~zulcss/samba/server-dailies-3.4

is a daemon that provides a number of services to the Name Service Switch capability found in most modern C libraries, to arbitrary applications via PAM and

184

\FCntlm_auth\F[]

185

and to Samba itself\&.

186

.PP

187

Even if winbind is not used for nsswitch, it still provides a service to

188

\FCsmbd\F[],

189

\FCntlm_auth\F[]

190

and the

191

\FCpam_winbind\&.so\F[]

192

PAM module, by managing connections to domain controllers\&. In this configuraiton the

193

\m[blue]\fBidmap uid\fR\m[]

194

and

195

\m[blue]\fBidmap gid\fR\m[]

196

parameters are not required\&. (This is known as `netlogon proxy only mode\'\&.)

197

.PP

198

The Name Service Switch allows user and system information to be obtained from different databases services such as NIS or DNS\&. The exact behaviour can be configured through the

199

\FC/etc/nsswitch\&.conf\F[]

200

file\&. Users and groups are allocated as they are resolved to a range of user and group ids specified by the administrator of the Samba system\&.

201

.PP

202

The service provided by

203

\FCwinbindd\F[]

204

is called `winbind\' and can be used to resolve user and group information from a Windows NT server\&. The service can also provide authentication services via an associated PAM module\&.

205

.PP

206

The

207

\FCpam_winbind\F[]

208

module supports the

209

\fIauth\fR,

210

\fIaccount\fR

211

and

212

\fIpassword\fR

213

module\-types\&. It should be noted that the

214

\fIaccount\fR

215

module simply performs a getpwnam() to verify that the system can obtain a uid for the user, as the domain controller has already performed access control\&. If the

216

\FClibnss_winbind\F[]

217

library has been correctly installed, or an alternate source of names configured, this should always succeed\&.

218

.PP

219

The following nsswitch databases are implemented by the winbindd service:

220

.PP

221

\-D

222

.RS 4

223

If specified, this parameter causes the server to operate as a daemon\&. That is, it detaches itself and runs in the background on the appropriate port\&. This switch is assumed if

224

\FCwinbindd\F[]

225

is executed on the command line of a shell\&.

226

.RE

227

.PP

228

hosts

229

.RS 4

230

This feature is only available on IRIX\&. User information traditionally stored in the

231

\FChosts(5)\F[]

232

file and used by

233

\FCgethostbyname(3)\F[]

234

functions\&. Names are resolved through the WINS server or by broadcast\&.

235

.RE

236

.PP

237

passwd

238

.RS 4

239

User information traditionally stored in the

240

\FCpasswd(5)\F[]

241

file and used by

242

\FCgetpwent(3)\F[]

243

functions\&.

244

.RE

245

.PP

246

group

247

.RS 4

248

Group information traditionally stored in the

249

\FCgroup(5)\F[]

250

file and used by

251

\FCgetgrent(3)\F[]

252

functions\&.

253

.RE

254

.PP

255

For example, the following simple configuration in the

256

\FC/etc/nsswitch\&.conf\F[]

257

file can be used to initially resolve user and group information from

258

\FC/etc/passwd \F[]

259

and

260

\FC/etc/group\F[]

261

and then from the Windows NT server\&.

262

.sp

263

.if n \{\

264

.RS 4

265

.\}

266

.fam C

267

.ps -1

268

.nf

269

.if t \{\

270

.sp -1

271

.\}

272

.BB lightgray adjust-for-leading-newline

273

.sp -1

274

275

passwd: files winbind

276

group: files winbind

277

## only available on IRIX: use winbind to resolve hosts:

278

# hosts: files dns winbind

279

## All other NSS enabled systems should use libnss_wins\&.so like this:

280

hosts: files dns wins

281

282

.EB lightgray adjust-for-leading-newline

283

.if t \{\

284

.sp 1

285

.\}

286

.fi

287

.fam

288

.ps +1

289

.if n \{\

290

.RE

291

.\}

292

.PP

293

The following simple configuration in the

294

\FC/etc/nsswitch\&.conf\F[]

295

file can be used to initially resolve hostnames from

296

\FC/etc/hosts\F[]

297

and then from the WINS server\&.

