1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�3.�Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part�I.�Example Network Configurations"><link rel="prev" href="small.html" title="Chapter�2.�Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter�4.�The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�3.�Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a>�</td><th width="60%" align="center">Part�I.�Example Network Configurations</th><td width="20%" align="right">�<a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter�3.�Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2558556">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558607">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2558840">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558856">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2559282">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2559322">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2560176">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2564636">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564698">Questions and Answers</a></span></dt></dl></div><p>
2
Congratulations, your Samba networking skills are developing nicely. You started out
3
with three simple networks in <a class="link" href="simple.html" title="Chapter�1.�No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter�2.�Small Office Networking">“Small Office Networking”</a>
4
you designed and built a network that provides a high degree of flexibility, integrity,
5
and dependability. It was enough for the basic needs each was designed to fulfill. In
6
this chapter you address a more complex set of needs. The solution you explore
7
introduces you to basic features that are specific to Samba-3.
9
You should note that a working and secure solution could be implemented using Samba-2.2.x.
10
In the exercises presented here, you are gradually using more Samba-3-specific features,
11
so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given.
12
To avoid confusion, this book is all about Samba-3. Let's get the exercises in this
14
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558556"></a>Introduction</h2></div></div></div><p>
15
You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work
16
well done. It is one year since the last network upgrade. You have been quite busy.
17
Two months ago Mr. Meany gave approval to hire Christine Roberson, who has taken over
18
general network management. Soon she will provide primary user support. You have
19
demonstrated that you can delegate responsibility and can plan and execute according
20
to that plan. Above all, you have shown Mr. Meany that you are a responsible person.
21
Today is a big day. Mr. Meany called you to his office at 9 a.m. for news you never
22
expected: You are going to take charge of business operations. Mr. Meany
23
is retiring and has entrusted the business to your capable hands.
25
Mr. Meany may be retiring from this company, but not from work. He is taking the
26
opportunity to develop Abmas Accounting into a larger and more substantial company.
27
He says that it took him many years to learn that there is no future in just running
28
a business. He now realizes there is great personal satisfaction in the creation of
29
career opportunities for people in the local community. He wants to do more for others,
30
as he is doing for you. Today he spent a lot of time talking about his grand plan
31
for growth, which you will deal with in the chapters ahead.
33
Over the past year, the growth projections were exceeded. The network has grown to
34
meet the needs of 130 users. Along with growth, the demand for improved services
35
and better functionality has also developed. You are about to make an interim
36
improvement and then hand over all Help desk and network maintenance to Christine.
37
Christine has professional certifications in Microsoft Windows as well as in Linux;
38
she is a hard worker and quite likable. Christine does not want to manage the department
39
(although she manages well). She gains job satisfaction when left to sort things out.
40
Occasionally she wants to work with you on a challenging problem. When you told her
41
about your move, she almost resigned, although she was reassured that a new manager would
42
be hired to run Information Technology, and she would be responsible only for operations.
43
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558607"></a>Assignment Tasks</h3></div></div></div><p>
44
You promised the staff Internet services including Web browsing, electronic mail, virus
45
protection, and a company Web site. Christine is eager to help turn the vision into
46
reality. Let's see how close you can get to the promises made.
48
The network you are about to deliver will service 130 users today. Within a year,
49
Abmas will aquire another company. Mr. Meany claims that within 2 years there will be
50
well over 500 users on the network. You have bought into the big picture, so prepare
51
for growth. You have purchased a new server and will implement a new network infrastructure.
53
You have decided to not recycle old network components. The only items that will be
54
carried forward are notebook computers. You offered staff new notebooks, but not
55
one person wanted the disruption for what was perceived as a marginal update.
56
You decided to give everyone, even the notebook user, a new desktop computer.
58
You procured a DSL Internet connection that provides 1.5 Mb/sec (bidirectional)
59
and a 10 Mb/sec ethernet port. You registered the domain
60
<code class="constant">abmas.us</code>, and the Internet Service Provider (ISP) is supplying
61
secondary DNS. Information furnished by your ISP is shown in <a class="link" href="secure.html#chap4netid" title="Table�3.1.�Abmas.US ISP Information">“Abmas.US ISP Information”</a>.
63
It is of paramount priority that under no circumstances will Samba offer
64
service access from an Internet connection. You are paying an ISP to
65
give, as part of its value-added services, full firewall protection for your
66
connection to the outside world. The only services allowed in from
67
the Internet side are the following destination ports: <code class="constant">http/https (ports
68
80 and 443), email (port 25), DNS (port 53)</code>. All Internet traffic
69
will be allowed out after network address translation (NAT). No internal IP addresses
70
are permitted through the NAT filter because complete privacy of internal network
71
operations must be assured.
72
</p><div class="table"><a name="chap4netid"></a><p class="title"><b>Table�3.1.�Abmas.US ISP Information</b></p><div class="table-contents"><table summary="Abmas.US ISP Information" border="1"><colgroup><col align="left"><col align="center"></colgroup><thead><tr><th align="left">Parameter</th><th align="center">Value</th></tr></thead><tbody><tr><td align="left">Server IP Address</td><td align="center">123.45.67.66</td></tr><tr><td align="left">DSL Device IP Address</td><td align="center">123.45.67.65</td></tr><tr><td align="left">Network Address</td><td align="center">123.45.67.64/30</td></tr><tr><td align="left">Gateway Address</td><td align="center">123.45.54.65</td></tr><tr><td align="left">Primary DNS Server</td><td align="center">123.45.54.65</td></tr><tr><td align="left">Secondary DNS Server</td><td align="center">123.45.54.32</td></tr><tr><td align="left">Forwarding DNS Server</td><td align="center">123.45.12.23</td></tr></tbody></table></div></div><br class="table-break"><div class="figure"><a name="ch04net"></a><p class="title"><b>Figure�3.1.�Abmas Network Topology 130 Users</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap4-net.png" width="351" alt="Abmas Network Topology 130 Users"></div></div></div><br class="figure-break"><p>
73
Christine recommended that desktop systems should be installed from a single cloned
74
master system that has a minimum of locally installed software and loads all software
75
off a central application server. The benefit of having the central application server
76
is that it allows single-point maintenance of all business applications, a more
77
efficient way to manage software. She further recommended installation of antivirus
78
software on workstations as well as on the Samba server. Christine knows the dangers
79
of potential virus infection and insists on a comprehensive approach to detective
80
as well as corrective action to protect network operations.
82
A significant concern is the problem of managing company growth. Recently, a number
83
of users had to share a PC while waiting for new machines to arrive. This presented
84
some problems with desktop computers and software installation into the new users'
86
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558840"></a>Dissection and Discussion</h2></div></div></div><p>
87
Many of the conclusions you draw here are obvious. Some requirements are not very clear
88
or may simply be your means of drawing the most out of Samba-3. Much can be done more simply
89
than you will demonstrate here, but keep in mind that the network must scale to at least 500
90
users. This means that some functionality will be overdesigned for the current 130-user
92
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558856"></a>Technical Issues</h3></div></div></div><p>
93
In this exercise we use a 24-bit subnet mask for the two local networks. This,
94
of course, limits our network to a maximum of 253 usable IP addresses. The network
95
address range chosen is one assigned by RFC1918 for private networks.
96
When the number of users on the network begins to approach the limit of usable
97
addresses, it is a good idea to switch to a network address specified in RFC1918
98
in the 172.16.0.0/16 range. This is done in subsequent chapters.
100
<a class="indexterm" name="id2558874"></a>
101
<a class="indexterm" name="id2558880"></a>
102
The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code>
103
passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in
104
performance problems. The <code class="constant">tdbsam</code> passdb backend offers features that
105
are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database.
107
<a class="indexterm" name="id2558907"></a>
108
The proposed network design uses a single server to act as an Internet services host for
109
electronic mail, Web serving, remote administrative access via SSH,
110
Samba-based file and print services. This design is often chosen by sites that feel
111
they cannot afford or justify the cost or overhead of having separate servers. It must
112
be realized that if security of this type of server should ever be violated (compromised),
113
the whole network and all data is at risk. Many sites continue to choose this type
114
of solution; therefore, this chapter provides detailed coverage of key implementation
117
Samba will be configured to specifically not operate on the Ethernet interface that is
118
directly connected to the Internet.
120
<a class="indexterm" name="id2558932"></a>
121
<a class="indexterm" name="id2558938"></a>
122
<a class="indexterm" name="id2558945"></a>
123
<a class="indexterm" name="id2558953"></a>
124
You know that your ISP is providing full firewall services, but you cannot rely on that.
125
Always assume that human error will occur, so be prepared by using Linux firewall facilities
126
based on <code class="literal">iptables</code> to effect NAT. Block all
127
incoming traffic except to permitted well-known ports. You must also allow incoming packets
128
to establish outgoing connections. You will permit all internal outgoing requests.
130
The configuration of Web serving, Web proxy services, electronic mail, and the details of
131
generic antivirus handling are beyond the scope of this book and therefore are not
132
covered except insofar as this affects Samba-3.
134
<a class="indexterm" name="id2558982"></a>
135
Notebook computers are configured to use a network login when in the office and a
136
local account to log in while away from the office. Users store all work done in
137
transit (away from the office) by using a local share for work files. Standard procedures
138
dictate that on completion of the work that necessitates mobile file access, all
139
work files are moved back to secure storage on the office server. Staff is instructed
140
to not carry on any company notebook computer any files that are not absolutely required.
141
This is a preventative measure to protect client information as well as private business
144
<a class="indexterm" name="id2559012"></a>
145
All applications are served from the central server from a share called <code class="constant">apps</code>.
146
Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network
147
(or administrative) installation. Accounting and financial management software can also
148
be run only from the central application server. Notebook users are provided with
149
locally installed applications on a need-to-have basis only.
151
<a class="indexterm" name="id2559032"></a>
152
The introduction of roaming profiles support means that users can move between
153
desktop computer systems without constraint while retaining full access to their data.
154
The desktop travels with them as they move.
156
<a class="indexterm" name="id2559045"></a>
157
The DNS server implementation must now address both internal and external
158
needs. You forward DNS lookups to your ISP-provided server as well as the
159
<code class="constant">abmas.us</code> external secondary DNS server.
161
<a class="indexterm" name="id2559062"></a>
162
<a class="indexterm" name="id2559068"></a>
163
<a class="indexterm" name="id2559076"></a>
164
Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter�2.�Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the
165
configuration used in this example has to deal with the presence of an Internet connection.
166
The scope set for it ensures that no DHCP services will be offered on the external
167
connection. All printers are configured as DHCP clients so that the DHCP server assigns
168
the printer a fixed IP address by way of the Ethernet interface (MAC) address. One additional
169
feature of this DHCP server configuration file is the inclusion of parameters to allow dynamic
170
DNS (DDNS) operation.
172
This is the first implementation that depends on a correctly functioning DNS server.
