~zulcss/samba/server-dailies-3.4

<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�7.�Standalone Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part�II.�Server Configuration Basics"><link rel="prev" href="domain-member.html" title="Chapter�6.�Domain Membership"><link rel="next" href="ClientConfig.html" title="Chapter�8.�MS Windows Network Configuration Guide"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�7.�Standalone Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="domain-member.html">Prev</a>�</td><th width="60%" align="center">Part�II.�Server Configuration Basics</th><td width="20%" align="right">�<a accesskey="n" href="ClientConfig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="StandAloneServer"></a>Chapter�7.�Standalone Servers</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="StandAloneServer.html#id2574148">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="StandAloneServer.html#id2574242">Background</a></span></dt><dt><span class="sect1"><a href="StandAloneServer.html#id2574443">Example Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="StandAloneServer.html#RefDocServer">Reference Documentation Server</a></span></dt><dt><span class="sect2"><a href="StandAloneServer.html#SimplePrintServer">Central Print Serving</a></span></dt></dl></dd><dt><span class="sect1"><a href="StandAloneServer.html#id2575426">Common Errors</a></span></dt></dl></div><p>

Standalone servers are independent of domain controllers on the network.

They are not domain members and function more like workgroup servers. In many

cases a standalone server is configured with a minimum of security control

with the intent that all data served will be readily accessible to all users.

</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2574148"></a>Features and Benefits</h2></div></div></div><p>

Standalone servers can be as secure or as insecure as needs dictate. They can

have simple or complex configurations. Above all, despite the hoopla about

domain security, they remain a common installation.

</p><p>

If all that is needed is a server for read-only files, or for

printers alone, it may not make sense to effect a complex installation.

For example, a drafting office needs to store old drawings and reference

standards. Noone can write files to the server because it is legislatively

important that all documents remain unaltered. A share-mode read-only standalone

server is an ideal solution.

</p><p>

Another situation that warrants simplicity is an office that has many printers

that are queued off a single central server. Everyone needs to be able to print

to the printers, there is no need to effect any access controls, and no files will

be served from the print server. Again, a share-mode standalone server makes

a great solution.

</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2574242"></a>Background</h2></div></div></div><p>

The term <span class="emphasis"><em>standalone server</em></span> means that it will provide local authentication and access

control for all resources that are available from it. In general this means that there will be a local user

database. In more technical terms, it means resources on the machine will be made available in either

<span class="emphasis"><em>share</em></span> mode or in <span class="emphasis"><em>user</em></span> mode.

</p><p>

No special action is needed other than to create user accounts. Standalone

servers do not provide network logon services. This means that machines that

use this server do not perform a domain logon to it. Whatever logon facility

the workstations are subject to is independent of this machine. It is, however,

necessary to accommodate any network user so the logon name he or she uses will

be translated (mapped) locally on the standalone server to a locally known

user name. There are several ways this can be done.

</p><p>

Samba tends to blur the distinction a little in defining

a standalone server. This is because the authentication database may be

local or on a remote server, even if from the SMB protocol perspective

the Samba server is not a member of a domain security context.

</p><p>

Through the use of Pluggable Authentication Modules (PAM) (see <a class="link" href="pam.html" title="Chapter�28.�PAM-Based Distributed Authentication">the chapter on PAM</a>)

and the name service switcher (NSS), which maintains the UNIX-user database, the source of authentication may

reside on another server. We would be inclined to call this the authentication server. This means that the

Samba server may use the local UNIX/Linux system password database (<code class="filename">/etc/passwd</code> or

<code class="filename">/etc/shadow</code>), may use a local smbpasswd file, or may use an LDAP backend, or even via PAM

and Winbind another CIFS/SMB server for authentication.

</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2574443"></a>Example Configuration</h2></div></div></div><p>

<a class="link" href="StandAloneServer.html#simplynice" title="Example�7.1.�smb.conf for Reference Documentation Server">The example Reference Documentation Server</a> and <a class="link" href="StandAloneServer.html#SimplePrintServer" title="Central Print Serving">Central Print Serving</a> are designed to inspire simplicity. It is too easy to

attempt a high level of creativity and to introduce too much complexity in server and network design.