298

.sp

299

.if n \{\

300

.RS 4

301

.\}

302

.fam C

303

.ps -1

304

.nf

305

.if t \{\

306

.sp -1

307

.\}

308

.BB lightgray adjust-for-leading-newline

309

.sp -1

310

311

hosts: files wins

312

.EB lightgray adjust-for-leading-newline

313

.if t \{\

314

.sp 1

315

.\}

316

.fi

317

.fam

318

.ps +1

319

.if n \{\

320

.RE

321

.\}

322

.SH "OPTIONS"

323

.PP

324

\-F

325

.RS 4

326

If specified, this parameter causes the main

327

\FCwinbindd\F[]

328

process to not daemonize, i\&.e\&. double\-fork and disassociate with the terminal\&. Child processes are still created as normal to service each connection request, but the main process does not exit\&. This operation mode is suitable for running

329

\FCwinbindd\F[]

330

under process supervisors such as

331

\FCsupervise\F[]

332

and

333

\FCsvscan\F[]

334

from Daniel J\&. Bernstein\'s

335

\FCdaemontools\F[]

336

package, or the AIX process monitor\&.

337

.RE

338

.PP

339

\-S

340

.RS 4

341

If specified, this parameter causes

342

\FCwinbindd\F[]

343

to log to standard output rather than a file\&.

344

.RE

345

.PP

346

\-d|\-\-debuglevel=level

347

.RS 4

348

\fIlevel\fR

349

is an integer from 0 to 10\&. The default value if this parameter is not specified is 0\&.

350

.sp

351

The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day\-to\-day running \- it generates a small amount of information about operations carried out\&.

352

.sp

353

Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&.

354

.sp

355

Note that specifying this parameter here will override the

356

\m[blue]\fB\%smb.conf.5.html#\fR\m[]

357

parameter in the

358

\FCsmb\&.conf\F[]

359

file\&.

360

.RE

361

.PP

362

\-V|\-\-version

363

.RS 4

364

Prints the program version number\&.

365

.RE

366

.PP

367

\-s|\-\-configfile <configuration file>

368

.RS 4

369

The file specified contains the configuration details required by the server\&. The information in this file includes server\-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See

370

\FCsmb\&.conf\F[]

371

for more information\&. The default configuration file name is determined at compile time\&.

372

.RE

373

.PP

374

\-l|\-\-log\-basename=logdirectory

375

.RS 4

376

Base directory name for log/debug files\&. The extension

377

\fB"\&.progname"\fR

378

will be appended (e\&.g\&. log\&.smbclient, log\&.smbd, etc\&.\&.\&.)\&. The log file is never removed by the client\&.

379

.RE

380

.PP

381

\-h|\-\-help

382

.RS 4

383

Print a summary of command line options\&.

384

.RE

385

.PP

386

\-i

387

.RS 4

388

Tells

389

\FCwinbindd\F[]

390

to not become a daemon and detach from the current terminal\&. This option is used by developers when interactive debugging of

391

\FCwinbindd\F[]

392

is required\&.

393

\FCwinbindd\F[]

394

also logs to standard output, as if the

395

\FC\-S\F[]

396

parameter had been given\&.

397

.RE

398

.PP

399

\-n

400

.RS 4

401

Disable caching\&. This means winbindd will always have to wait for a response from the domain controller before it can respond to a client and this thus makes things slower\&. The results will however be more accurate, since results from the cache might not be up\-to\-date\&. This might also temporarily hang winbindd if the DC doesn\'t respond\&.

402

.RE

403

.PP

404

\-Y

405

.RS 4

406

Single daemon mode\&. This means winbindd will run as a single process (the mode of operation in Samba 2\&.2)\&. Winbindd\'s default behavior is to launch a child process that is responsible for updating expired cache entries\&.

407

.RE

408

.SH "NAME AND ID RESOLUTION"

409

.PP

410

Users and groups on a Windows NT server are assigned a security id (SID) which is globally unique when the user or group is created\&. To convert the Windows NT user or group into a unix user or group, a mapping between SIDs and unix user and group ids is required\&. This is one of the jobs that

411

\FC winbindd\F[]

412

performs\&.

413

.PP

414

As winbindd users and groups are resolved from a server, user and group ids are allocated from a specified range\&. This is done on a first come, first served basis, although all existing users and groups will be mapped as soon as a client performs a user or group enumeration command\&. The allocated unix ids are stored in a database and will be remembered\&.

415

.PP

416

WARNING: The SID to unix id database is the only location where the user and group mappings are stored by winbindd\&. If this store is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user and group rids\&.

