</command>
1338
function executes with the SUID user and/or SGID group of the directory in which the file is
1343
If you want to obtain the SUID behavior, simply execute the following command:
1345
&rootprompt; chmod u+s file-or-directory
1347
To set the SGID properties on a file or a directory, execute this command:
1349
&rootprompt; chmod g+s file-or-directory
1351
And to set both SUID and SGID properties, execute the following:
1353
&rootprompt; chmod ug+s file-or-directory
1358
Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this
1359
directory before setting both SUID and SGID on this directory are:
1361
&rootprompt; ls -al /data/accounts
1363
drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1364
drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1365
drwxrwxrwx 2 bobj Domain Users 48 Dec 18 17:08 accounts/
1366
drwx------ 2 root root 48 Jan 26 2002 lost+found
1368
In this example, if the user <constant>maryv</constant> creates a file, it is owned by her.
1369
If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is
1370
owned by the group <constant>Accounts</constant>, as shown in this listing:
1372
&rootprompt; ls -al /data/accounts/maryvfile.txt
1373
drw-rw-r-- 2 maryv Accounts 12346 Dec 18 17:53
1378
Now you set the SUID and SGID and check the result as follows:
1380
&rootprompt; chmod ug+s /data/accounts
1381
&rootprompt; ls -al /data/accounts
1383
drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1384
drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1385
drwsrwsr-x 2 bobj Domain Users 48 Dec 18 17:08 accounts
1386
drwx------ 2 root root 48 Jan 26 2002 lost+found
1388
If <constant>maryv</constant> creates a file in this directory after this change has been made, the
1389
file is owned by the user <constant>bobj</constant>, and the group is set to the group
1390
<constant>Domain Users</constant>, as shown here:
1392
&rootprompt; chmod ug+s /data/accounts
1393
&rootprompt; ls -al /data/accounts/maryvfile.txt
1395
drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
1401
<sect1 id="ch12dblck">
1402
<title>Shared Data Integrity</title>
1405
<primary>data integrity</primary>
1406
</indexterm><indexterm>
1407
<primary>multi-user</primary>
1408
<secondary>data access</secondary>
1410
The integrity of shared data is often viewed as a particularly emotional issue, especially where
1411
there are concurrent problems with multiuser data access. Contrary to the assertions of some who have
1412
experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
1416
The solution to concurrent multiuser data access problems must consider three separate areas
1417
from which the problem may stem:<indexterm>
1418
<primary>locking</primary>
1419
<secondary>Application level</secondary>
1420
</indexterm><indexterm>
1421
<primary>locking</primary>
1422
<secondary>Client side</secondary>
1423
</indexterm><indexterm>
1424
<primary>locking</primary>
1425
<secondary>Server side</secondary>
1430
<listitem><para>application-level locking controls</para></listitem>
1431
<listitem><para>client-side locking controls</para></listitem>
1432
<listitem><para>server-side locking controls</para></listitem>
1436
<primary>database applications</primary>
1437
</indexterm><indexterm>
1438
<primary>Microsoft Access</primary>
1440
Many database applications use some form of application-level access control. An example of one
1441
well-known application that uses application-level locking is Microsoft Access. Detailed guidance
1442
is provided here because this is the most common application for which problems have been reported.
1446
<primary>Microsoft Excel</primary>
1447
</indexterm><indexterm>
1448
<primary>Act!</primary>
1450
Common applications that are affected by client- and server-side locking controls include MS
1451
Excel and Act!. Important locking guidance is provided here.
1456
<title>Microsoft Access</title>
1459
The best advice that can be given is to carefully read the Microsoft knowledgebase articles that
1460
cover this area. Examples of relevant documents include:
1464
<listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem>
1465
<listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem>
1470
<primary>multi-user</primary>
1471
<secondary>access</secondary>
1472
</indexterm><indexterm>
1473
<primary>exclusive open</primary>
1475
Make sure that your MS Access database file is configured for multiuser access (not set for
1476
exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice>
1477
<guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu>
1478
</menuchoice>. Set network path to Default database folder: <filename>\\server\share\folder</filename>.
1482
You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>.
1484
<primary>record locking</primary>
1489
<listitem><para>Default open mode: Shared</para></listitem>
1490
<listitem><para>Default Record Locking: Edited Record</para></listitem>
1491
<listitem><para>Open databases using record_level locking</para></listitem>
1495
<primary>MS Access</primary>
1496
<secondary>validate</secondary>
1498
You must now commit the changes so that they will take effect. To do so, click
1499
<guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart
1500
it, and then validate that these settings have not changed.
1506
<title>Act! Database Sharing</title>
1509
<primary>ACT! database</primary>
1510
</indexterm><indexterm>
1511
<primary>data corruption</primary>
1513
Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you
1514
must disable opportunistic locking on the server and all workstations. Failure to do so
1515
results in data corruption. This information is available from the Act! Web site
1516
knowledgebase articles
1517
<ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink>
1518
as well as from article
1519
<ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>.
1523
<primary>opportunistic locking</primary>
1524
</indexterm><indexterm>
1525
<primary>Act!Diag</primary>
1527
These documents clearly state that opportunistic locking must be disabled on both
1528
the server (Samba in the case we are interested in here), as well as on every workstation
1529
from which the centrally shared Act! database will be accessed. Act! provides
1530
a tool called <command>Act!Diag</command> that may be used to disable all workstation
1531
registry settings that may otherwise interfere with the operation of Act!
1532
Registered Act! users may download this utility from the Act! Web
1533
<ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink>
1539
<title>Opportunistic Locking Controls</title>
1542
<primary>file caching</primary>
1544
Third-party Windows applications may not be compatible with the use of opportunistic file
1545
and record locking. For applications that are known not to be compatible,<footnote>Refer to
1546
the application manufacturer's installation guidelines and knowledge base for specific
1547
information regarding compatibility. It is often safe to assume that if the software
1548
manufacturer does not specifically mention incompatibilities with opportunistic file
1549
and record locking, or with Windows client file caching, the application is probably
1550
compatible with Windows (as well as Samba) default settings.</footnote> oplock
1551
support may need to be disabled both on the Samba server and on the Windows workstations.
1555
<primary>cache</primary>
1556
</indexterm><indexterm>
1557
<primary>write lock</primary>
1558
</indexterm><indexterm>
1559
<primary>flush</primary>
1560
<secondary>cache memory</secondary>
1562
Oplocks enable a Windows client to cache parts of a file that are being
1563
edited. Another windows client may then request to open the file with the
1564
ability to write to it. The server will then ask the original workstation
1565
that had the file open with a write lock to release its lock. Before
1566
doing so, that workstation must flush the file from cache memory to the
1567
disk or network drive.
1571
<primary>Oplocks</primary>
1572
<secondary>disabled</secondary>
1574
Disabling of Oplocks usage may require server and client changes.
1575
Oplocks may be disabled by file, by file pattern, on the share, or on the
1580
The following are examples showing how Oplock support may be managed using
1581
Samba &smb.conf; file settings:
1583
By file: veto oplock files = myfile.mdb
1585
By Pattern: veto oplock files = /*.mdb/
1587
On the Share: oplocks = No
1591
(in [global]) oplocks = No
1597
The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4
1598
workstation clients must be configured as shown here:
1602
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1603
Services\LanmanServer\Parameters]
1604
"EnableOplocks"=dword:00000000
1606
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1607
Services\LanmanWorkstation\Parameters]
1608
"UseOpportunisticLocking"=dword:00000000
1613
Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13.
1614
The information in that chapter was obtained from a wide variety of sources.
added
removed
docs-xml/Samba3-ByExample/SBE-Appendix1.xml
