Table of Contents
There is something indeed mystical about things that are +
Table of Contents
There is something indeed mystical about things that are big. Large networks exhibit a certain magnetism and exude a sense of importance that obscures reality. You and I know that it is no more difficult to secure a large network than it is a small one. We all @@ -22,7 +22,7 @@ implementing a DNS or a DHCP server are under control. Even the basics of Samba are largely under control. So in this section you focus on the specifics of implementing LDAP changes, Samba changes, and approach and - design of the solution and its deployment.
+ design of the solution and its deployment.
Abmas is a miracle company. Most businesses would have collapsed under the weight of rapid expansion that this company has experienced. Samba is flexible, so there is no need to reinstall the whole operating @@ -30,16 +30,16 @@ you can keep an old server running right up to the moment of cut-over and then do a near-live conversion. There is no need to reinstall a Samba server just to change the way your network should function. -
Network growth is common to all organizations. In this exercise, your preoccupation is with the mechanics of implementing Samba and LDAP so that network users on each network segment can work - without impediment.
+ without impediment.
Starting with the configuration files for the server called MASSIVE in Chapter 6, you now deal with the issues that are particular to large distributed networks. Your task is simple identify the challenges, consider the - alternatives, and then design and implement a solution.
+ alternatives, and then design and implement a solution.
Remember, you have users based in London (UK), Los Angeles, Washington DC, and three buildings in New York. A significant portion of your workforce have notebook computers and roam all over the @@ -53,12 +53,12 @@ and Help desk in New York, plus one floater for Washington DC.
You have outsourced all desktop deployment and management to DirectPointe,Inc. Your concern is server maintenance and third-level - support. Build a plan and show what must be done.
In the previous chapter, you implemented an LDAP server that provided the passdb backend for the Samba servers. You explored ways to accelerate Windows desktop profile handling and you took control of network performance. -
The implementation of an LDAP-based passdb backend (known as ldapsam in Samba parlance), or some form of database that can be distributed, is essential to permit the deployment of Samba @@ -69,34 +69,34 @@ using a tool such as rsync, but smbpasswd suffers the drawback that it does not support the range of account facilities demanded by modern network - managers.
The new tdbsam facility supports functionality that is similar to an ldapsam, but the lack of distributed infrastructure sorely limits the scope for its deployment. This does raise the following questions: "Why can't I just use an XML based backend, or for that matter, why not use an SQL based backend?" "Is support for these tools broken?" No. Answers to these - questions require a bit of background.
+ questions require a bit of background.
What is a directory? A directory is a collection of information regarding objects that can be accessed to rapidly find information that is relevant in a particular and consistent manner. A directory differs from a database in that it is generally more often searched (read) than updated. As a consequence, the information is organized to facilitate read access rather than to - support transaction processing.
+ support transaction processing.
The Lightweight Directory Access Protocol (LDAP) differs considerably from a traditional database. It has a simple search facility that uniquely makes a highly preferred mechanism for managing user identities. LDAP provides a scalable mechanism for distributing the data repository and for keeping all copies (slaves) in sync with - the master repository.
Samba is a flexible and powerful file and print sharing technology. It can use many external authentication sources and can be part of a total authentication and identity management infrastructure. The two most important external sources for large sites are Microsoft Active Directory and LDAP. Sites that specifically wish to avoid the proprietary implications of Microsoft Active Directory - naturally gravitate toward OpenLDAP.
+ naturally gravitate toward OpenLDAP.
In Chapter 6, you had to deal with a locally routed network. All deployment concerns focused around making users happy, and that simply means taking control over all network practices and @@ -107,10 +107,10 @@ between offices. You must take into account the way users need to access information globally. And you must make the network robust enough so that it can sustain partial breakdown without causing loss of - productivity.
There are at least three areas that need to be addressed as you + productivity.
There are at least three areas that need to be addressed as you approach the challenge of designing a network solution for the newly - expanded business. These are:
Let's look at each in turn.
The new company has three divisions. Staff for each division + expanded business. These are:
Let's look at each in turn.
The new company has three divisions. Staff for each division are spread across the company. Some staff are office-bound and some are mobile users. Mobile users travel globally. Some spend considerable periods working in other offices. Everyone wants to be @@ -118,7 +118,7 @@ even dial-up connectivity is poor, while in other regions political encumbrances severely curtail user needs. Parts of the global Internet infrastructure remain shielded-off for reasons outside - the scope of this discussion.
+ the scope of this discussion.
Decisions must be made regarding where data is to be stored, how it will be replicated (if at all), and what the network bandwidth implications are. For example, one decision that can be made is @@ -128,7 +128,7 @@ synchronization tool could be rsync, run via a cron job. Mobile users may use off-line file storage under Windows XP Professional. This way, they can synchronize all files that have - changed since each logon to the network.
+ changed since each logon to the network.
No matter which way you look at this, the bandwidth requirements for acceptable performance are substantial even if only 10 percent of staff are global data users. A company with 3500 employees @@ -139,10 +139,10 @@ mobile users. At that time, the average roaming profile took 480 Kbytes, while today the minimum Windows XP Professional roaming profile involves a transfer of over 750 Kbytes from the profile - server to/from the client.
Obviously then, user needs and wide-area practicalities dictate the economic and technical aspects of your network - design as well as for standard operating procedures.