417

.SH "CONFIGURATION"

418

.PP

419

Configuration of the

420

\FCwinbindd\F[]

421

daemon is done through configuration parameters in the

422

\fBsmb.conf\fR(5)

423

file\&. All parameters should be specified in the [global] section of smb\&.conf\&.

424

.sp

425

.RS 4

426

.ie n \{\

427

\h'-04'\(bu\h'+03'\c

428

.\}

429

.el \{\

430

.sp -1

431

.IP \(bu 2.3

432

.\}

433

434

\m[blue]\fBwinbind separator\fR\m[]

435

.RE

436

.sp

437

.RS 4

438

.ie n \{\

439

\h'-04'\(bu\h'+03'\c

440

.\}

441

.el \{\

442

.sp -1

443

.IP \(bu 2.3

444

.\}

445

446

\m[blue]\fBidmap uid\fR\m[]

447

.RE

448

.sp

449

.RS 4

450

.ie n \{\

451

\h'-04'\(bu\h'+03'\c

452

.\}

453

.el \{\

454

.sp -1

455

.IP \(bu 2.3

456

.\}

457

458

\m[blue]\fBidmap gid\fR\m[]

459

.RE

460

.sp

461

.RS 4

462

.ie n \{\

463

\h'-04'\(bu\h'+03'\c

464

.\}

465

.el \{\

466

.sp -1

467

.IP \(bu 2.3

468

.\}

469

470

\m[blue]\fBidmap backend\fR\m[]

471

.RE

472

.sp

473

.RS 4

474

.ie n \{\

475

\h'-04'\(bu\h'+03'\c

476

.\}

477

.el \{\

478

.sp -1

479

.IP \(bu 2.3

480

.\}

481

482

\m[blue]\fBwinbind cache time\fR\m[]

483

.RE

484

.sp

485

.RS 4

486

.ie n \{\

487

\h'-04'\(bu\h'+03'\c

488

.\}

489

.el \{\

490

.sp -1

491

.IP \(bu 2.3

492

.\}

493

494

\m[blue]\fBwinbind enum users\fR\m[]

495

.RE

496

.sp

497

.RS 4

498

.ie n \{\

499

\h'-04'\(bu\h'+03'\c

500

.\}

501

.el \{\

502

.sp -1

503

.IP \(bu 2.3

504

.\}

505

506

\m[blue]\fBwinbind enum groups\fR\m[]

507

.RE

508

.sp

509

.RS 4

510

.ie n \{\

511

\h'-04'\(bu\h'+03'\c

512

.\}

513

.el \{\

514

.sp -1

515

.IP \(bu 2.3

516

.\}

517

518

\m[blue]\fBtemplate homedir\fR\m[]

519

.RE

520

.sp

521

.RS 4

522

.ie n \{\

523

\h'-04'\(bu\h'+03'\c

524

.\}

525

.el \{\

526

.sp -1

527

.IP \(bu 2.3

528

.\}

529

530

\m[blue]\fBtemplate shell\fR\m[]

531

.RE

532

.sp

533

.RS 4

534

.ie n \{\

535

\h'-04'\(bu\h'+03'\c

536

.\}

537

.el \{\

538

.sp -1

539

.IP \(bu 2.3

540

.\}

541

542

\m[blue]\fBwinbind use default domain\fR\m[]

543

.RE

544

.sp

545

.RS 4

546

.ie n \{\

547

\h'-04'\(bu\h'+03'\c

548

.\}

549

.el \{\

550

.sp -1

551

.IP \(bu 2.3

552

.\}

553

554

\m[blue]\fBwinbind: rpc only\fR\m[]

555

Setting this parameter forces winbindd to use RPC instead of LDAP to retrieve information from Domain Controllers\&.

556

.SH "EXAMPLE SETUP"

557

.PP

558

To setup winbindd for user and group lookups plus authentication from a domain controller use something like the following setup\&. This was tested on an early Red Hat Linux box\&.