173
Comprehensive steps are included to provide for a fully functioning DNS server that also
174
is enabled for DDNS operation. This means that DHCP clients can be autoregistered
177
You are taking the opportunity to manually set the netbios name of the Samba server to
178
a name other than what will be automatically resolved. You are doing this to ensure that
179
the machine has the same NetBIOS name on both network segments.
181
As in the previous network configuration, printing in this network configuration uses
182
direct raw printing (i.e., no smart printing and no print driver autodownload to Windows
183
clients). Printer drivers are installed on the Windows client manually. This is not
184
a problem because Christine is to install and configure one single workstation and
185
then clone that configuration, using Norton Ghost, to all workstations. Each machine is
186
identical, so this should pose no problem.
187
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2559128"></a>Hardware Requirements</h4></div></div></div><p>
188
<a class="indexterm" name="id2559136"></a>
189
This server runs a considerable number of services. From similarly configured Linux
190
installations, the approximate calculated memory requirements are as shown in
191
<a class="link" href="secure.html#ch4memoryest" title="Example�3.1.�Estimation of Memory Requirements">“Estimation of Memory Requirements”</a>.
193
</p><div class="example"><a name="ch4memoryest"></a><p class="title"><b>Example�3.1.�Estimation of Memory Requirements</b></p><div class="example-contents"><pre class="screen">
194
Application Memory per User 130 Users 500 Users
195
Name (MBytes) Total MBytes Total MBytes
196
----------- --------------- ------------ ------------
199
Samba (nmbd) 16.0 16 16
200
Samba (winbind) 16.0 16 16
201
Samba (smbd) 4.0 520 2000
202
Apache 10.0 (20 User) 200 200
204
Basic OS 256.0 256 256
205
-------------- --------------
206
Total: 1043 MBytes 2539 MBytes
207
-------------- --------------
208
</pre></div></div><p><br class="example-break">
209
You should add a safety margin of at least 50% to these estimates. The minimum
210
system memory recommended for initial startup 1 GB, but to permit the system
211
to scale to 500 users, it makes sense to provision the machine with 4 GB memory.
212
An initial configuration with only 1 GB memory would lead to early performance complaints
213
as the system load builds up. Given the low cost of memory, it does not make sense to
214
compromise in this area.
216
<a class="indexterm" name="id2559187"></a>
217
Aggregate input/output loads should be considered for sizing network configuration as
218
well as disk subsystems. For network bandwidth calculations, one would typically use an
219
estimate of 0.1 MB/sec per user. This suggests that 100-Base-T (approx. 10 MB/sec)
220
would deliver below acceptable capacity for the initial user load. It is therefore a good
221
idea to begin with 1 Gb Ethernet cards for the two internal networks, each attached
222
to a 1 Gb Ethernet switch that provides connectivity to an expandable array of 100-Base-T
225
<a class="indexterm" name="id2559206"></a>
226
<a class="indexterm" name="id2559212"></a>
227
Considering the choice of 1 Gb Ethernet interfaces for the two local network segments,
228
the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O
229
demand that would require a fast disk storage I/O capability. Peak disk throughput is
230
limited by the disk subsystem chosen. It is desirable to provide the maximum
231
I/O bandwidth affordable. If a low-cost solution must be chosen,
232
3Ware IDE RAID Controllers are a good choice. These controllers can be fitted into a
233
64-bit, 66 MHz PCI-X slot. They appear to the operating system as a high-speed SCSI
234
controller that can operate at the peak of the PCI-X bandwidth (approximately 450 MB/sec).
235
Alternative SCSI-based hardware RAID controllers should also be considered. Alternately,
236
it makes sense to purchase well-known, branded hardware that has appropriate performance
237
specifications. As a minimum, one should attempt to provide a disk subsystem that can
238
deliver I/O rates of at least 100 MB/sec.
240
Disk storage requirements may be calculated as shown in <a class="link" href="secure.html#ch4diskest" title="Example�3.2.�Estimation of Disk Storage Requirements">“Estimation of Disk Storage Requirements”</a>.
242
</p><div class="example"><a name="ch4diskest"></a><p class="title"><b>Example�3.2.�Estimation of Disk Storage Requirements</b></p><div class="example-contents"><pre class="screen">
243
Corporate Data: 100 MBytes/user per year
244
Email Storage: 500 MBytes/user per year
245
Applications: 5000 MBytes
246
Safety Buffer: At least 50%
248
Given 500 Users and 2 years:
249
-----------------------------
250
Corporate Data: 2 x 100 x 500 = 100000 MBytes = 100 GBytes
251
Email Storage: 2 x 500 x 500 = 500000 MBytes = 500 GBytes
252
Applications: 5000 MBytes = 5 GBytes
253
----------------------------
255
Add 50% buffer 303 GBytes
256
Recommended Storage: 908 GBytes
257
</pre></div></div><p><br class="example-break">
258
<a class="indexterm" name="id2559270"></a>
259
The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5
260
with two hot spare drives would require an 8-drive by 200 GB capacity per drive array.
261
</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2559282"></a>Political Issues</h3></div></div></div><p>
262
Your industry is coming under increasing accountability pressures. Increased paranoia
263
is necessary so you can demonstrate that you have acted with due diligence. You must
264
not trust your Internet connection.
266
Apart from permitting more efficient management of business applications through use of
267
an application server, your primary reason for the decision to implement this is that it
268
gives you greater control over software licensing.
270
<a class="indexterm" name="id2559304"></a>
271
You are well aware that the current configuration results in some performance issues
272
as the size of the desktop profile grows. Given that users use Microsoft Outlook
273
Express, you know that the storage implications of the <code class="constant">.PST</code> file
274
is something that needs to be addressed later.
275
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2559322"></a>Implementation</h2></div></div></div><p>
276
<a class="link" href="secure.html#ch04net" title="Figure�3.1.�Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement.
278
The information presented here assumes that you are already familiar with many basic steps.
279
As this stands, the details provided already extend well beyond just the necessities of
280
Samba configuration. This decision is deliberate to ensure that key determinants
281
of a successful installation are not overlooked. This is the last case that documents
282
the finite minutiae of DHCP and DNS server configuration. Beyond the information provided
283
here, there are many other good reference books on these subjects.
285
The <code class="filename">smb.conf</code> file has the following noteworthy features:
286
</p><div class="itemizedlist"><ul type="disc"><li><p>
287
The NetBIOS name of the Samba server is set to <code class="constant">DIAMOND</code>.
289
The Domain name is set to <code class="constant">PROMISES</code>.
291
<a class="indexterm" name="id2559379"></a>
292
<a class="indexterm" name="id2559385"></a>
293
<a class="indexterm" name="id2559391"></a>
294
Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection
295
and is externally exposed. This interface is explicitly not available for Samba to use.
296
Samba listens on this interface for broadcast messages but does not broadcast any
297
information on <code class="constant">eth0</code>, nor does it accept any connections from it.
298
This is achieved by way of the <em class="parameter"><code>interfaces</code></em> parameter and the
299
<em class="parameter"><code>bind interfaces only</code></em> entry.
301
<a class="indexterm" name="id2559424"></a>
302
<a class="indexterm" name="id2559430"></a>
303
<a class="indexterm" name="id2559437"></a>
304
The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use
305
of the <code class="constant">tdbsam</code> password backend. This is a binary database that
306
has excellent scalability for a large number of user account entries.
308
<a class="indexterm" name="id2559459"></a>
309
<a class="indexterm" name="id2559465"></a>
310
<a class="indexterm" name="id2559471"></a>
311
WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = Yes</a>,
312
and name resolution is set to use it by means of the
313
<a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order = wins bcast hosts</a> entry.
315
<a class="indexterm" name="id2559501"></a>
316
The Samba server is configured for use by Windows clients as a time server.
318
<a class="indexterm" name="id2559513"></a>
319
<a class="indexterm" name="id2559519"></a>
320
<a class="indexterm" name="id2559525"></a>
321
Samba is configured to directly interface with CUPS via the direct internal interface
322
that is provided by CUPS libraries. This is achieved with the
323
<a class="link" href="smb.conf.5.html#PRINTING" target="_top">printing = CUPS</a> as well as the
324
<a class="link" href="smb.conf.5.html#PRINTCAPNAME" target="_top">printcap name = CUPS</a> entries.
326
<a class="indexterm" name="id2559556"></a>
327
<a class="indexterm" name="id2559562"></a>
328
<a class="indexterm" name="id2559568"></a>
329
External interface scripts are provided to enable Samba to interface smoothly to
330
essential operating system functions for user and group management. This is important
331
to enable workstations to join the Domain and is also important so that you can use
332
the Windows NT4 Domain User Manager as well as the Domain Server Manager. These tools
333
are provided as part of the <code class="filename">SRVTOOLS.EXE</code> toolkit that can be
334
downloaded from the Microsoft FTP
335
<a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>.
337
<a class="indexterm" name="id2559598"></a>
338
The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code>
339
security = user</code></em> mode<sup>[<a name="id2559616" href="#ftn.id2559616" class="footnote">5</a>]</sup>
342
<a class="indexterm" name="id2559632"></a>
343
<a class="indexterm" name="id2559639"></a>
344
Domain logon services as well as a Domain logon script are specified. The logon script
345
will be used to add robustness to the overall network configuration.
347
<a class="indexterm" name="id2559652"></a>
348
<a class="indexterm" name="id2559658"></a>
349
<a class="indexterm" name="id2559665"></a>
350
Roaming profiles are enabled through the specification of the parameter,
351
<a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the
352
<code class="constant">%L</code> to the name by which the Samba server is called by the client (for this
353
configuration, it translates to the name <code class="constant">DIAMOND</code>), and the <code class="constant">%U</code>
354
will translate to the name of the user within the context of the connection made to the profile share.
355
It is the administrator's responsibility to ensure there is a directory in the root of the
356
profile share for each user. This directory must be owned by the user also. An exception to this
357
requirement is when a profile is created for group use.
359
<a class="indexterm" name="id2559705"></a>
360
<a class="indexterm" name="id2559711"></a>
361
Precautionary veto is effected for particular Windows file names that have been targeted by
362
virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking
363
controls. This should help to prevent lock contention-related file access problems.
365
Every user has a private home directory on the UNIX/Linux host. This is mapped to
366
a network drive that is the same for all users.
367
</p></li></ul></div><p>
368
The configuration of the server is the most complex so far. The following steps are used:
369
</p><div class="orderedlist"><ol type="1"><li><p>
370
Basic System Configuration
374
DHCP and DNS Server Configuration
376
Printer Configuration
378
Process Start-up Configuration
382
Application Share Configuration
384
Windows Client Configuration
385
</p></li></ol></div><p>
386
The following sections cover each step in logical and defined detail.
387
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p>
388
<a class="indexterm" name="id2559796"></a>
389
The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been
390
freshly installed. It prepares basic files so that the system is ready for comprehensive
391
operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure�3.1.�Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>.
