1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�2.�Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part�I.�Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter�1.�No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter�3.�Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�2.�Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><th width="60%" align="center">Part�I.�Example Network Configurations</th><td width="20%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter�2.�Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2555435">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555458">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555518">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555566">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2555765">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555786">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2557330">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2557978">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2558003">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2558077">Questions and Answers</a></span></dt></dl></div><p>
2
<a class="link" href="simple.html" title="Chapter�1.�No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective
3
network solutions. Network administrators who take pride in their work
4
(that's most of us, right?) take care to deliver what our users want,
5
but not too much more. If we make things too complex, we confound our users
6
and increase costs of network ownership. A professional network manager
7
avoids the temptation to put too much pizazz into the way that the network
8
operates. Some creativity is helpful, but keep it under control
9
good advice that the following two scenarios illustrate.
11
<a class="indexterm" name="id2555391"></a>
12
In one case the network administrator of a mid-sized company spent three
13
months building a new network to replace an old Netware server. What he
14
delivered had all the bells and whistles he could muster. There were a
15
few teething problems during the changeover, nothing serious but a little
16
disruptive all the same. Users were exposed to many changes at once. The
17
network administrator was asked to resign two months after implementing
18
the new system because so many staff complained they had lost time and
19
were not happy with the new network. Everything was automated, and he
20
delivered more features than any advanced user could think of. He was
21
just too smart for his own good.
23
In the case of the other company, a new network manager was appointed
24
to oversee the replacement of a LanTastic network with an MS Windows
25
NT 4.0 network. He had the replacement installed and operational within
26
two weeks. Before installation and changeover, he called a meeting to
27
explain to all users what was going to happen, how it would affect them,
28
and that he would be available 24 hours a day to help them transition.
29
One week after conversion, he held another meeting asking for cooperation
30
in the introduction of a few new features that would help to make life
31
easier. Network users were thrilled with the help he provided. The network
32
he implemented was nowhere near as complex as in the first example, had fewer
33
features, and yet he had happy users. Months later he was still adding
34
new innovations. He always asked the users if a
35
particular feature was what they wanted. He asked his boss for a raise
36
and got it. He often told me, “<span class="quote">Always keep a few new tricks up your
37
sleeves for when you need them.</span>” Was he smart? You decide. Let's
38
get on with our next exercise.
39
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555435"></a>Introduction</h2></div></div></div><p>
40
Abmas Accounting has grown. Mr. Meany likes you and says he knew you
41
were the right person for the job. That's why he asked you to install the
42
new server. The past few months have been hard work. You advised Mr. Meany
43
that it is time for a change. Abmas now has 52 users, having acquired an
44
investment consulting business recently. The new users were added to the
45
network without any problems.
47
Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on
48
some of the workstations that came with the acquired business and found some machines in need of both
49
hardware and software maintenance.
50
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555458"></a>Assignment Tasks</h3></div></div></div><p>
51
<a class="indexterm" name="id2555465"></a>
52
Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
53
that the business is running efficiently. Many of the new staff want notebook
54
computers. They visit customer business premises and need to use local network
55
facilities; these users are technically competent. The company uses a
56
business application that requires Windows XP Professional. In short, a complete
57
client upgrade is about to happen. Mr. Meany told you that he is working
58
on another business acquisition and that by the time he retires there will be
61
Mr. Meany is not concerned about security. He wants to make it easier for
62
staff to do their work. He has hired you to help him appoint a full-time
63
network manager before he retires. Above all, he says he is investing in
64
the ability to grow. He is determined to live his lifelong dream and
65
hand the business over to a bright and capable executive who can make
66
things happen. This means your network design must cope well with
69
In a few months, Abmas will require an Internet connection for email and so
70
that staff can easily obtain software updates. Mr. Meany is warming up to
71
the installation of antivirus software but is not yet ready to approve
72
this expense. He told you to spend the money a virus scanner costs
73
on better quality notebook computers for mobile users.
75
One of Mr. Meany's golfing partners convinced him to buy new laser
76
printers, one black only, the other a color laser printer. Staff support
77
the need for a color printer so they can present more attractive proposals
80
Mr. Meany also asked if it would be possible for one of the staff to manage
81
user accounts from the Windows desktop. That person will be responsible for
83
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555518"></a>Dissection and Discussion</h2></div></div></div><p>
84
What are the key requirements in this business example? A quick review indicates
86
</p><div class="itemizedlist"><ul type="disc"><li><p>
87
Scalability, from 52 to over 100 users in 12 months
89
Mobile computing capability
90
<a class="indexterm" name="id2555539"></a>
92
Improved reliability and usability
95
</p></li></ul></div><p>
96
In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
97
(as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>).