</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="RefDocServer"></a>Reference Documentation Server</h3></div></div></div><p>

Configuration of a read-only data server that everyone can access is very simple. By default, all shares are

read-only, unless set otherwise in the <code class="filename">smb.conf</code> file. <a class="link" href="StandAloneServer.html#simplynice" title="Example�7.1.�smb.conf for Reference Documentation Server">The example - Reference

Documentation Server</a> is the <code class="filename">smb.conf</code> file that will do this. Assume that all the reference documents

are stored in the directory <code class="filename">/export</code>, and the documents are owned by a user other than

nobody. No home directories are shared, and there are no users in the <code class="filename">/etc/passwd</code> UNIX

system database. This is a simple system to administer.

</p><div class="example"><a name="simplynice"></a><p class="title"><b>Example�7.1.�smb.conf for Reference Documentation Server</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2574589"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2574601"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2574613"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id2574624"></a><em class="parameter"><code>passdb backend = guest</code></em></td></tr><tr><td><a class="indexterm" name="id2574636"></a><em class="parameter"><code>wins server = 192.168.1.1</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2574657"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2574668"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2574680"></a><em class="parameter"><code>guest only = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top">�</td><td width="80%" valign="top"><p>

I would have spoken more briefly, if I'd had more time to prepare.

</p></td><td width="10%" valign="top">�</td></tr><tr><td width="10%" valign="top">�</td><td colspan="2" align="right" valign="top">--<span class="attribution">Mark Twain</span></td></tr></table></div><p>

100

In <a class="link" href="StandAloneServer.html#simplynice" title="Example�7.1.�smb.conf for Reference Documentation Server">this example</a>, the machine name is set to GANDALF, and the

101

workgroup is set to the name of the local workgroup (MIDEARTH) so the machine will appear together

102

with systems with which users are familiar. The only password backend required is the “<span class="quote">guest</span>”

103

backend to allow default unprivileged account names to be used. As there is a WINS server on this network, we

104

of course make use of it.

105

</p><p>

106

A US Air Force Colonel was renowned for saying: “<span class="quote">Better is the enemy of good enough!</span>” There are often

107

sound reasons for avoiding complexity as well as for avoiding a technically perfect solution. Unfortunately,

108

many network administrators still need to learn the art of doing just enough to keep out of trouble.

109

</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="SimplePrintServer"></a>Central Print Serving</h3></div></div></div><p>

110

111

112

Configuration of a simple print server is easy if you have all the right tools on your system.

113

</p><div class="orderedlist"><p class="title"><b> Assumptions</b></p><ol type="1"><li><p>

114

The print server must require no administration.

115

</p></li><li><p>

116

The print spooling and processing system on our print server will be CUPS.

117

(Please refer to <a class="link" href="CUPS-printing.html" title="Chapter�22.�CUPS Printing Support">CUPS Printing Support</a>, for more information).

118

</p></li><li><p>

119

The print server will service only network printers. The network administrator

120

will correctly configure the CUPS environment to support the printers.

121

</p></li><li><p>

122

All workstations will use only PostScript drivers. The printer driver

123

of choice is the one shipped with the Windows OS for the Apple Color LaserWriter.

124

</p></li></ol></div><p>

125

126

127

128

In this example our print server will spool all incoming print jobs to

129

<code class="filename">/var/spool/samba</code> until the job is ready to be submitted by

130

Samba to the CUPS print processor. Since all incoming connections will be as

131

the anonymous (guest) user, two things will be required to enable anonymous printing.

132

</p><div class="itemizedlist"><p class="title"><b>Enabling Anonymous Printing</b></p><ul type="disc"><li><p>

133

134

135

136

The UNIX/Linux system must have a <code class="literal">guest</code> account.