392
</p><div class="procedure"><a name="id2559813"></a><p class="title"><b>Procedure�3.1.�Server Configuration Steps</b></p><ol type="1"><li><p>
393
<a class="indexterm" name="id2559823"></a>
394
Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>.
395
Verify that your hostname is correctly set by running:
396
</p><pre class="screen">
397
<code class="prompt">root# </code> uname -n
400
An alternate method to verify the hostname is:
401
</p><pre class="screen">
402
<code class="prompt">root# </code> hostname -f
406
<a class="indexterm" name="id2559863"></a>
407
<a class="indexterm" name="id2559870"></a>
408
Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses
409
of all network interfaces that are on the host server. This is necessary so that during
410
startup the system can resolve all its own names to the IP address prior to
411
startup of the DNS server. An example of entries that should be in the
412
<code class="filename">/etc/hosts</code> file is:
413
</p><pre class="screen">
415
192.168.1.1 sleeth1.abmas.biz sleeth1 diamond
416
192.168.2.1 sleeth2.abmas.biz sleeth2
417
123.45.67.66 server.abmas.us server
419
You should check the startup order of your system. If the CUPS print server is started before
420
the DNS server (<code class="literal">named</code>), you should also include an entry for the printers
421
in the <code class="filename">/etc/hosts</code> file, as follows:
422
</p><pre class="screen">
423
192.168.1.20 qmsa.abmas.biz qmsa
424
192.168.1.30 hplj6a.abmas.biz hplj6a
425
192.168.2.20 qmsf.abmas.biz qmsf
426
192.168.2.30 hplj6f.abmas.biz hplj6f
428
<a class="indexterm" name="id2559921"></a>
429
<a class="indexterm" name="id2559927"></a>
430
<a class="indexterm" name="id2559933"></a>
431
The printer entries are not necessary if <code class="literal">named</code> is started prior to
432
startup of <code class="literal">cupsd</code>, the CUPS daemon.
434
<a class="indexterm" name="id2559958"></a>
435
<a class="indexterm" name="id2559964"></a>
436
<a class="indexterm" name="id2559970"></a>
437
The host server is acting as a router between the two internal network segments as well
438
as for all Internet access. This necessitates that IP forwarding be enabled. This can be
439
achieved by adding to the <code class="filename">/etc/rc.d/boot.local</code> an entry as follows:
440
</p><pre class="screen">
441
echo 1 > /proc/sys/net/ipv4/ip_forward
443
To ensure that your kernel is capable of IP forwarding during configuration, you may
444
wish to execute that command manually also. This setting permits the Linux system to
445
act as a router.<sup>[<a name="id2559997" href="#ftn.id2559997" class="footnote">6</a>]</sup>
447
<a class="indexterm" name="id2560009"></a>
448
<a class="indexterm" name="id2560016"></a>
449
Installation of a basic firewall and NAT facility is necessary.
450
The following script can be installed in the <code class="filename">/usr/local/sbin</code>
451
directory. It is executed from the <code class="filename">/etc/rc.d/boot.local</code> startup
452
script. In your case, this script is called <code class="filename">abmas-netfw.sh</code>. The
453
script contents are shown in <a class="link" href="secure.html#ch4natfw" title="Example�3.3.�NAT Firewall Configuration Script">“NAT Firewall Configuration Script”</a>.
455
</p><div class="example"><a name="ch4natfw"></a><p class="title"><b>Example�3.3.�NAT Firewall Configuration Script</b></p><div class="example-contents"><pre class="screen">
457
echo -e "\n\nLoading NAT firewall.\n"
458
IPTABLES=/usr/sbin/iptables
464
/sbin/modprobe ip_tables
465
/sbin/modprobe ip_conntrack
466
/sbin/modprobe ip_conntrack_ftp
467
/sbin/modprobe iptable_nat
468
/sbin/modprobe ip_nat_ftp
469
$IPTABLES -P INPUT DROP
471
$IPTABLES -P OUTPUT ACCEPT
473
$IPTABLES -P FORWARD DROP
476
$IPTABLES -A INPUT -i lo -j ACCEPT
477
$IPTABLES -A INPUT -i $INTIFA -j ACCEPT
478
$IPTABLES -A INPUT -i $INTIFB -j ACCEPT
479
$IPTABLES -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
480
# Enable incoming traffic for: SSH, SMTP, DNS(tcp), HTTP, HTTPS
481
for i in 22 25 53 80 443
483
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport $i -j ACCEPT
486
$IPTABLES -A INPUT -i $EXTIF -p udp -dport 53 -j ACCEPT
487
echo "Allow all connections OUT and only existing and specified ones IN"
488
$IPTABLES -A FORWARD -i $EXTIF -o $INTIFA -m state \
489
--state ESTABLISHED,RELATED -j ACCEPT
490
$IPTABLES -A FORWARD -i $EXTIF -o $INTIFB -m state \
491
--state ESTABLISHED,RELATED -j ACCEPT
492
$IPTABLES -A FORWARD -i $INTIFA -o $EXTIF -j ACCEPT
493
$IPTABLES -A FORWARD -i $INTIFB -o $EXTIF -j ACCEPT
494
$IPTABLES -A FORWARD -j LOG
495
echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
496
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
497
echo "1" > /proc/sys/net/ipv4/ip_forward
498
echo -e "\nNAT firewall done.\n"
499
</pre></div></div><p><br class="example-break">
501
Execute the following to make the script executable:
502
</p><pre class="screen">
503
<code class="prompt">root# </code> chmod 755 /usr/local/sbin/abmas-natfw.sh
505
You must now edit <code class="filename">/etc/rc.d/boot.local</code> to add an entry
506
that runs your <code class="literal">abmas-natfw.sh</code> script. The following
508
</p><pre class="screen">
511
# Copyright (c) 2002 SUSE Linux AG Nuernberg, Germany.
512
# All rights reserved.
514
# Author: Werner Fink, 1996
515
# Burchard Steinbild, 1996
517
# /etc/init.d/boot.local
519
# script with local commands to be executed from init on system startup
521
# Here you should add things that should happen directly after booting
522
# before we're going to the first run level.
524
/usr/local/sbin/abmas-natfw.sh
526
</p></li></ol></div><p>
527
<a class="indexterm" name="id2560155"></a>
528
The server is now ready for Samba configuration. During the validation step, you remove
529
the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code>
530
file. This is done after you are satisfied that DNS-based name resolution is functioning correctly.
531
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2560176"></a>Samba Configuration</h3></div></div></div><p>
532
When you have completed this section, the Samba server is ready for testing and validation;
533
however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have
535
</p><div class="procedure"><a name="id2560188"></a><p class="title"><b>Procedure�3.2.�Samba Configuration Steps</b></p><ol type="1"><li><p>
536
Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary
537
RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this
539
</p><pre class="screen">
540
<code class="prompt">root# </code> rpm -Uvh samba-3.0.20-1.i386.rpm
542
This operation must be performed while logged in as the <code class="literal">root</code> user.
543
Successful operation is clearly indicated. If this installation should fail for any reason,
544
refer to the operating system manufacturer's documentation for guidance.
546
Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="secure.html#promisnet" title="Example�3.4.�130 User Network with tdbsam [globals] Section">“130 User Network with tdbsam [globals] Section”</a>, <a class="link" href="secure.html#promisnetsvca" title="Example�3.5.�130 User Network with tdbsam Services Section Part A">“130 User Network with tdbsam Services Section Part A”</a>,
547
and <a class="link" href="secure.html#promisnetsvcb" title="Example�3.6.�130 User Network with tdbsam Services Section Part B">“130 User Network with tdbsam Services Section Part B”</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code>
548
file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>.
550
</p><div class="example"><a name="promisnet"></a><p class="title"><b>Example�3.4.�130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560294"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2560304"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2560314"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2560325"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560335"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2560346"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560356"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2560366"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2560378"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2560389"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560400"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2560410"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2560421"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2560432"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2560442"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2560452"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2560464"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560474"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2560484"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560496"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560507"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560518"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560529"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560541"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560552"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560564"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2560575"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2560586"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2560597"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560608"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2560619"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560629"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560640"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560650"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560660"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560671"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560681"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2560692"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2560702"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2560713"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">
552
</p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example�3.5.�130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2560752"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2560763"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2560773"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560784"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2560802"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2560813"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2560823"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560834"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560844"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560854"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560865"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2560884"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2560894"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2560905"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560915"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2560934"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2560945"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2560956"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560966"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2560985"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2560995"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2561006"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">
554
</p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example�3.6.�130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2561044"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561054"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2561065"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2561084"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561095"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2561105"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2561124"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561134"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2561145"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561155"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">
556
<a class="indexterm" name="id2561173"></a><a class="indexterm" name="id2561178"></a>
557
Add the <code class="constant">root</code> user to the password backend as follows:
558
</p><pre class="screen">
559
<code class="prompt">root# </code> smbpasswd -a root
560
New SMB password: XXXXXXXX
561
Retype new SMB password: XXXXXXXX
562
<code class="prompt">root# </code>
564
The <code class="constant">root</code> account is the UNIX equivalent of the Windows Domain Administrator.
565
This account is essential in the regular maintenance of your Samba server. It must never be
566
deleted. If for any reason the account is deleted, you may not be able to recreate this account
567
without considerable trouble.