559

.PP

560

561

\FC/etc/nsswitch\&.conf\F[]

562

put the following:

563

.sp

564

.if n \{\

565

.RS 4

566

.\}

567

.fam C

568

.ps -1

569

.nf

570

.if t \{\

571

.sp -1

572

.\}

573

.BB lightgray adjust-for-leading-newline

574

.sp -1

575

576

passwd: files winbind

577

group: files winbind

578

.EB lightgray adjust-for-leading-newline

579

.if t \{\

580

.sp 1

581

.\}

582

.fi

583

.fam

584

.ps +1

585

.if n \{\

586

.RE

587

.\}

588

.PP

589

590

\FC/etc/pam\&.d/*\F[]

591

replace the

592

\fI auth\fR

593

lines with something like this:

594

.sp

595

.if n \{\

596

.RS 4

597

.\}

598

.fam C

599

.ps -1

600

.nf

601

.if t \{\

602

.sp -1

603

.\}

604

.BB lightgray adjust-for-leading-newline

605

.sp -1

606

607

auth required /lib/security/pam_securetty\&.so

608

auth required /lib/security/pam_nologin\&.so

609

auth sufficient /lib/security/pam_winbind\&.so

610

auth required /lib/security/pam_unix\&.so \e

611

use_first_pass shadow nullok

612

.EB lightgray adjust-for-leading-newline

613

.if t \{\

614

.sp 1

615

.\}

616

.fi

617

.fam

618

.ps +1

619

.if n \{\

620

.RE

621

.\}

622

.sp

623

.if n \{\

624

.sp

625

.\}

626

.RS 4

627

.BM yellow

628

.it 1 an-trap

629

.nr an-no-space-flag 1

630

.nr an-break-flag 1

631

.br

632

.ps +1

633

\fBNote\fR

634

.ps -1

635

.br

636

.PP

637

The PAM module pam_unix has recently replaced the module pam_pwdb\&. Some Linux systems use the module pam_unix2 in place of pam_unix\&.

638

.sp .5v

639

.EM yellow

640

.RE

641

.PP

642

Note in particular the use of the

643

\fIsufficient \fR

644

keyword and the

645

\fIuse_first_pass\fR

646

keyword\&.

647

.PP

648

Now replace the account lines with this:

649

.PP

650

\FCaccount required /lib/security/pam_winbind\&.so \F[]

651

.PP

652

The next step is to join the domain\&. To do that use the

653

\FCnet\F[]

654

program like this:

655

.PP

656

\FCnet join \-S PDC \-U Administrator\F[]

657

.PP

658

The username after the

659

\fI\-U\fR

660

can be any Domain user that has administrator privileges on the machine\&. Substitute the name or IP of your PDC for "PDC"\&.

661

.PP

662

Next copy

663

\FClibnss_winbind\&.so\F[]

664

665

\FC/lib\F[]

666

and

667

\FCpam_winbind\&.so \F[]

668

669

\FC/lib/security\F[]\&. A symbolic link needs to be made from

670

\FC/lib/libnss_winbind\&.so\F[]

671

672

\FC/lib/libnss_winbind\&.so\&.2\F[]\&. If you are using an older version of glibc then the target of the link should be

673

\FC/lib/libnss_winbind\&.so\&.1\F[]\&.

674

.PP

675

Finally, setup a

676

\fBsmb.conf\fR(5)

677

containing directives like the following:

678

.sp

679

.if n \{\

680

.RS 4

681

.\}

682

.fam C

683

.ps -1

684

.nf

685

.if t \{\

686

.sp -1

687

.\}

688

.BB lightgray adjust-for-leading-newline

689

.sp -1

690

691

[global]

692

winbind separator = +

693

winbind cache time = 10

694

template shell = /bin/bash

695

template homedir = /home/%D/%U

696

idmap uid = 10000\-20000

697

idmap gid = 10000\-20000

698

workgroup = DOMAIN

699

security = domain

700

password server = *

701

.EB lightgray adjust-for-leading-newline

702

.if t \{\

703

.sp 1

704

.\}

705

.fi

706

.fam

707

.ps +1

708

.if n \{\

709

.RE

710

.\}

711

.PP

712

Now start winbindd and you should find that your user and group database is expanded to include your NT users and groups, and that you can login to your unix box as a domain user, using the DOMAIN+user syntax for the username\&. You may wish to use the commands

713

\FCgetent passwd\F[]

714

and

715

\FCgetent group \F[]

716

to confirm the correct operation of winbindd\&.

717

.SH "NOTES"

718

.PP

719

The following notes are useful when configuring and running

720

\FCwinbindd\F[]:

721

.PP

722

\fBnmbd\fR(8)

723

must be running on the local machine for

724

\FCwinbindd\F[]

725

to work\&.