99
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555566"></a>Technical Issues</h3></div></div></div><p>
100
<a class="indexterm" name="id2555574"></a>
101
<a class="indexterm" name="id2555580"></a>
102
<a class="indexterm" name="id2555586"></a>
103
<a class="indexterm" name="id2555592"></a>
104
<a class="indexterm" name="id2555599"></a>
105
It is time to implement a domain security environment. You will use the <code class="constant">
106
smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to
107
run DNS at this time, but the system will use WINS. The domain name will be <code class="constant">
108
BILLMORE</code>. This time, the name of the server will be <code class="constant">SLEETH</code>.
110
All printers will be configured as DHCP clients. The DHCP server will assign
111
the printer a fixed IP address by way of its Ethernet interface (MAC) address.
112
See <a class="link" href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>.
113
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
114
The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness
115
with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
116
possible to start with the installation that you have created here, migrate it
117
to a Samba-3 configuration, and then secure the system further. Configurations following
118
this one utilize features that may not be supported in Samba-2.2.x releases.
119
However, you should note that the examples in each chapter start with the assumption
120
that a fresh new installation is being effected.
122
Later on, when the Internet connection is implemented, you will add DNS as well as
123
other enhancements. It is important that you plan accordingly.
125
<a class="indexterm" name="id2555658"></a>
126
You have split the network into two separate areas. Each has its own Ethernet switch.
127
There are 20 users on the accounting network and 32 users on the financial services
128
network. The server has two network interfaces, one serving each network. The
129
network printers will be located in a central area. You plan to install the new
130
printers and keep the old printer in use also.
132
You will provide separate file storage areas for each business entity. The old system
133
will go away, accounting files will be handled under a single directory, and files will
134
be stored under customer name, not under a personal work area. Staff will be made
135
responsible for file location, so the old share point must be maintained.
137
Given that DNS will not be used, you will configure WINS name resolution for UNIX
138
hostname name resolution.
140
<a class="indexterm" name="id2555688"></a>
141
<a class="indexterm" name="id2555696"></a>
142
It is necessary to map Windows Domain Groups to UNIX groups. It is
143
advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
144
key staff groups in the firm are accounting staff and financial services staff.
145
For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
147
In the sample <code class="filename">smb.conf</code> file, you have configured Samba to call the UNIX
148
<code class="literal">groupadd</code> to add group entries. This utility does not permit
149
the addition of group names that contain uppercase characters or spaces. This
150
is considered a bug. The <code class="literal">groupadd</code> is part of the
151
<code class="literal">shadow-utils</code> open source software package. A later release
152
of this package may have been patched to resolve this bug. If your operating
153
platform has this bug, it means that attempts to add a Windows Domain Group that
154
has either a space or uppercase characters in it will fail. See
155
<span class="emphasis"><em>TOSHARG2</em></span>, Chapter 11, Section 11.3.1, Example 11.1, for
158
<a class="indexterm" name="id2555751"></a>
159
Vendor-supplied printer drivers will be installed on each client. The CUPS print
160
spooler on the UNIX host will be operated in <code class="constant">raw</code> mode.
161
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555765"></a>Political Issues</h3></div></div></div><p>
162
Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
163
He is willing to spend money on things he believes are of value. You need more
164
time to convince him of real priorities.
166
Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
167
supplied with antivirus software? Above all, demonstrate good purchase value and remember
168
to make your users happy.
169
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555786"></a>Implementation</h2></div></div></div><p>
170
<a class="indexterm" name="id2555793"></a>
171
In this example, the assumption is made that this server is being configured from a clean start.
172
The alternate approach could be to demonstrate the migration of the system that is documented
173
in <a class="link" href="simple.html#AcctgNet" title="Implementation">“Implementation”</a> to meet the new requirements. The decision to treat this case, as with
174
future examples, as a new installation is based on the premise that you can determine
175
the migration steps from the information provided in <a class="link" href="ntmigration.html" title="Chapter�9.�Migrating NT4 Domain to Samba-3">“Migrating NT4 Domain to Samba-3”</a>.
176
Additionally, a fresh installation makes the example easier to follow.