569
<a class="indexterm" name="id2561222"></a>
570
Create the username map file to permit the <code class="constant">root</code> account to be called
571
<code class="constant">Administrator</code> from the Windows network environment. To do this, create
572
the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
573
</p><pre class="screen">
579
# Unix_ID = Windows_ID
582
# root = Administrator
583
# janes = "Jane Smith"
586
# Note: If the name contains a space it must be double quoted.
587
# In the example above the name 'jimbo' will be mapped to Windows
588
# user names 'Jim' and 'Bones' because the space was not quoted.
589
#######################################################################
596
<a class="indexterm" name="id2561264"></a>
597
<a class="indexterm" name="id2561270"></a>
598
<a class="indexterm" name="id2561281"></a>
599
<a class="indexterm" name="id2561291"></a>
600
Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter�2.�Small Office Networking">“Small Office Networking”</a>,
601
<a class="link" href="small.html#initGrps" title="Example�2.1.�Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours
602
<code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed,
603
and then execute the script. Sample output should be as follows:
605
</p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example�3.7.�Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2561329"></a><pre class="screen">
615
# Map Windows Domain Groups to UNIX groups
616
net groupmap add ntgroup="Domain Admins" unixgroup=root type=d
617
net groupmap add ntgroup="Domain Users" unixgroup=users type=d
618
net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d
620
# Add Functional Domain Groups
621
net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
622
net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
623
net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d
625
# Map Windows NT machine local groups to local UNIX groups
626
# Mapping of local groups is not necessary and not functional
627
# for this installation.
628
</pre></div></div><p><br class="example-break">
630
</p><pre class="screen">
631
<code class="prompt">root# </code> chmod 755 initGrps.sh
632
<code class="prompt">root# </code> /etc/samba # ./initGrps.sh
633
Updated mapping entry for Domain Admins
634
Updated mapping entry for Domain Users
635
Updated mapping entry for Domain Guests
636
No rid or sid specified, choosing algorithmic mapping
637
Successfully added group Accounts Dept to the mapping db
638
No rid or sid specified, choosing algorithmic mapping
639
Successfully added group Domain Guests to the mapping db
641
<code class="prompt">root# </code> /etc/samba # net groupmap list | sort
642
Account Operators (S-1-5-32-548) -> -1
643
Accounts Dept (S-1-5-21-179504-2437109-488451-2003) -> acctsdep
644
Administrators (S-1-5-32-544) -> -1
645
Backup Operators (S-1-5-32-551) -> -1
646
Domain Admins (S-1-5-21-179504-2437109-488451-512) -> root
647
Domain Guests (S-1-5-21-179504-2437109-488451-514) -> nobody
648
Domain Users (S-1-5-21-179504-2437109-488451-513) -> users
649
Financial Services (S-1-5-21-179504-2437109-488451-2005) -> finsrvcs
650
Guests (S-1-5-32-546) -> -1
651
Power Users (S-1-5-32-547) -> -1
652
Print Operators (S-1-5-32-550) -> -1
653
Replicators (S-1-5-32-552) -> -1
654
System Operators (S-1-5-32-549) -> -1
655
Users (S-1-5-32-545) -> -1
658
<a class="indexterm" name="id2561402"></a>
659
<a class="indexterm" name="id2561408"></a>
660
<a class="indexterm" name="id2561414"></a>
661
<a class="indexterm" name="id2561420"></a>
662
<a class="indexterm" name="id2561427"></a>
663
<a class="indexterm" name="id2561433"></a>
664
<a class="indexterm" name="id2561441"></a>
665
There is one preparatory step without which you will not have a working Samba
666
network environment. You must add an account for each network user.
667
For each user who needs to be given a Windows Domain account, make an entry in the
668
<code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
669
Use the system tool of your choice to create the UNIX system account, and use the Samba
670
<code class="literal">smbpasswd</code> to create a Domain user account.
671
There are a number of tools for user management under UNIX, such as
672
<code class="literal">useradd</code>, and <code class="literal">adduser</code>, as well as a plethora of custom
673
tools. You also want to create a home directory for each user.
674
You can do this by executing the following steps for each user:
675
</p><pre class="screen">
676
<code class="prompt">root# </code> useradd -m <em class="parameter"><code>username</code></em>
677
<code class="prompt">root# </code> passwd <em class="parameter"><code>username</code></em>
678
Changing password for <em class="parameter"><code>username</code></em>.
679
New password: XXXXXXXX
680
Re-enter new password: XXXXXXXX
682
<code class="prompt">root# </code> smbpasswd -a <em class="parameter"><code>username</code></em>
683
New SMB password: XXXXXXXX
684
Retype new SMB password: XXXXXXXX
685
Added user <em class="parameter"><code>username</code></em>.
687
You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>.
689
<a class="indexterm" name="id2561546"></a>
690
<a class="indexterm" name="id2561554"></a>
691
<a class="indexterm" name="id2561562"></a>
692
Using the preferred tool for your UNIX system, add each user to the UNIX groups created
693
previously as necessary. File system access control will be based on UNIX group membership.
695
Create the directory mount point for the disk subsystem that can be mounted to provide
696
data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code>
697
file is <code class="filename">/data</code>. Format the file system as required, and mount the formatted
698
file system partition using appropriate system tools.
700
<a class="indexterm" name="id2561602"></a>
701
Create the top-level file storage directories for data and applications as follows:
702
</p><pre class="screen">
703
<code class="prompt">root# </code> mkdir -p /data/{accounts,finsrvcs}
704
<code class="prompt">root# </code> mkdir -p /apps
705
<code class="prompt">root# </code> chown -R root:root /data
706
<code class="prompt">root# </code> chown -R root:root /apps
707
<code class="prompt">root# </code> chown -R bjordan:acctsdep /data/accounts
708
<code class="prompt">root# </code> chown -R bjordan:finsrvcs /data/finsrvcs
709
<code class="prompt">root# </code> chmod -R ug+rwxs,o-rwx /data
710
<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps
712
Each department is responsible for creating its own directory structure within the departmental
713
share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>.
714
The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>.
715
The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share
716
that provides the application server infrastructure.
718
The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network
719
logon services. You can now create the file system infrastructure to provide the
720
locations on disk that these services require. Adequate planning is essential,
721
since desktop profiles can grow to be quite large. For planning purposes, a minimum of
722
200 MB of storage should be allowed per user for profile storage. The following
723
commands create the directory infrastructure needed:
724
</p><pre class="screen">
725
<code class="prompt">root# </code> mkdir -p /var/spool/samba
726
<code class="prompt">root# </code> mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
727
<code class="prompt">root# </code> chown -R root:root /var/spool/samba
728
<code class="prompt">root# </code> chown -R root:root /var/lib/samba
729
<code class="prompt">root# </code> chmod a+rwxt /var/spool/samba
730
<code class="prompt">root# </code> chmod 2775 /var/lib/samba/profiles
731
<code class="prompt">root# </code> chgrp users /var/lib/samba/profiles
733
For each user account that is created on the system, the following commands should be
735
</p><pre class="screen">
736
<code class="prompt">root# </code> mkdir /var/lib/samba/profiles/'username'
737
<code class="prompt">root# </code> chown 'username':users /var/lib/samba/profiles/'username'
738
<code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
741
<a class="indexterm" name="id2561796"></a>
742
<a class="indexterm" name="id2561802"></a>
743
<a class="indexterm" name="id2561808"></a>
744
Create a logon script. It is important that each line is correctly terminated with
745
a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
746
works if the right tools (<code class="constant">unix2dos</code> and <code class="constant">dos2unix</code>) are installed.
747
First, create a file called <code class="filename">/var/lib/samba/netlogon/scripts/logon.bat.unix</code>
748
with the following contents:
749
</p><pre class="screen">
750
net time \\diamond /set /yes
752
net use p: \\diamond\apps
754
Convert the UNIX file to a DOS file using the <code class="literal">unix2dos</code> as shown here:
755
</p><pre class="screen">
756
<code class="prompt">root# </code> unix2dos < /var/lib/samba/netlogon/scripts/logon.bat.unix \
757
> /var/lib/samba/netlogon/scripts/logon.bat
759
</p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p>
760
DHCP services are a basic component of the entire network client installation. DNS operation is
761
foundational to Internet access as well as to trouble-free operation of local networking. When
762
you have completed this section, the server should be ready for solid duty operation.
763
</p><div class="procedure"><a name="id2561878"></a><p class="title"><b>Procedure�3.3.�DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p>
764
<a class="indexterm" name="id2561890"></a>
765
Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as
766
shown in <a class="link" href="secure.html#prom-dhcp" title="Example�3.8.�DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>.
768
</p><div class="example"><a name="prom-dhcp"></a><p class="title"><b>Example�3.8.�DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><pre class="screen">
769
# Abmas Accounting Inc.
770
default-lease-time 86400;
771
max-lease-time 172800;
772
default-lease-time 86400;
773
option ntp-servers 192.168.1.1;
774
option domain-name "abmas.biz";
775
option domain-name-servers 192.168.1.1, 192.168.2.1;
776
option netbios-name-servers 192.168.1.1, 192.168.2.1;
777
option netbios-node-type 8; ### Node type = Hybrid ###
778
ddns-updates on; ### Dynamic DNS enabled ###
779
ddns-update-style interim;
781
subnet 192.168.1.0 netmask 255.255.255.0 {
782
range dynamic-bootp 192.168.1.128 192.168.1.254;
783
option subnet-mask 255.255.255.0;
784
option routers 192.168.1.1;
785
allow unknown-clients;
787
hardware ethernet 08:00:46:7a:35:e4;
788
fixed-address 192.168.1.20;
791
hardware ethernet 00:03:47:cb:81:e0;
792
fixed-address 192.168.1.30;
795
subnet 192.168.2.0 netmask 255.255.255.0 {
796
range dynamic-bootp 192.168.2.128 192.168.2.254;
797
option subnet-mask 255.255.255.0;
798
option routers 192.168.2.1;
799
allow unknown-clients;
801
hardware ethernet 01:04:31:db:e1:c0;
802
fixed-address 192.168.1.20;
805
hardware ethernet 00:03:47:cf:83:e2;
806
fixed-address 192.168.2.30;
809
subnet 127.0.0.0 netmask 255.0.0.0 {
811
subnet 123.45.67.64 netmask 255.255.255.252 {
813
</pre></div></div><p><br class="example-break">
815
<a class="indexterm" name="id2561965"></a>
816
Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents
817
of the <a class="link" href="secure.html#ch4namedcfg" title="Example�3.9.�DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example�3.10.�DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and
818
<a class="link" href="secure.html#ch4namedvarrev" title="Example�3.11.�DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section”</a> files that are concatenated (merged) in this
821
Create the files shown in their respective directories as shown in <a class="link" href="secure.html#namedrscfiles" title="Table�3.2.�DNS (named) Resource Files">DNS
822
(named) Resource Files</a>.
824
</p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table�3.2.�DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example�15.3.�DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example�15.4.�DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example�15.5.�DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example�3.14.�DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example�3.15.�DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example�3.12.�DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example�3.13.�DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break">
826
</p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example�3.9.�DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id2562175"></a><pre class="screen">
828
# Abmas Biz DNS Control File
830
# Date: November 15, 2003
833
directory "/var/lib/named";
851
zone "localhost" in {
853
file "localhost.zone";
856
zone "0.0.127.in-addr.arpa" in {
871
</pre></div></div><p><br class="example-break">
873
</p><div class="example"><a name="ch4namedvarfwd"></a><p class="title"><b>Example�3.10.�DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</b></p><div class="example-contents"><pre class="screen">
876
file "/var/lib/named/master/abmas.biz.hosts";
890
file "/var/lib/named/master/abmas.us.hosts";
898
</pre></div></div><p><br class="example-break">
900
</p><div class="example"><a name="ch4namedvarrev"></a><p class="title"><b>Example�3.11.�DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</b></p><div class="example-contents"><pre class="screen">
901
zone "1.168.192.in-addr.arpa" {
903
file "/var/lib/named/master/192.168.1.0.rev";
915
zone "2.168.192.in-addr.arpa" {
917
file "/var/lib/named/master/192.168.2.0.rev";
928
</pre></div></div><p><br class="example-break">
930
</p><div class="example"><a name="eth1zone"></a><p class="title"><b>Example�3.12.�DNS 192.168.1 Reverse Zone File</b></p><div class="example-contents"><pre class="screen">
932
$TTL 38400 ; 10 hours 40 minutes
933
1.168.192.in-addr.arpa IN SOA sleeth.abmas.biz. root.abmas.biz. (
935
10800 ; refresh (3 hours)
936
3600 ; retry (1 hour)
937
604800 ; expire (1 week)
938
38400 ; minimum (10 hours 40 minutes)
940
NS sleeth1.abmas.biz.