137

The default for this is usually the account <code class="literal">nobody</code>.

138

To find the correct name to use for your version of Samba, do the

139

following:

140

</p><pre class="screen">

141

<code class="prompt">$ </code><strong class="userinput"><code>testparm -s -v | grep "guest account"</code></strong>

142

</pre><p>

143

144

Make sure that this account exists in your system password

145

database (<code class="filename">/etc/passwd</code>).

146

</p><p>

147

148

149

150

It is a good idea either to set a password on this account, or else to lock it

151

from UNIX use. Assuming that the guest account is called <code class="literal">pcguest</code>,

152

it can be locked by executing:

153

</p><pre class="screen">

154

<code class="prompt">root# </code> passwd -l pcguest

155

</pre><p>

156

The exact command may vary depending on your UNIX/Linux distribution.

157

</p></li><li><p>

158

159

160

161

162

163

164

The directory into which Samba will spool the file must have write

165

access for the guest account. The following commands will ensure that

166

this directory is available for use:

167

</p><pre class="screen">

168

<code class="prompt">root# </code><strong class="userinput"><code>mkdir /var/spool/samba</code></strong>

169

<code class="prompt">root# </code><strong class="userinput"><code>chown nobody.nobody /var/spool/samba</code></strong>

170

<code class="prompt">root# </code><strong class="userinput"><code>chmod a+rwt /var/spool/samba</code></strong>

171

</pre><p>

172

</p></li></ul></div><p>

173

The contents of the <code class="filename">smb.conf</code> file is shown in <a class="link" href="StandAloneServer.html#AnonPtrSvr" title="Example�7.2.�smb.conf for Anonymous Printing">the Anonymous Printing example</a>.

174

</p><div class="example"><a name="AnonPtrSvr"></a><p class="title"><b>Example�7.2.�<code class="filename">smb.conf</code> for Anonymous Printing</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2575130"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2575142"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2575154"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id2575165"></a><em class="parameter"><code>passdb backend = guest</code></em></td></tr><tr><td><a class="indexterm" name="id2575177"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2575189"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2575210"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2575221"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2575233"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2575245"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575256"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575268"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575280"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>

175

176

177

178

179

180

On CUPS-enabled systems there is a facility to pass raw data directly to the printer without intermediate

181

processing via CUPS print filters. Where use of this mode of operation is desired, it is necessary to

182

configure a raw printing device. It is also necessary to enable the raw mime handler in the

183

<code class="filename">/etc/mime.conv</code> and <code class="filename">/etc/mime.types</code> files. Refer to <a class="link" href="CUPS-printing.html" title="Chapter�22.�CUPS Printing Support">CUPS Printing Support</a>, <a class="link" href="CUPS-printing.html#cups-raw" title="Explicitly Enable raw Printing for application/octet-stream">Explicitly Enable raw Printing

184

for application/octet-stream</a>.

185

</p></div><p>

186

187

188

189

190

The example in <a class="link" href="StandAloneServer.html#AnonPtrSvr" title="Example�7.2.�smb.conf for Anonymous Printing">the Anonymous Printing example</a> uses CUPS for direct printing

191

via the CUPS libarary API. This means that all printers will be exposed to Windows users without need to

192

configure a printcap file. If there is necessity to expose only a sub-set of printers, or to define a special

193

type of printer (for example, a PDF filter) the <em class="parameter"><code>printcap name = cups</code></em> can be replaced

194

with the entry <em class="parameter"><code>printcap name = /etc/samba/myprintcap</code></em>. In this case the file specified

195

should contain a list of the printer names that should be exposed to Windows network users.

196

</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2575426"></a>Common Errors</h2></div></div></div><p>

197

198

199

The greatest mistake so often made is to make a network configuration too complex.

200

It pays to use the simplest solution that will meet the needs of the moment.

201

</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="domain-member.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="ClientConfig.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�6.�Domain Membership�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�8.�MS Windows Network Configuration Guide</td></tr></table></div></body></html>