178
<a class="indexterm" name="id2555819"></a>
179
Each user will be given a home directory on the UNIX system, which will be available as a private
180
share. Two additional shares will be created, one for the accounting department and the other for
181
the financial services department. Network users will be given access to these shares by way
184
<a class="indexterm" name="id2555834"></a>
185
UNIX group membership is the primary mechanism by which Windows Domain users will be granted
186
rights and privileges within the Windows environment.
188
<a class="indexterm" name="id2555849"></a>
189
The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved
190
by setting the sticky bit (set UID/GID) on the top-level directories.
191
</p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure�2.1.�Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id2555903"></a><p class="title"><b>Procedure�2.1.�Server Installation Steps</b></p><ol type="1"><li><p>
192
Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>.
194
<a class="indexterm" name="id2555924"></a>
195
Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>.
196
The printers are network attached, so there should be entries for the
197
network printers also. An example <code class="filename">/etc/hosts</code> file is shown here:
198
</p><pre class="screen">
199
192.168.1.1 sleeth sleeth1
206
Install the Samba-3 binary RPM from the Samba-Team FTP site.
208
Install the ISC DHCP server using the UNIX/Linux system tools available to you.
210
<a class="indexterm" name="id2555975"></a>
211
<a class="indexterm" name="id2555981"></a>
212
<a class="indexterm" name="id2555988"></a>
213
<a class="indexterm" name="id2555994"></a>
214
Because Samba will be operating over two network interfaces and clients on each side
215
may want to be able to reach clients on the other side, it is imperative that IP forwarding
216
is enabled. Use the system tool of your choice to enable IP forwarding. In the
217
absence of such a tool on the Linux system, add to the <code class="filename">/etc/rc.d/rc.local</code>
218
file an entry as follows:
219
</p><pre class="screen">
220
echo 1 > /proc/sys/net/ipv4/ip_forward
222
This causes the Linux kernel to forward IP packets so that it acts as a router.
224
Install the <code class="filename">smb.conf</code> file as shown in <a class="link" href="small.html#acct2conf" title="Example�2.3.�Accounting Office Network smb.conf File [globals] Section">“Accounting Office Network smb.conf File [globals] Section”</a> and
225
<a class="link" href="small.html#acct3conf" title="Example�2.4.�Accounting Office Network smb.conf File Services and Shares Section">“Accounting Office Network smb.conf File Services and Shares Section”</a>. Combine these two examples to form a single
226
<code class="filename">/etc/samba/smb.conf</code> file.
228
<a class="indexterm" name="id2556053"></a>
229
Add the user <code class="literal">root</code> to the Samba password backend:
230
</p><pre class="screen">
231
<code class="prompt">root# </code> smbpasswd -a root
232
New SMB password: XXXXXXX
233
Retype new SMB password: XXXXXXX
234
<code class="prompt">root# </code>
236
<a class="indexterm" name="id2556082"></a>
237
This is the Windows Domain Administrator password. Never delete this account from
238
the password backend after Windows Domain Groups have been initialized. If you delete
239
this account, your system is crippled. You cannot restore this account,
240
and your Samba server can no longer be administered.
242
<a class="indexterm" name="id2556100"></a>
243
Create the username map file to permit the <code class="constant">root</code> account to be called
244
<code class="constant">Administrator</code> from the Windows network environment. To do this, create