941
$ORIGIN 1.168.192.in-addr.arpa.
942
1 PTR sleeth1.abmas.biz.
943
20 PTR qmsa.abmas.biz.
944
30 PTR hplj6a.abmas.biz.
945
</pre></div></div><p><br class="example-break">
947
</p><div class="example"><a name="eth2zone"></a><p class="title"><b>Example�3.13.�DNS 192.168.2 Reverse Zone File</b></p><div class="example-contents"><pre class="screen">
949
$TTL 38400 ; 10 hours 40 minutes
950
2.168.192.in-addr.arpa IN SOA sleeth.abmas.biz. root.abmas.biz. (
952
10800 ; refresh (3 hours)
953
3600 ; retry (1 hour)
954
604800 ; expire (1 week)
955
38400 ; minimum (10 hours 40 minutes)
957
NS sleeth2.abmas.biz.
958
$ORIGIN 2.168.192.in-addr.arpa.
959
1 PTR sleeth2.abmas.biz.
960
20 PTR qmsf.abmas.biz.
961
30 PTR hplj6f.abmas.biz.
962
</pre></div></div><p><br class="example-break">
964
</p><div class="example"><a name="abmasbiz"></a><p class="title"><b>Example�3.14.�DNS Abmas.biz Forward Zone File</b></p><div class="example-contents"><pre class="screen">
966
$TTL 38400 ; 10 hours 40 minutes
967
abmas.biz IN SOA sleeth1.abmas.biz. root.abmas.biz. (
969
10800 ; refresh (3 hours)
970
3600 ; retry (1 hour)
971
604800 ; expire (1 week)
972
38400 ; minimum (10 hours 40 minutes)
975
MX 10 mail.abmas.biz.
977
sleeth1 A 192.168.1.1
978
sleeth2 A 192.168.2.1
980
hplj6a A 192.168.1.30
982
hplj6f A 192.168.2.30
984
diamond CNAME sleeth1
986
</pre></div></div><p><br class="example-break">
988
</p><div class="example"><a name="abmasus"></a><p class="title"><b>Example�3.15.�DNS Abmas.us Forward Zone File</b></p><div class="example-contents"><pre class="screen">
990
$TTL 38400 ; 10 hours 40 minutes
991
abmas.us IN SOA server.abmas.us. root.abmas.us. (
993
10800 ; refresh (3 hours)
994
3600 ; retry (1 hour)
995
604800 ; expire (1 week)
996
38400 ; minimum (10 hours 40 minutes)
1000
MX 10 mail.abmas.us.
1002
server A 123.45.67.66
1008
</pre></div></div><p><br class="example-break">
1011
<a class="indexterm" name="id2562388"></a><a class="indexterm" name="id2562394"></a>
1012
All DNS name resolution should be handled locally. To ensure that the server is configured
1013
correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following
1015
</p><pre class="screen">
1016
search abmas.us abmas.biz
1017
nameserver 127.0.0.1
1018
nameserver 123.45.54.23
1020
<a class="indexterm" name="id2562419"></a>
1021
This instructs the name resolver function (when configured correctly) to ask the DNS server
1022
that is running locally to resolve names to addresses. In the event that the local name server
1023
is not available, ask the name server provided by the ISP. The latter, of course, does not resolve
1024
purely local names to IP addresses.
1026
<a class="indexterm" name="id2562440"></a>
1027
The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file.
1028
This file controls the operation of the various resolver libraries that are part of the Linux
1029
Glibc libraries. Edit this file so that it contains the following entries:
1030
</p><pre class="screen">
1031
hosts: files dns wins
1033
</p></li></ol></div><p>
1034
The basic DHCP and DNS services are now ready for validation testing. Before you can proceed,
1035
there are a few more steps along the road. First, configure the print spooling and print
1036
processing system. Then you can configure the server so that all services
1037
start automatically on reboot. You must also manually start all services prior to validation testing.
1038
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p>
1039
Network administrators who are new to CUPS based-printing typically experience some difficulty mastering
1040
its powerful features. The steps outlined in this section are designed to navigate around the distractions
1041
of learning CUPS. Instead of implementing smart features and capabilities, our approach is to use it as a
1042
transparent print queue that performs no filtering, and only minimal handling of each print job that is
1043
submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that
1044
the correct printer driver must be installed on all clients.
1045
</p><div class="procedure"><a name="id2562499"></a><p class="title"><b>Procedure�3.4.�Printer Configuration Steps</b></p><ol type="1"><li><p>
1046
Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines.
1048
Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100.
1049
Use any other port the manufacturer specifies for direct-mode raw printing, and adjust the
1050
port as necessary in the following example commands.
1051
This allows the CUPS spooler to print using raw mode protocols.
1052
<a class="indexterm" name="id2562524"></a>
1053
<a class="indexterm" name="id2562531"></a>
1055
<a class="indexterm" name="id2562545"></a><a class="indexterm" name="id2562553"></a>
1056
Configure the CUPS Print Queues as follows:
1057
</p><pre class="screen">
1058
<code class="prompt">root# </code> lpadmin -p qmsa -v socket://qmsa.abmas.biz:9100 -E
1059
<code class="prompt">root# </code> lpadmin -p hplj6a -v socket://hplj6a.abmas.biz:9100 -E
1060
<code class="prompt">root# </code> lpadmin -p qmsf -v socket://qmsf.abmas.biz:9100 -E
1061
<code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E
1063
<a class="indexterm" name="id2562596"></a>
1064
This creates the necessary print queues with no assigned print filter.
1065
</p></li><li><p><a class="indexterm" name="id2562610"></a>
1066
Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check
1067
the status of the print queues and, if necessary, make certain that the queues you have
1068
just created are enabled by executing the following:
1069
</p><pre class="screen">
1070
<code class="prompt">root# </code> /usr/bin/enable qmsa
1071
<code class="prompt">root# </code> /usr/bin/enable hplj6a
1072
<code class="prompt">root# </code> /usr/bin/enable qmsf
1073
<code class="prompt">root# </code> /usr/bin/enable hplj6f
1075
</p></li><li><p><a class="indexterm" name="id2562665"></a>
1076
Even though your print queues may be enabled, it is still possible that they
1077
are not accepting print jobs. A print queue services incoming printing
1078
requests only when configured to do so. Ensure that your print queues are
1079
set to accept incoming jobs by executing the following commands:
1080
</p><pre class="screen">
1081
<code class="prompt">root# </code> /usr/sbin/accept qmsa
1082
<code class="prompt">root# </code> /usr/sbin/accept hplj6a
1083
<code class="prompt">root# </code> /usr/sbin/accept qmsf
1084
<code class="prompt">root# </code> /usr/sbin/accept hplj6f
1087
<a class="indexterm" name="id2562716"></a>
1088
<a class="indexterm" name="id2562723"></a>
1089
<a class="indexterm" name="id2562730"></a>
1090
Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line:
1091
</p><pre class="screen">
1092
application/octet-stream application/vnd.cups-raw 0 -
1095
<a class="indexterm" name="id2562758"></a>
1096
Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
1097
</p><pre class="screen">
1098
application/octet-stream
1101
Printing drivers are installed on each network client workstation.
1102
</p></li></ol></div><p>
1103
Note: If the parameter <em class="parameter"><code>cups options = Raw</code></em> is specified in the <code class="filename">smb.conf</code> file,
1104
the last two steps can be omitted with CUPS version 1.1.18, or later.
1106
The UNIX system print queues have been configured and are ready for validation testing.
1107
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p>
1108
<a class="indexterm" name="id2562823"></a>
1109
There are two essential steps to process startup configuration. First, the process
1110
must be configured so that it automatically restarts each time the server
1111
is rebooted. This step involves use of the <code class="literal">chkconfig</code> tool that
1112
creates the appropriate symbolic links from the master daemon control file that is
1113
located in the <code class="filename">/etc/rc.d</code> directory, to the <code class="filename">/etc/rc'x'.d</code>
1114
directories. Links are created so that when the system run level is changed, the
1115
necessary start or kill script is run.
1117
<a class="indexterm" name="id2562858"></a>
1118
<a class="indexterm" name="id2562865"></a>
1119
<a class="indexterm" name="id2562872"></a>
1120
<a class="indexterm" name="id2562879"></a>
1121
<a class="indexterm" name="id2562886"></a>
1122
In the event that a service is not run as a daemon, but via the internetworking
1123
super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code>
1124
tool makes the necessary entries in the <code class="filename">/etc/xinetd.d</code> directory
1125
and sends a hang-up (HUP) signal to the the super daemon, thus forcing it to
1126
re-read its control files.
1128
Last, each service must be started to permit system validation to proceed.
1129
</p><div class="procedure"><ol type="1"><li><p>
1130
Use the standard system tool to configure each service to restart
1131
automatically at every system reboot. For example,
1132
<a class="indexterm" name="id2562937"></a>
1133
</p><pre class="screen">
1134
<code class="prompt">root# </code> chkconfig dhpcd on
1135
<code class="prompt">root# </code> chkconfig named on
1136
<code class="prompt">root# </code> chkconfig cups on
1137
<code class="prompt">root# </code> chkconfig smb on
1140
<a class="indexterm" name="id2562981"></a>
1141
<a class="indexterm" name="id2562988"></a>
1142
<a class="indexterm" name="id2562995"></a>
1143
Now start each service to permit the system to be validated.
1144
Execute each of the following in the sequence shown:
1146
</p><pre class="screen">
1147
<code class="prompt">root# </code> /etc/rc.d/init.d/dhcpd restart
1148
<code class="prompt">root# </code> /etc/rc.d/init.d/named restart
1149
<code class="prompt">root# </code> /etc/rc.d/init.d/cups restart
1150
<code class="prompt">root# </code> /etc/rc.d/init.d/smb restart
1152
</p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p>
1153
<a class="indexterm" name="id2563049"></a>
1154
Complex networking problems are most often caused by simple things that are poorly or incorrectly
1155
configured. The validation process adopted here should be followed carefully; it is the result of the
1156
experience gained from years of making and correcting the most common mistakes. Shortcuts often lead to basic errors. You should
1157
refrain from taking shortcuts, from making basic assumptions, and from not exercising due process
1158
and diligence in network validation. By thoroughly testing and validating every step in the process
1159
of network installation and configuration, you can save yourself from sleepless nights and restless
1160
days. A well debugged network is a foundation for happy network users and network administrators.
1161
Later in this book you learn how to make users happier. For now, it is enough to learn to
1162
validate. Let's get on with it.