726

.PP

727

PAM is really easy to misconfigure\&. Make sure you know what you are doing when modifying PAM configuration files\&. It is possible to set up PAM such that you can no longer log into your system\&.

728

.PP

729

If more than one UNIX machine is running

730

\FCwinbindd\F[], then in general the user and groups ids allocated by winbindd will not be the same\&. The user and group ids will only be valid for the local machine, unless a shared

731

\m[blue]\fBidmap backend\fR\m[]

732

is configured\&.

733

.PP

734

If the the Windows NT SID to UNIX user and group id mapping file is damaged or destroyed then the mappings will be lost\&.

735

.SH "SIGNALS"

736

.PP

737

The following signals can be used to manipulate the

738

\FCwinbindd\F[]

739

daemon\&.

740

.PP

741

SIGHUP

742

.RS 4

743

Reload the

744

\fBsmb.conf\fR(5)

745

file and apply any parameter changes to the running version of winbindd\&. This signal also clears any cached user and group information\&. The list of other domains trusted by winbindd is also reloaded\&.

746

.RE

747

.PP

748

SIGUSR2

749

.RS 4

750

The SIGUSR2 signal will cause

751

\FC winbindd\F[]

752

to write status information to the winbind log file\&.

753

.sp

754

Log files are stored in the filename specified by the log file parameter\&.

755

.RE

756

.SH "FILES"

757

.PP

758

\FC/etc/nsswitch\&.conf(5)\F[]

759

.RS 4

760

Name service switch configuration file\&.

761

.RE

762

.PP

763

/tmp/\&.winbindd/pipe

764

.RS 4

765

The UNIX pipe over which clients communicate with the

766

\FCwinbindd\F[]

767

program\&. For security reasons, the winbind client will only attempt to connect to the winbindd daemon if both the

768

\FC/tmp/\&.winbindd\F[]

769

directory and

770

\FC/tmp/\&.winbindd/pipe\F[]

771

file are owned by root\&.

772

.RE

773

.PP

774

$LOCKDIR/winbindd_privileged/pipe

775

.RS 4

776

The UNIX pipe over which \'privileged\' clients communicate with the

777

\FCwinbindd\F[]

778

program\&. For security reasons, access to some winbindd functions \- like those needed by the

779

\FCntlm_auth\F[]

780

utility \- is restricted\&. By default, only users in the \'root\' group will get this access, however the administrator may change the group permissions on $LOCKDIR/winbindd_privileged to allow programs like \'squid\' to use ntlm_auth\&. Note that the winbind client will only attempt to connect to the winbindd daemon if both the

781

\FC$LOCKDIR/winbindd_privileged\F[]

782

directory and

783

\FC$LOCKDIR/winbindd_privileged/pipe\F[]

784

file are owned by root\&.

785

.RE

786

.PP

787

/lib/libnss_winbind\&.so\&.X

788

.RS 4

789

Implementation of name service switch library\&.

790

.RE

791

.PP

792

$LOCKDIR/winbindd_idmap\&.tdb

793

.RS 4

794

Storage for the Windows NT rid to UNIX user/group id mapping\&. The lock directory is specified when Samba is initially compiled using the

795

\fI\-\-with\-lockdir\fR

796

option\&. This directory is by default

797

\FC/usr/local/samba/var/locks \F[]\&.

798

.RE

799

.PP

800

$LOCKDIR/winbindd_cache\&.tdb

801

.RS 4

802

Storage for cached user and group information\&.

803

.RE

804

.SH "VERSION"

805

.PP

806

This man page is correct for version 3 of the Samba suite\&.

807

.SH "SEE ALSO"

808

.PP

809

\FCnsswitch\&.conf(5)\F[],

810

\fBsamba\fR(7),

811

\fBwbinfo\fR(1),

812

\fBntlm_auth\fR(8),

813

\fBsmb.conf\fR(5),

814

\fBpam_winbind\fR(8)

815

.SH "AUTHOR"

816

.PP

817

The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&.

818

.PP

819

\FCwbinfo\F[]

820

and

821

\FCwinbindd\F[]

822

were written by Tim Potter\&.

823

.PP

824

The conversion to DocBook for Samba 2\&.2 was done by Gerald Carter\&. The conversion to DocBook XML 4\&.2 for Samba 3\&.0 was done by Alexander Bokovoy\&.