245
the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
246
</p><pre class="screen">
252
# Unix_ID = Windows_ID
255
# root = Administrator
256
# janes = "Jane Smith"
259
# Note: If the name contains a space it must be double quoted.
260
# In the example above the name 'jimbo' will be mapped to Windows
261
# user names 'Jim' and 'Bones' because the space was not quoted.
262
#######################################################################
269
<a class="indexterm" name="id2556140"></a>
270
Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
271
<a class="link" href="small.html#initGrps" title="Example�2.1.�Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours
272
<code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed,
273
and then execute the script. Sample output should be as follows:
275
</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example�2.1.�Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2556169"></a><pre class="screen">
285
# Map Windows Domain Groups to UNIX groups
286
net groupmap add ntgroup="Domain Admins" unixgroup=root type=d
287
net groupmap add ntgroup="Domain Users" unixgroup=users type=d
288
net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d
290
# Add Functional Domain Groups
291
net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
292
net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
293
</pre></div></div><p><br class="example-break">
295
</p><pre class="screen">
296
<code class="prompt">root# </code> chmod 755 initGrps.sh
297
<code class="prompt">root# </code> cd /etc/samba
298
<code class="prompt">root# </code> ./initGrps.sh
299
Updated mapping entry for Domain Admins
300
Updated mapping entry for Domain Users
301
Updated mapping entry for Domain Guests
302
No rid or sid specified, choosing algorithmic mapping
303
Successfully added group Accounts Dept to the mapping db
304
No rid or sid specified, choosing algorithmic mapping
305
Successfully added group Domain Guests to the mapping db
307
<code class="prompt">root# </code> cd /etc/samba
308
<code class="prompt">root# </code> net groupmap list | sort
309
Account Operators (S-1-5-32-548) -> -1
310
Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
311
Administrators (S-1-5-32-544) -> -1
312
Backup Operators (S-1-5-32-551) -> -1
313
Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
314
Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
315
Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
316
Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
317
Guests (S-1-5-32-546) -> -1
318
Power Users (S-1-5-32-547) -> -1
319
Print Operators (S-1-5-32-550) -> -1
320
Replicators (S-1-5-32-552) -> -1
321
System Operators (S-1-5-32-549) -> -1
322
Users (S-1-5-32-545) -> -1
325
<a class="indexterm" name="id2556247"></a>
326
<a class="indexterm" name="id2556253"></a>
327
<a class="indexterm" name="id2556261"></a>
328
For each user who needs to be given a Windows Domain account, make an entry in the
329
<code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
330
Use the system tool of your choice to create the UNIX system accounts, and use the Samba
331
<code class="literal">smbpasswd</code> program to create the Domain user accounts.
333
<a class="indexterm" name="id2556286"></a>
334
<a class="indexterm" name="id2556292"></a>
335
<a class="indexterm" name="id2556299"></a>
336
There are a number of tools for user management under UNIX, such as
337
<code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom
338
tools. With the tool of your choice, create a home directory for each user.
340
Using the preferred tool for your UNIX system, add each user to the UNIX groups created
341
previously, as necessary. File system access control will be based on UNIX group membership.
343
Create the directory mount point for the disk subsystem that is mounted to provide
344
data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code>
345
file is <code class="filename">/data</code>. Format the file system as required, mount the formatted
346
file system partition using <code class="literal">mount</code>,
347
and make the appropriate changes in <code class="filename">/etc/fstab</code>.
349
Create the top-level file storage directories are follows:
350
</p><pre class="screen">
351
<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs}
352
<code class="prompt">root# </code> chown -R root:root /data
353
<code class="prompt">root# </code> chown -R alanm:accounts /data/accounts
354
<code class="prompt">root# </code> chown -R alanm:finsvcs /data/finsvcs
355
<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /data
357
Each department is responsible for creating its own directory structure within its
358
share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>.
359
The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>.
361
Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
362
Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
363
This allows the CUPS spooler to print using raw mode protocols.
364
<a class="indexterm" name="id2556442"></a>
365
<a class="indexterm" name="id2556449"></a>
367
<a class="indexterm" name="id2556461"></a>
368
<a class="indexterm" name="id2556470"></a>
369
Configure the CUPS Print Queues as follows:
370
</p><pre class="screen">
371
<code class="prompt">root# </code> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
372
<code class="prompt">root# </code> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
373
<code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E
375
<a class="indexterm" name="id2556500"></a>
376
This creates the necessary print queues with no assigned print filter.
378
<a class="indexterm" name="id2556514"></a>
379
<a class="indexterm" name="id2556521"></a>
380
<a class="indexterm" name="id2556527"></a>
381
Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line:
382
</p><pre class="screen">
383
application/octet-stream application/vnd.cups-raw 0 -
386
<a class="indexterm" name="id2556551"></a>
387
Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
388
</p><pre class="screen">
389
application/octet-stream
392
<a class="indexterm" name="id2556574"></a>
393
Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the
394
contents as shown in <a class="link" href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>.