1163
</p><div class="procedure"><a name="id2563072"></a><p class="title"><b>Procedure�3.5.�Server Validation Steps</b></p><ol type="1"><li><p>
1164
<a class="indexterm" name="id2563083"></a>
1165
One of the most important facets of Samba configuration is to ensure that
1166
name resolution functions correctly. You can check name resolution
1167
with a few simple tests. The most basic name resolution is provided from the
1168
<code class="filename">/etc/hosts</code> file. To test its operation, make a
1169
temporary edit to the <code class="filename">/etc/nsswitch.conf</code> file. Using
1170
your favorite editor, change the entry for <code class="constant">hosts</code> to read:
1171
</p><pre class="screen">
1174
When you have saved this file, execute the following command:
1175
</p><pre class="screen">
1176
<code class="prompt">root# </code> ping diamond
1177
PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data.
1178
64 bytes from sleeth1 (192.168.1.1): icmp_seq=1 ttl=64 time=0.131 ms
1179
64 bytes from sleeth1 (192.168.1.1): icmp_seq=2 ttl=64 time=0.179 ms
1180
64 bytes from sleeth1 (192.168.1.1): icmp_seq=3 ttl=64 time=0.192 ms
1181
64 bytes from sleeth1 (192.168.1.1): icmp_seq=4 ttl=64 time=0.191 ms
1183
--- sleeth1.abmas.biz ping statistics ---
1184
4 packets transmitted, 4 received, 0% packet loss, time 3016ms
1185
rtt min/avg/max/mdev = 0.131/0.173/0.192/0.026 ms
1187
This proves that name resolution via the <code class="filename">/etc/hosts</code> file
1190
<a class="indexterm" name="id2563152"></a>
1191
So far, your installation is going particularly well. In this step we validate
1192
DNS server and name resolution operation. Using your favorite UNIX system editor,
1193
change the <code class="filename">/etc/nsswitch.conf</code> file so that the
1194
<code class="constant">hosts</code> entry reads:
1195
</p><pre class="screen">
1199
<a class="indexterm" name="id2563185"></a>
1200
Before you test DNS operation, it is a good idea to verify that the DNS server
1201
is running by executing the following:
1202
</p><pre class="screen">
1203
<code class="prompt">root# </code> ps ax | grep named
1204
437 ? S 0:00 /sbin/syslogd -a /var/lib/named/dev/log
1205
524 ? S 0:00 /usr/sbin/named -t /var/lib/named -u named
1206
525 ? S 0:00 /usr/sbin/named -t /var/lib/named -u named
1207
526 ? S 0:00 /usr/sbin/named -t /var/lib/named -u named
1208
529 ? S 0:00 /usr/sbin/named -t /var/lib/named -u named
1209
540 ? S 0:00 /usr/sbin/named -t /var/lib/named -u named
1210
2552 pts/2 S 0:00 grep named
1212
This means that we are ready to check DNS operation. Do so by executing:
1213
<a class="indexterm" name="id2563215"></a>
1214
</p><pre class="screen">
1215
<code class="prompt">root# </code> ping diamond
1216
PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data.
1217
64 bytes from sleeth1 (192.168.1.1): icmp_seq=1 ttl=64 time=0.156 ms
1218
64 bytes from sleeth1 (192.168.1.1): icmp_seq=2 ttl=64 time=0.183 ms
1220
--- sleeth1.abmas.biz ping statistics ---
1221
2 packets transmitted, 2 received, 0% packet loss, time 999ms
1222
rtt min/avg/max/mdev = 0.156/0.169/0.183/0.018 ms
1224
You should take a few more steps to validate DNS server operation, as follows:
1225
</p><pre class="screen">
1226
<code class="prompt">root# </code> host -f diamond.abmas.biz
1227
sleeth1.abmas.biz has address 192.168.1.1
1229
<a class="indexterm" name="id2563254"></a>
1230
You may now remove the entry called <code class="constant">diamond</code> from the
1231
<code class="filename">/etc/hosts</code> file. It does not hurt to leave it there,
1232
but its removal reduces the number of administrative steps for this name.
1234
<a class="indexterm" name="id2563279"></a>
1235
WINS is a great way to resolve NetBIOS names to their IP address. You can test
1236
the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way
1237
of the Samba startup method shown in <a class="link" href="secure.html#procstart" title="Process Startup Configuration">“Process Startup Configuration”</a>). You must edit
1238
the <code class="filename">/etc/nsswitch.conf</code> file so that the <code class="constant">hosts</code>
1239
entry is as follows:
1240
</p><pre class="screen">
1243
The next step is to make certain that Samba is running using <code class="literal">ps ax | grep mbd</code>.
1244
The <code class="literal">nmbd</code> daemon will provide the WINS name resolution service when the
1245
<code class="filename">smb.conf</code> file <em class="parameter"><code></code></em> parameter <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = Yes</a> has been specified. Having validated that Samba is operational,
1246
excute the following:
1247
</p><pre class="screen">
1248
<code class="prompt">root# </code> ping diamond
1249
PING diamond (192.168.1.1) 56(84) bytes of data.
1250
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.094 ms
1251
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms
1253
<a class="indexterm" name="id2563371"></a>
1254
Now that you can relax with the knowledge that all three major forms of name
1255
resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code>
1256
again. This time you add all three forms of name resolution to this file.
1257
Your edited entry for <code class="constant">hosts</code> should now look like this:
1258
</p><pre class="screen">
1259
hosts: files dns wins
1261
The system is looking good. Let's move on.
1263
It would give you peace of mind to know that the DHCP server is running
1264
and available for service. You can validate DHCP services by running:
1266
</p><pre class="screen">
1267
<code class="prompt">root# </code> ps ax | grep dhcp
1268
2618 ? S 0:00 /usr/sbin/dhcpd ...
1269
8180 pts/2 S 0:00 grep dhcp
1271
This shows that the server is running. The proof of whether or not it is working
1272
comes when you try to add the first DHCP client to the network.
1274
<a class="indexterm" name="id2563431"></a>
1275
This is a good point at which to start validating Samba operation. You are
1276
content that name resolution is working for basic TCP/IP needs. Let's move on.
1277
If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba
1278
to refuse to start. The first step should always be to validate the contents
1279
of this file by running:
1280
</p><pre class="screen">
1281
<code class="prompt">root# </code> testparm -s
1282
Load smb config files from smb.conf
1283
Processing section "[homes]"
1284
Processing section "[printers]"
1285
Processing section "[netlogon]"
1286
Processing section "[profiles]"
1287
Processing section "[accounts]"
1288
Processing section "[service]"
1289
Processing section "[apps]"
1290
Loaded services file OK.
1293
workgroup = PROMISES
1294
netbios name = DIAMOND
1295
interfaces = eth1, eth2, lo
1296
bind interfaces only = Yes
1297
passdb backend = tdbsam
1298
pam password change = Yes
1299
passwd program = /usr/bin/passwd '%u'
1300
passwd chat = *New*Password* %n\n \
1301
*Re-enter*new*password* %n\n *Password*changed*
1302
username map = /etc/samba/smbusers
1303
unix password sync = Yes
1306
log file = /var/log/samba/%m
1309
name resolve order = wins bcast hosts
1311
printcap name = CUPS
1312
show add printer wizard = No
1313
add user script = /usr/sbin/useradd -m '%u'
1314
delete user script = /usr/sbin/userdel -r '%u'
1315
add group script = /usr/sbin/groupadd '%g'
1316
delete group script = /usr/sbin/groupdel '%g'
1317
add user to group script = /usr/sbin/usermod -G '%g' '%u'
1318
add machine script = /usr/sbin/useradd \
1319
-s /bin/false -d /dev/null '%u'
1320
shutdown script = /var/lib/samba/scripts/shutdown.sh
1321
abort shutdown script = /sbin/shutdown -c
1322
logon script = scripts\logon.bat
1323
logon path = \\%L\profiles\%U
1325
logon home = \\%L\%U
1327
preferred master = Yes
1330
winbind use default domain = Yes
1331
map acl inherit = Yes
1333
veto files = /*.eml/*.nws/*.{*}/
1334
veto oplock files = /*.doc/*.xls/*.mdb/
1337
comment = Home Directories
1342
### Remainder cut to save space ###
1344
Clear away all errors before proceeding.
1346
<a class="indexterm" name="id2563532"></a>
1347
<a class="indexterm" name="id2563539"></a>
1348
<a class="indexterm" name="id2563545"></a>
1349
<a class="indexterm" name="id2563552"></a>
1350
Check that the Samba server is running:
1351
</p><pre class="screen">
1352
<code class="prompt">root# </code> ps ax | grep mbd
1353
14244 ? S 0:00 /usr/sbin/nmbd -D
1354
14245 ? S 0:00 /usr/sbin/nmbd -D
1355
14290 ? S 0:00 /usr/sbin/smbd -D
1357
$rootprompt; ps ax | grep winbind
1358
14293 ? S 0:00 /usr/sbin/winbindd -D
1359
14295 ? S 0:00 /usr/sbin/winbindd -D
1361
The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also
1362
two instances<sup>[<a name="id2563584" href="#ftn.id2563584" class="footnote">7</a>]</sup> of it.
1364
<a class="indexterm" name="id2563614"></a>
1365
<a class="indexterm" name="id2563621"></a>
1366
Check that an anonymous connection can be made to the Samba server:
1367
</p><pre class="screen">
1368
<code class="prompt">root# </code> smbclient -L localhost -U%
1370
Sharename Type Comment
1371
--------- ---- -------
1372
IPC$ IPC IPC Service (Samba 3.0.20)
1373
netlogon Disk Network Logon Service
1374
profiles Disk Profile Share
1375
accounts Disk Accounting Files
1376
service Disk Financial Services Files
1377
apps Disk Application Files
1378
ADMIN$ IPC IPC Service (Samba 3.0.20)
1379
hplj6a Printer hplj6a
1380
hplj6f Printer hplj6f
1386
DIAMOND Samba 3.0.20
1392
This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
1393
of browsing the server from a Windows client to obtain a list of shares on the server.
1394
The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and
1395
a <code class="constant">NULL</code> password.
1397
<a class="indexterm" name="id2563679"></a>
1398
<a class="indexterm" name="id2563686"></a>
1399
<a class="indexterm" name="id2563693"></a>
1400
Verify that each printer has the IP address assigned in the DHCP server configuration file.
1401
The easiest way to do this is to ping the printer name. Immediately after the ping response
1402
has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer
1403
that has responded. Now you can compare the IP address and the MAC address of the printer
1404
with the configuration information in the <code class="filename">/etc/dhcpd.conf</code> file. They
1405
should, of course, match. For example,
1406
</p><pre class="screen">
1407
<code class="prompt">root# </code> ping hplj6
1408
PING hplj6a (192.168.1.30) 56(84) bytes of data.