395
</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example�2.2.�Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id2556607"></a><pre class="screen">
396
default-lease-time 86400;
397
max-lease-time 172800;
398
default-lease-time 86400;
400
option ntp-servers 192.168.1.1;
401
option domain-name "abmas.biz";
402
option domain-name-servers 192.168.1.1, 192.168.2.1;
403
option netbios-name-servers 192.168.1.1, 192.168.2.1;
404
option netbios-node-type 8;
406
# netbios-node-type=8 means set clients to Hybrid Mode
407
# so they will use Unicast communication with the WINS
408
# server and thus reduce the level of UDP broadcast
409
# traffic by up to 90%.
412
subnet 192.168.1.0 netmask 255.255.255.0 {
413
range dynamic-bootp 192.168.1.128 192.168.1.254;
414
option subnet-mask 255.255.255.0;
415
option routers 192.168.1.1;
416
allow unknown-clients;
418
hardware ethernet 08:00:46:7a:35:e4;
419
fixed-address 192.168.1.10;
422
hardware ethernet 00:03:47:cb:81:e0;
423
fixed-address 192.168.1.11;
426
subnet 192.168.2.0 netmask 255.255.255.0 {
427
range dynamic-bootp 192.168.2.128 192.168.2.254;
428
option subnet-mask 255.255.255.0;
429
option routers 192.168.2.1;
430
allow unknown-clients;
432
hardware ethernet 01:04:31:db:e1:c0;
433
fixed-address 192.168.1.10;
436
subnet 127.0.0.0 netmask 255.0.0.0 {
438
</pre></div></div><p><br class="example-break">
440
Use the standard system tool to start Samba and CUPS and configure them to start
441
automatically at every system reboot. For example,
443
<a class="indexterm" name="id2556650"></a>
444
<a class="indexterm" name="id2556657"></a>
445
<a class="indexterm" name="id2556663"></a>
446
<a class="indexterm" name="id2556669"></a>
447
<a class="indexterm" name="id2556676"></a>
448
</p><pre class="screen">
449
<code class="prompt">root# </code> chkconfig dhcp on
450
<code class="prompt">root# </code> chkconfig smb on
451
<code class="prompt">root# </code> chkconfig cups on
452
<code class="prompt">root# </code> /etc/rc.d/init.d/dhcp restart
453
<code class="prompt">root# </code> /etc/rc.d/init.d/smb restart
454
<code class="prompt">root# </code> /etc/rc.d/init.d/cups restart
457
<a class="indexterm" name="id2556726"></a>
458
<a class="indexterm" name="id2556732"></a>
459
<a class="indexterm" name="id2556740"></a>
460
<a class="indexterm" name="id2556747"></a>
461
<a class="indexterm" name="id2556753"></a>
462
<a class="indexterm" name="id2556759"></a>
463
Configure the name service switch (NSS) to handle WINS-based name resolution.
464
Since this system does not use a DNS server, it is safe to remove this option from
465
the NSS configuration. Edit the <code class="filename">/etc/nsswitch.conf</code> file so that
466
the <code class="constant">hosts:</code> entry looks like this:
467
</p><pre class="screen">
470
</p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example�2.3.�Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556817"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2556827"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2556839"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2556850"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2556860"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2556871"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2556882"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556893"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556904"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556915"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556927"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556938"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556949"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556961"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2556972"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2556983"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2556993"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557004"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557014"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557024"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example�2.4.�Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557065"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557075"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557086"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557096"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557115"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2557125"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557136"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557146"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557156"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557167"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557186"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557197"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557207"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557217"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2557236"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557247"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2557257"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557267"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2557286"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557297"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2557308"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557318"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557330"></a>Validation</h3></div></div></div><p>
471
Does everything function as it ought? That is the key question at this point.
472
Here are some simple steps to validate your Samba server configuration.
473
</p><div class="procedure"><a name="id2557341"></a><p class="title"><b>Procedure�2.2.�Validation Steps</b></p><ol type="1"><li><p>
474
<a class="indexterm" name="id2557351"></a>
475
If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba
476
to refuse to start. The first step should always be to validate the contents
477
of this file by running:
478
</p><pre class="screen">
479
<code class="prompt">root# </code> testparm -s
480
Load smb config files from smb.conf
481
Processing section "[homes]"
482
Processing section "[printers]"
483
Processing section "[netlogon]"
484
Processing section "[accounts]"
485
Processing section "[service]"
486
Loaded services file OK.
490
passwd chat = *New*Password* \
491
%n\n *Re-enter*new*password* %n\n *Password*changed*
492
username map = /etc/samba/smbusers
494
name resolve order = wins bcast hosts
496
show add printer wizard = No
497
add user script = /usr/sbin/useradd -m -G users '%u'
498
delete user script = /usr/sbin/userdel -r '%u'
499
add group script = /usr/sbin/groupadd '%g'
500
delete group script = /usr/sbin/groupdel '%g'
501
add user to group script = /usr/sbin/usermod -A '%g' '%u'
502
add machine script = /usr/sbin/useradd
503
-s /bin/false -d /var/lib/nobody '%u'
504
logon script = scripts\logon.bat
508
preferred master = Yes
511
### Remainder cut to save space ###
513
The inclusion of an invalid parameter (say one called dogbert) would generate an
515
</p><pre class="screen">
516
Unknown parameter encountered: "dogbert"
517
Ignoring unknown parameter "dogbert"
519
Clear away all errors before proceeding, and start or restart samba as necessary.
521
<a class="indexterm" name="id2557431"></a>
522
<a class="indexterm" name="id2557437"></a>
523
<a class="indexterm" name="id2557443"></a>
524
<a class="indexterm" name="id2557450"></a>
525
Check that the Samba server is running:
526
</p><pre class="screen">
527
<code class="prompt">root# </code> ps ax | grep mbd
528
14244 ? S 0:00 /usr/sbin/nmbd -D
529
14245 ? S 0:00 /usr/sbin/nmbd -D
530
14290 ? S 0:00 /usr/sbin/smbd -D
532
$rootprompt; ps ax | grep winbind
533
14293 ? S 0:00 /usr/sbin/winbindd -D
534
14295 ? S 0:00 /usr/sbin/winbindd -D
536
The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also
537
two instances of it. For more information regarding <code class="literal">winbindd</code>, see
538
<span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of
539
<code class="literal">smbd</code> is normal.
541
<a class="indexterm" name="id2557500"></a>
542
Check that an anonymous connection can be made to the Samba server:
543
</p><pre class="screen">
544
<code class="prompt">root# </code> smbclient -L localhost -U%
546
Sharename Type Comment
547
--------- ---- -------
548
netlogon Disk Network Logon Service
549
accounts Disk Accounting Files
550
finsvcs Disk Financial Service Files
551
IPC$ IPC IPC Service (Samba3)
552
ADMIN$ IPC IPC Service (Samba3)
553
hplj4 Printer Hewlett-Packard LaserJet 4
554
hplj6 Printer Hewlett-Packard LaserJet 6
555
qms Printer QMS Magicolor Laser Printer XXXX
565
This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
566
of browsing the server from a Windows client to obtain a list of shares on the server.
567
The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and
568
a <code class="constant">NULL</code> password.
570
<a class="indexterm" name="id2557551"></a>
571
<a class="indexterm" name="id2557557"></a>
572
<a class="indexterm" name="id2557564"></a>
573
Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
574
The easiest way to do this is to ping the printer name. Immediately after the ping response
575
has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer
576
that has responded. Now you can compare the IP address and the MAC address of the printer
577
with the configuration information in the <code class="filename">/etc/dhcpd.conf</code> file. They
578
should, of course, match. For example,
579
</p><pre class="screen">
580
<code class="prompt">root# </code> ping hplj4
581
PING hplj4 (192.168.1.11) 56(84) bytes of data.
582
64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
584
<code class="prompt">root# </code> arp -a
585
hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
587
The MAC address <code class="constant">08:00:46:7A:35:E4</code> matches that specified for the
588
IP address from which the printer has responded and the entry for it in the
589
<code class="filename">/etc/dhcpd.conf</code> file.
591
<a class="indexterm" name="id2557624"></a>
592
Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool:
593
</p><pre class="screen">
594
<code class="prompt">root# </code> smbclient //sleeth/accounts -U alanm
597
. D 0 Sun Nov 9 01:28:34 2003
598
.. D 0 Sat Aug 16 17:24:26 2003
599
.mc DH 0 Sat Nov 8 21:57:38 2003
600
.qt DH 0 Fri Sep 5 00:48:25 2003
601
SMB D 0 Sun Oct 19 23:04:30 2003
602
Documents D 0 Sat Nov 1 00:31:51 2003
603
xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
605
65387 blocks of size 65536. 28590 blocks available
608
</p></li></ol></div></div><div class="procedure"><a name="id2557672"></a><p class="title"><b>Procedure�2.3.�Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>
609
Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
610
All clients use DHCP for TCP/IP protocol stack configuration.
611
<a class="indexterm" name="id2557690"></a>
612
<a class="indexterm" name="id2557697"></a>
613
DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>.
615
Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator
616
username <code class="constant">root</code> and the SMB password you assigned to this account.
617
A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
618
a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter�15.�A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>.
619
Reboot the machine as prompted and then log on using a Domain User account.