1409
64 bytes from hplj6a (192.168.1.30): icmp_seq=1 ttl=64 time=0.113 ms
1411
<code class="prompt">root# </code> arp -a
1412
hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0
1414
<a class="indexterm" name="id2563739"></a>
1415
The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the
1416
IP address from which the printer has responded and with the entry for it in the
1417
<code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured.
1419
<a class="indexterm" name="id2563768"></a>
1420
Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool:
1421
</p><pre class="screen">
1422
<code class="prompt">root# </code> smbclient //diamond/accounts -U gholmes
1425
. D 0 Thu Nov 27 15:07:09 2003
1426
.. D 0 Sat Nov 15 17:40:50 2003
1427
zakadmin.exe 161424 Thu Nov 27 15:06:52 2003
1428
zak.exe 6066384 Thu Nov 27 15:06:52 2003
1429
dhcpd.conf 1256 Thu Nov 27 15:06:52 2003
1430
smb.conf 2131 Thu Nov 27 15:06:52 2003
1431
initGrps.sh A 1089 Thu Nov 27 15:06:52 2003
1432
POLICY.EXE 86542 Thu Nov 27 15:06:52 2003
1434
55974 blocks of size 65536. 33968 blocks available
1438
<a class="indexterm" name="id2563825"></a>
1439
Your new server is connected to an Internet-accessible connection. Before you start
1440
your firewall, you should run a port scanner against your system. You should repeat that
1441
after the firewall has been started. This helps you understand to what extent the
1442
server may be vulnerable to external attack. One way you can do this is by using an
1443
external service, such as the <a class="ulink" href="http://www.dslreports.com/scan" target="_top">DSL Reports</a>
1444
tools. Alternately, if you can gain root-level access to a remote
1445
UNIX/Linux system that has the <code class="literal">nmap</code> tool, you can run the following:
1446
</p><pre class="screen">
1447
<code class="prompt">root# </code> nmap -v -sT server.abmas.us
1449
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
1450
Host server.abmas.us (123.45.67.66) appears to be up ... good.
1451
Initiating Connect() Scan against server.abmas.us (123.45.67.66)
1452
Adding open port 6000/tcp
1453
Adding open port 873/tcp
1454
Adding open port 445/tcp
1455
Adding open port 10000/tcp
1456
Adding open port 901/tcp
1457
Adding open port 631/tcp
1458
Adding open port 25/tcp
1459
Adding open port 111/tcp
1460
Adding open port 32770/tcp
1461
Adding open port 3128/tcp
1462
Adding open port 53/tcp
1463
Adding open port 80/tcp
1464
Adding open port 443/tcp
1465
Adding open port 139/tcp
1466
Adding open port 22/tcp
1467
The Connect() Scan took 0 seconds to scan 1601 ports.
1468
Interesting ports on server.abmas.us (123.45.67.66):
1469
(The 1587 ports scanned but not shown below are in state: closed)
1476
139/tcp open netbios-ssn
1478
445/tcp open microsoft-ds
1481
901/tcp open samba-swat
1482
3128/tcp open squid-http
1484
10000/tcp open snet-sensor-mgmt
1485
32770/tcp open sometimes-rpc3
1487
Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
1489
The above scan was run before the external interface was locked down with the NAT-firewall
1490
script you created above. The following results are obtained after the firewall rules
1491
have been put into place:
1492
</p><pre class="screen">
1493
<code class="prompt">root# </code> nmap -v -sT server.abmas.us
1495
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
1496
Host server.abmas.us (123.45.67.66) appears to be up ... good.
1497
Initiating Connect() Scan against server.abmas.us (123.45.67.66)
1498
Adding open port 53/tcp
1499
Adding open port 22/tcp
1500
The Connect() Scan took 168 seconds to scan 1601 ports.
1501
Interesting ports on server.abmas.us (123.45.67.66):
1502
(The 1593 ports scanned but not shown below are in state: filtered)
1508
443/tcp closed https
1510
Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds
1512
</p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p>
1513
<a class="indexterm" name="id2563928"></a>
1514
<a class="indexterm" name="id2563935"></a>
1515
The use of an application server is a key mechanism by which desktop administration overheads
1516
can be reduced. Check the application manual for your software to identify how best to
1517
create an administrative installation.
1519
Some Windows software will only run locally on the desktop computer. Such software
1520
is typically not suited for administrative installation. Administratively installed software
1521
permits one or more of the following installation choices:
1522
</p><div class="itemizedlist"><ul type="disc"><li><p>
1523
Install software fully onto a workstation, storing data files on the same workstation.
1525
Install software fully onto a workstation with central network data file storage.
1527
Install software to run off a central application server with data files stored
1528
on the local workstation. This is often called a minimum installation, or a
1529
network client installation.
1531
Install software to run off a central application server with data files stored
1532
on a central network share. This type of installation often prevents storage
1533
of work files on the local workstation.
1534
</p></li></ul></div><p>
1535
<a class="indexterm" name="id2563987"></a>
1536
A common application deployed in this environment is an office suite.
1537
Enterprise editions of Microsoft Office XP Professional can be administratively installed
1538
by launching the installation from a command shell. The command that achieves this is
1539
<code class="literal">setup /a</code>. It results in a set of prompts through which various
1540
installation choices can be made. Refer to the Microsoft Office Resource SDK and Resource
1541
Kit for more information regarding this mode of installation of MS Office XP Professional.
1542
The full administrative installation of MS Office XP Professional requires approximately
1543
650 MB of disk space.
1545
When the MS Office XP Professional product has been installed to the administrative network
1546
share, the product can be installed onto a workstation by executing the normal setup program.
1547
The installation process now provides a choice to either perform a minimum installation
1548
or a full local installation. A full local installation takes over 100 MB of disk space.
1549
A network workstation (minimum) installation requires typically 10 MB to 15 MB of
1550
local disk space. In the latter case, when the applications are used, they load over the network.
1552
<a class="indexterm" name="id2564024"></a>
1553
<a class="indexterm" name="id2564031"></a>
1554
Microsoft Office Service Packs can be unpacked to update an administrative share. This makes
1555
it possible to update MS Office XP Professional for all users from a single installation
1556
of the service pack and generally circumvents the need to run updates on each network
1559
The default location for MS Office XP Professional data files can be set through registry
1560
editing or by way of configuration options inside each Office XP Professional application.
1562
<a class="indexterm" name="id2564053"></a>
1563
OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also
1564
be installed to run off a network share. The latter is a most desirable solution for office-bound
1565
network users and for administrative staff alike. It permits quick and easy updates
1566
to be rolled out to all users with a minimum of disruption and with maximum flexibility.
1568
The process for installation of administrative shared OpenOffice involves download of the
1569
distribution ZIP file, followed by extraction of the ZIP file into a temporary disk area.
1570
When fully extracted using the unzipping tool of your choosing, change into the Windows
1571
installation files directory then execute <code class="literal">setup -net</code>. You are
1572
prompted on screen for the target installation location. This is the administrative
1573
share point. The full administrative OpenOffice share takes approximately 150 MB of disk
1575
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2564084"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>
1576
Many single-user products can be installed into an administrative share, but
1577
personal versions of products such as Microsoft Office XP Professional do not permit this.
1578
Many people do not like terms of use typical with commercial products, so a few comments
1579
regarding software licensing seem important.
1581
Please do not use an administrative installation of proprietary and commercially licensed
1582
software products to violate the copyright holders' property. All software is licensed,
1583
particularly software that is licensed for use free of charge. All software is the property
1584
of the copyright holder unless the author and/or copyright holder has explicitly disavowed
1585
ownership and has placed the software into the public domain.
1587
Software that is under the GNU General Public License, like proprietary software, is
1588
licensed in a way that restricts use. For example, if you modify GPL software and then
1589
distribute the binary version of your modifications, you must offer to provide the source
1590
code as well. This restriction is designed to maintain the momentum
1591
of the diffusion of technology and to protect against the withholding of innovations.
1593
Commercial and proprietary software generally restrict use to those who have paid the
1594
license fees and who comply with the licensee's terms of use. Software that is released
1595
under the GNU General Public License is restricted to particular terms and conditions
1596
also. Whatever the licensing terms may be, if you do not approve of the terms of use,
1597
please do not use the software.
1599
<a class="indexterm" name="id2564133"></a>
1600
Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided
1601
with the source code.
1602
</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p>
1603
Christine needs to roll out 130 new desktop systems. There is no doubt that she also needs
1604
to reinstall many of the notebook computers that will be recycled for use with the new network
1605
configuration. The smartest way to handle the challenge of the roll-out program is to build
1606
a staged system for each type of target machine, and then use an image replication tool such as Norton
1607
Ghost (enterprise edition) to replicate the staged machine to its target desktops. The same can
1608
be done with notebook computers as long as they are identical or sufficiently similar.
1609
</p><div class="procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure�3.6.�Windows Client Configuration Procedure</b></p><ol type="1"><li><p>
1610
<a class="indexterm" name="id2564183"></a>
1611
<a class="indexterm" name="id2564190"></a>
1612
Install MS Windows XP Professional. During installation, configure the client to use DHCP for
1613
TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server
1614
address that has been defined for the local subnet.
1616
Join the Windows Domain <code class="constant">PROMISES</code>. Use the Domain Administrator
1617
username <code class="constant">root</code> and the SMB password you assigned to this account.
1618
A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
1619
a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter�15.�A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>.
1620
Reboot the machine as prompted and then log on using the Domain Administrator account
1621
(<code class="constant">root</code>).
1623
Verify <code class="constant">DIAMOND</code> is visible in <span class="guimenu">My Network Places</span>,
1624
that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>,
1625
<span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>, and that it is
1626
possible to open each share to reveal its contents.
1628
Create a drive mapping to the <code class="constant">apps</code> share on the server <code class="constant">DIAMOND</code>.
1630
Perform an administrative installation of each application to be used. Select the options
1631
that you wish to use. Of course, you can choose to run applications over the network, correct?
1633
Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
1634
NTP-based time synchronization software, drivers for specific local devices such as fingerprint
1635
scanners, and the like. Probably the most significant application for local installation
1636
is antivirus software.
1638
Now install all four printers onto the staging system. The printers you install
1639
include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers. You will
1640
also configure identical printers that are located in the financial services department.
1641
Install printers on each machine following the steps shown in the Windows client printer
1642
preparation procedure below.
1644
<a class="indexterm" name="id2564328"></a>
1645
When you are satisfied that the staging systems are complete, use the appropriate procedure to
1646
remove the client from the domain. Reboot the system and then log on as the local administrator
1647
and clean out all temporary files stored on the system. Before shutting down, use the disk
1648
defragmentation tool so that the file system is in optimal condition before replication.
1650
Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the
1651
machine to a network share on the server.
1653
<a class="indexterm" name="id2564357"></a>
1654
<a class="indexterm" name="id2564366"></a>
1655
You may now replicate the image to the target machines using the appropriate Norton Ghost
1656
procedure. Make sure to use the procedure that ensures each machine has a unique
1657
Windows security identifier (SID). When the installation of the disk image has completed, boot the PC.
1659
Log on to the machine as the local Administrator (the only option), and join the machine to
1660
the Domain, following the procedure set out in <a class="link" href="appendix.html" title="Chapter�15.�A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. The system is now
1661
ready for the user to log on, provided you have created a network logon account for that
1664
Instruct all users to log on to the workstation using their assigned username and password.
1665
</p></li></ol></div><div class="procedure"><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure�3.7.�Windows Client Printer Preparation Procedure</b></p><ol type="1"><li><p>
1666
Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
1667
Ensure that <span class="guimenuitem">Local printer</span> is selected.
1669
Click <span class="guibutton">Next</span>. In the
1670
<span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
1671
In the <span class="guimenuitem">Printers:</span> panel, select the printer called
1672
<code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>.
1674
In the <span class="guimenuitem">Available ports:</span> panel, select
1675
<code class="constant">FILE:</code>. Accept the default printer name by clicking
1676
<span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a
1677
test page?,</span>” click <span class="guimenuitem">No</span>. Click
1678
<span class="guibutton">Finish</span>.
1680
You may be prompted for the name of a file to print to. If so, close the
1681
dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>.
1683
In the <span class="guimenuitem">Network</span> panel, enter the name of
1684
the print queue on the Samba server as follows: <code class="constant">\\DIAMOND\hplj6a</code>.
1685
Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
1687
Repeat the printer installation steps above for both HP LaserJet 6 printers
1688
as well as for both QMS Magicolor laser printers.
1689
</p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2564636"></a>Key Points Learned</h3></div></div></div><p>
1690
How do you feel? You have built a capable network, a truly ambitious project.
1691
Future network updates can be handled by
1692
your staff. You must be a satisfied manager. Let's review the achievements.
1693
</p><div class="itemizedlist"><ul type="disc"><li><p>
1694
A simple firewall has been configured to protect the server in the event that
1695
the ISP firewall service should fail.
1697
The Samba configuration uses measures to ensure that only local network users
1698
can connect to SMB/CIFS services.
1700
Samba uses the new <code class="constant">tdbsam</code> passdb backend facility.
1701
Considerable complexity was added to Samba functionality.
1703
A DHCP server was configured to implement dynamic DNS (DDNS) updates to the DNS
1706
The DNS server was configured to permit DDNS only for local network clients. This
1707
server also provides primary DNS services for the company Internet presence.
1709
You introduced an application server as well as the concept of cloning a Windows
1710
client in order to effect improved standardization of desktops and to reduce
1711
the costs of network management.
1712
</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564698"></a>Questions and Answers</h2></div></div></div><p>
1713
</p><div class="qandaset"><dl><dt>1. <a href="secure.html#id2564714">
1714
What is the maximum number of account entries that the tdbsam
1715
passdb backend can handle?
1716
</a></dt><dt>2. <a href="secure.html#id2564783">
1717
Would Samba operate any better if the OS level is set to a value higher than 35?
1718
</a></dt><dt>3. <a href="secure.html#id2564805">
1719
Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?
1720
</a></dt><dt>4. <a href="secure.html#id2564827">
1721
Why has a path been specified in the IPC$ share?
1722
</a></dt><dt>5. <a href="secure.html#id2564856">
1723
Why does the smb.conf file in this exercise include an entry for smb ports?
1724
</a></dt><dt>6. <a href="secure.html#id2564902">
1725
What is the difference between a print queue and a printer?
1726
</a></dt><dt>7. <a href="secure.html#id2564938">
1727
Can all MS Windows application software be installed onto an application server share?
1728
</a></dt><dt>8. <a href="secure.html#id2564963">
1729
Why use dynamic DNS (DDNS)?
1730
</a></dt><dt>9. <a href="secure.html#id2564983">
1731
Why would you use WINS as well as DNS-based name resolution?
1732
</a></dt><dt>10. <a href="secure.html#id2565068">
1733
What are the major benefits of using an application server?
1734
</a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2564714"></a><a name="id2564716"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>
1735
What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em>
1736
passdb backend can handle?
1737
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1738
The tdb data structure and support system can handle more entries than the number of
1739
accounts that are possible on most UNIX systems. A practical limit would come into
1740
play long before a performance boundary would be anticipated. That practical limit
1741
is controlled by the nature of Windows networking. There are few Windows file and
1742
print servers that can handle more than a few hundred concurrent client connections.
1743
The key limiting factors that predicate offloading of services to additional servers
1744
are memory capacity, the number of CPUs, network bandwidth, and disk I/O limitations.
1745
All of these are readily exhausted by just a few hundred concurrent active users.
1746
Such bottlenecks can best be removed by segmentation of the network (distributing
1747
network load across multiple networks).
1749
As the network grows, it becomes necessary to provide additional authentication
1750
servers (domain controllers). The tdbsam is limited to a single machine and cannot
1751
be reliably replicated. This means that practical limits on network design dictate
1752
the point at which a distributed passdb backend is required; at this time, there is
1753
no real alternative other than ldapsam (LDAP).
1755
The guideline provided in <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, Section 10.1.2,
1756
is to limit the number of accounts in the tdbsam backend to 250. This is the point
1757
at which most networks tend to want backup domain controllers (BDCs). Samba-3 does
1758
not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The
1759
limitation of 250 users per tdbsam is predicated only on the need for replication,
1760
not on the limits<sup>[<a name="id2564772" href="#ftn.id2564772" class="footnote">8</a>]</sup> of the tdbsam backend itself.
1761
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564783"></a><a name="id2564785"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>
1762
Would Samba operate any better if the OS level is set to a value higher than 35?
1763
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1764
No. MS Windows workstations and servers do not use a value higher than 33. Setting this to a value
1765
of 35 already assures Samba of precedence over MS Windows products in browser elections. There is
1766
no gain to be had from setting this higher.
1767
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564805"></a><a name="id2564807"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>
1768
Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?
1769
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1770
At this time, Samba has the capacity to use only Domain Groups mappings. It is possible that at
1771
a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special
1772
Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups.
1773
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564827"></a><a name="id2564830"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>
1774
Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share?
1775
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1776
This is done so that in the event that a software bug may permit a client connection to the IPC$ share to
1777
obtain access to the file system, it does so at a location that presents least risk. Under normal operation
1778
this type of paranoid step should not be necessary. The use of this parameter should not be necessary.
1779
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564856"></a><a name="id2564858"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>
1780
Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS" target="_top">smb ports</a>?
1781
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1782
The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port
1783
used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS
1784
over TCP/IP. In this configuration Windows network operations are predicated around NetBIOS over TCP/IP. By
1785
specifying the use of only port 139, the intent is to reduce unsuccessful service connection attempts.
1786
The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain
1787
member, the default behavior is highly beneficial and should not be changed.
1788
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564902"></a><a name="id2564905"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>
1789
What is the difference between a print queue and a printer?
1790
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1791
A printer is a physical device that is connected either directly to the network or to a computer
1792
via a serial, parallel, or USB connection so that print jobs can be submitted to it to create a
1793
hard copy printout. Network-attached printers that use TCP/IP-based printing generally accept a
1794
single print data stream and block all secondary attempts to dispatch jobs concurrently to the
1795
same device. If many clients were to concurrently print directly via TCP/IP to the same printer,
1796
it would result in a huge amount of network traffic through continually failing connection attempts.
1798
A print server (like CUPS or LPR/LPD) accepts multiple concurrent input streams or
1799
print requests. When the data stream has been fully received, the input stream is closed,
1800
and the job is then submitted to a sequential print queue where the job is stored until
1801
the printer is ready to receive the job.
1802
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564938"></a><a name="id2564940"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>
1803
Can all MS Windows application software be installed onto an application server share?
1804
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1805
Much older Windows software is not compatible with installation to and execution from
1806
an application server. Enterprise versions of Microsoft Office XP Professional can
1807
be installed to an application server. Retail consumer versions of Microsoft Office XP
1808
Professional do not permit installation to an application server share and can be installed
1809
and used only to/from a local workstation hard disk.
1810
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564963"></a><a name="id2564965"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>
1811
Why use dynamic DNS (DDNS)?
1812
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1813
When DDNS records are updated directly from the DHCP server, it is possible for
1814
network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate
1815
Windows clients via DNS.
1816
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564983"></a><a name="id2564985"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>
1817
Why would you use WINS as well as DNS-based name resolution?
1818
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1819
WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is
1820
a name like “<span class="quote">myhost.mydomain.tld</span>” where <em class="parameter"><code>tld</code></em>
1821
means <code class="constant">top-level domain</code>. A FQDN is a longhand but easy-to-remember
1822
expression that may be up to 1024 characters in length and that represents an IP address.
1823
A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character
1824
is a name type indicator. A specific name type is registered<sup>[<a name="id2565020" href="#ftn.id2565020" class="footnote">9</a>]</sup> for each
1825
type of service that is provided by the Windows server or client and that may be registered
1826
where a WINS server is in use.
1828
WINS is a mechanism by which a client may locate the IP Address that corresponds to a
1829
NetBIOS name. The WINS server may be queried to obtain the IP Address for a NetBIOS name
1830
that includes a particular registered NetBIOS name type. DNS does not provide a mechanism
1831
that permits handling of the NetBIOS name type information.
1833
DNS provides a mechanism by which TCP/IP clients may locate the IP address of a particular
1834
hostname or service name that has been registered in the DNS database for a particular domain.
1835
A DNS server has limited scope of control and is said to be authoritative for the zone over
1836
which it has control.
1838
Windows 200x Active Directory requires the registration in the DNS zone for the domain it
1839
controls of service locator<sup>[<a name="id2565054" href="#ftn.id2565054" class="footnote">10</a>]</sup> records
1840
that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also
1841
requires the registration of special records that are called global catalog (GC) entries
1842
and site entries by which domain controllers and other essential ADS servers may be located.
1843
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2565068"></a><a name="id2565070"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>
1844
What are the major benefits of using an application server?
1845
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1846
The use of an application server can significantly reduce application update maintenance.
1847
By providing a centralized application share, software updates need be applied to only
1848
one location for all major applications used. This results in faster update roll-outs and
1849
significantly better application usage control.
1850
</p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2559616" href="#id2559616" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.
1851
This is necessary so that Samba can act as a Domain Controller (PDC); see
1852
<span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2559997" href="#id2559997" class="para">6</a>] </sup>You may want to do the echo command last and include
1853
"0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2563584" href="#id2563584" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,
1854
Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional
1855
<code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client
1856
connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2564772" href="#id2564772" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very
1857
effective database technology. There is surprisingly little performance loss even
1858
with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2565020" href="#id2565020" class="para">9</a>] </sup>
1859
See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2565054" href="#id2565054" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�2.�Small Office Networking�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�4.�The 500-User Office</td></tr></table></div></body></html>
added
removed
docs/htmldocs/Samba3-ByExample/secure.html