621
Verify on each client that the machine called <code class="constant">SLEETH</code>
622
is visible in <span class="guimenu">My Network Places</span>, that it is
623
possible to connect to it and see the shares <span class="guimenuitem">accounts</span>
624
and <span class="guimenuitem">finsvcs</span>,
625
and that it is possible to open that share to reveal its contents.
627
Instruct all users to log onto the workstation using their assigned username and password.
629
Install a printer on each using the following steps:
630
</p><div class="procedure"><ol type="1"><li><p>
631
Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
632
Ensure that <span class="guimenuitem">Local printer</span> is selected.
634
Click <span class="guibutton">Next</span>. In the
635
<span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
636
In the <span class="guimenuitem">Printers:</span> panel, select the printer called
637
<code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>.
639
In the <span class="guimenuitem">Available ports:</span> panel, select
640
<code class="constant">FILE:</code>. Accept the default printer name by clicking
641
<span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a
642
test page?</span>”, click <span class="guimenuitem">No</span>. Click
643
<span class="guibutton">Finish</span>.
645
You may be prompted for the name of a file to print to. If so, close the
646
dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>.
648
In the <span class="guimenuitem">Network</span> panel, enter the name of
649
the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>.
650
Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
652
Repeat the printer installation steps above for the HP LaserJet 6 printer
653
as well as for the QMS Magicolor XXXX laser printer.
654
</p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557978"></a>Notebook Computers: A Special Case</h3></div></div></div><p>
655
As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
656
Professional systems. This is the preferred solution to provide continuity of work for notebook users
657
so that absence from the office network environment does not become a barrier to productivity.
659
By creating a local machine account that has the same username and password as you create for that
660
user in the Windows Domain environment, the user can log onto the machine locally and still
661
transparently access network resources as if logged onto the domain itself. There are some trade-offs
662
that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
663
configuration somewhat.
664
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558003"></a>Key Points Learned</h3></div></div></div><p>
665
In this network design and implementation exercise, you created a Windows NT4-style Domain
666
Controller using Samba-3.0.20. Following these guidelines, you experienced
667
and implemented several important aspects of Windows networking. In the next chapter,
668
you build on the experience. These are the highlights from this chapter:
669
</p><div class="itemizedlist"><ul type="disc"><li><p>
670
<a class="indexterm" name="id2558023"></a>
671
You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
672
network configuration settings from this server.
674
<a class="indexterm" name="id2558036"></a>
675
You created a Windows Domain Controller. You were able to use the network logon service
676
and successfully joined Windows 200x/XP Professional clients to the Domain.
678
<a class="indexterm" name="id2558050"></a>
679
You created raw print queues in the CUPS printing system. You maintained a simple
680
printing system so that all users can share centrally managed printers. You installed
681
native printer drivers on the Windows clients.
683
You experienced the benefits of centrally managed user accounts on the server.
685
You offered Mobile notebook users a solution that allows them to continue to work
686
while away from the office and not connected to the corporate network.
687
</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558077"></a>Questions and Answers</h2></div></div></div><p>
688
Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
690
</p><div class="qandaset"><dl><dt>1. <a href="small.html#id2558090">
691
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
692
</a></dt><dt>2. <a href="small.html#id2558117">
693
Are there any DHCP server configuration parameters in the /etc/dhcpd.conf
694
that should be noted in particular?
695
</a></dt><dt>3. <a href="small.html#id2558148">
696
Is it possible to create a Windows Domain account that is specifically called Administrator?
697
</a></dt><dt>4. <a href="small.html#id2558185">
698
Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?
699
</a></dt><dt>5. <a href="small.html#id2558223">
700
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
701
root access. How can we do this?
702
</a></dt><dt>6. <a href="small.html#id2558262">
703
Why must I map Windows Domain Groups to UNIX groups?
704
</a></dt><dt>7. <a href="small.html#id2558299">
705
I deleted my root account and now I cannot add it back! What can I do?
706
</a></dt><dt>8. <a href="small.html#id2558366">
707
When I run net groupmap list, it reports a group called Administrators
708
as well as Domain Admins. What is the difference between them?
709
</a></dt><dt>9. <a href="small.html#id2558411">
710
What is the effect of changing the name of a Samba server or of changing the Domain name?
711
</a></dt><dt>10. <a href="small.html#id2558460">
712
How can I manage user accounts from my Windows XP Professional workstation?
713
</a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2558090"></a><a name="id2558092"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>
714
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
715
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
716
First and foremost, portability. It means that notebook users can move between
717
the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
718
reconfigure their machines. It also means that when they work from their home environments
719
either using DHCP assigned addressing or when using dial-up networking, settings such as
720
default routes and DNS server addresses that apply only to the Abmas office environment do
721
not interfere with remote operations. This is an extremely important feature of DHCP.
722
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558117"></a><a name="id2558119"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>
723
Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code>
724
that should be noted in particular?
725
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
726
Yes. The configuration you created automatically provides each client with the IP address
727
of your WINS server. It also configures the client to preferentially register NetBIOS names
728
with the WINS server, and then instructs the client to first query the WINS server when a
729
NetBIOS machine name needs to be resolved to an IP Address. This configuration
730
results in far lower UDP broadcast traffic than would be the case if WINS was not used.
731
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558148"></a><a name="id2558150"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>
732
Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>?
733
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
734
You can surely create a Windows Domain account called <code class="constant">Administrator</code>. It is also
735
possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
736
necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX
737
account called <code class="constant">root</code>.
738
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558185"></a><a name="id2558187"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>
739
Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0?
740
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
741
The Windows Domain <code class="constant">Administrator</code> account is the most privileged account that
742
exists on the Windows platform. This user can change any setting, add, delete, or modify user
743
accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
744
environment is the <code class="constant">root</code> account. If you want to permit the Windows Domain
745
Administrator to manage accounts as well as permissions, privileges, and security
746
settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
747
achieved with the <code class="constant">root</code> UID equal to 0.
748
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558223"></a><a name="id2558225"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>
749
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
750
<code class="constant">root</code> access. How can we do this?
751
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
752
Users who are members of the <code class="constant">Domain Admins</code> group can add machines to the
753
Domain. This group is mapped to the UNIX group account called <code class="constant">root</code>
754
(or the equivalent <code class="constant">wheel</code> on some UNIX systems) that has a GID of 0.
755
This must be the primary GID of the account of the user who is a member of the Windows <code class="constant">
756
Domain Admins</code> account.
757
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558262"></a><a name="id2558265"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>
758
Why must I map Windows Domain Groups to UNIX groups?
759
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
760
Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
761
has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
762
<span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>.
763
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558299"></a><a name="id2558301"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>
764
I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do?
765
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
766
This is a nasty problem. Fortunately, there is a solution.
767
</p><div class="procedure"><ol type="1"><li><p>
768
Back up your existing configuration files in case you need to restore them.
770
Rename the <code class="filename">group_mapping.tdb</code> file.
772
Use the <code class="literal">smbpasswd</code> to add the root account.
774
Restore the <code class="filename">group_mapping.tdb</code> file.
775
</p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558366"></a><a name="id2558368"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>
776
When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span>
777
as well as <span class="guimenu">Domain Admins</span>. What is the difference between them?
778
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
779
The group called <span class="guimenu">Administrators</span> is representative of the same account that would be
780
present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
781
Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
782
may change at some later date. These accounts are provided only so that security objects are correctly shown.
783
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558411"></a><a name="id2558413"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>
784
What is the effect of changing the name of a Samba server or of changing the Domain name?
785
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
786
If you elect to change the name of the Samba server, on restarting <code class="literal">smbd</code>,
787
Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
788
the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
789
(Workgroup name), the Domain SID is changed. This affects all Domain memberships.
791
If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
792
SID before the change is made. You can back up the SID using the <code class="literal">net getlocalsid</code> (Samba-3)
793
or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
794
to check the man page for this command for detailed instructions regarding the steps involved.
795
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558460"></a><a name="id2558462"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>
796
How can I manage user accounts from my Windows XP Professional workstation?
797
</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
798
Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
799
be managed using tools present on a Windows XP Professional installation. You may download from the
800
Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
801
it. This package extracts the tools: <code class="literal">User Manager for Domains</code>, <code class="literal">Server Manager</code>, and <code class="literal">Event
802
Viewer</code>. You may use the <span class="guimenu">User Manager for Domains</span> to manage your Samba-3
803
Domain user and group accounts. Of course, you do need to be logged on as the <code class="constant">Administrator</code>
804
for the Samba-3 Domain. It may help to log on as the <code class="constant">root</code> account.
805
</p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�1.�No-Frills Samba Servers�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�3.�Secure Office Networking</td></tr></table></div></body></html>
added
removed
docs/htmldocs/Samba3-ByExample/small.html