Network logons that include roaming profile handling requires from 140 Kbytes to 2 Mbytes. The inclusion of support for a minimal set of common desktop applications can push the size of a complete @@ -150,7 +150,7 @@ as location of user profiles is concerned. Additionally, it is a significant factor in determining the nature and style of mandatory profiles that may be enforced as part of a total service level - assurance program that might be implemented.
+ assurance program that might be implemented.
One way to reduce the network bandwidth impact of user logon traffic is through folder redirection. In Chapter 6, you implemented this in the new Windows XP Professional standard @@ -158,21 +158,21 @@ Documents are redirected to a network drive, they should also be excluded from synchronization to/from the server on logon/out. Redirected folders are analogous to network drive - connections.
Of course, network applications should only be run off local application servers. As a general rule, even with 2 Mbit/sec network bandwidth, it would not make sense at all for someone who is working out of the London office to run applications off a - server that is located in New York.
+ server that is located in New York.
When network bandwidth becomes a precious commodity (that is most of the time), there is a significant demand to understand network processes and to mould the limits of acceptability around the constraints of affordability.
When a Windows NT4/200x/XP Professional client user logs onto - the network, several important things must happen.
+ the network, several important things must happen.
The client obtains an IP address via DHCP. (DHCP is - necessary so that users can roam between offices.)
The client must register itself with the WINS and/or DNS - server.
The client must log onto a Domain Controller and obtain as part of that process the location of the user's profile, load it, connect to redirected folders, and establish all network @@ -187,11 +187,11 @@ DHCP and WINS.
As soon as the Windows workstation starts up, it obtains an IP address. This is immediately followed by registration of its name both by broadcast and Unicast registration that is directed - at the WINS server.
Given that the client is already a Domain Member, it then sends a directed (Unicast) request to the WINS server seeking the list of IP addresses for domain controllers (NetBIOS name type 0x1C). The - WINS server replies with the information requested.
+ WINS server replies with the information requested.
The client sends two netlogon mailslot broadcast requests to the local network and to each of the IP addresses returned by the WINS server. Whichever answers this request first appears to @@ -199,7 +199,7 @@ process the network logon. The mailslot messages use UDP broadcast to the local network and UDP Unicast directed at each machine that was listed in the WINS server response to a request for the list of - Domain Controllers.
The logon process begins with negotiation of the SMB/CIFS protocols that are to be used; this is followed by an exchange of information that ultimately includes the client sending the @@ -208,7 +208,7 @@ connection, but that is a good point to halt for now. The priority here must center around identification of network infrastructure needs. A secondary fact we need to know is, what happens when - local Domain Controllers fail or break?
+ local Domain Controllers fail or break?
Under most circumstances, the nearest Domain Controller responds to the netlogon mailslot broadcast. The exception to this norm occurs when the nearest Domain Controller is too busy or is out @@ -216,19 +216,19 @@ important that every network segment should have at least two Domain Controllers. Since there can be only one Primary Domain Controller (PDC), all additional Domain Controllers are by definition - Backup Domain Controllers (BDCs).
+ Backup Domain Controllers (BDCs).
The provision of sufficient servers that are BDCs is an important design factor. The second important design factor involves how each of the BDCs obtains user authentication data. That is the subject of the next section as it involves key - decisions regarding Identity Management facilities.
Network managers recognize that in large organizations users generally need to be given resource access based on needs, while being excluded from other resources for reasons of privacy. It is, therefore, essential that all users identify themselves at the point of network access. The network logon is the principal means by which user credentials are validated and filtered, and appropriate - rights and privileges are allocated.
+ rights and privileges are allocated.
Unfortunately, network resources tend to have their own Identity Management facilities, the quality and manageability of which varies from quite poor to exceptionally good. Corporations that use a mixture @@ -238,7 +238,7 @@ was originally called Yellow Pages, and was renamed when a telephone company objected to the use of its trademark. What was once called Yellow Pages is today known - as Network Information System (NIS).
+ as Network Information System (NIS).
NIS gained a strong following throughout the UNIX/VMS space in a short period of time and retained that appeal and use for over a decade. Security concerns as well as inherent limitations @@ -247,17 +247,17 @@ adopted. Sun updated this to a more secure implementation called NIS+, but even it has fallen victim to changing demands as the demand for directory services that can be coupled with other - information systems is catching on.
+ information systems is catching on.
Nevertheless, both NIS and NIS+ continue to hold ground in business areas where UNIX still has major sway. Examples of organizations that remain firmly attached to the use of NIS and NIS+ includes large government departments, education institutions, as well as large corporations that have a scientific or engineering - focus.
Today's networking world needs a scalable, distributed Identity Management infrastructure, commonly called a directory. The most popular technologies today are Microsoft Active Directory service - and a number of LDAP implementations.
+ and a number of LDAP implementations.
The problem of managing multiple directories has become a focal point over the past decade. This has created a large market for meta-directory products and services that allow organizations that @@ -265,19 +265,19 @@ centers to provision information from one directory into another. The attendant benefit to end users is the promise of having to remember and deal with fewer login identities and - passwords.
The challenge of every large network is to find the optimum balance of internal systems and facilities for Identity Management resources. How well the solution is chosen and implemented has potentially significant impact on network bandwidth - and systems response needs.
In Chapter 6, you implemented a single LDAP server for the entire network. This may work for smaller networks, but almost certainly fails to meet the needs of large and complex networks. The following section documents how one may implement a single master LDAP server, with multiple slave servers.
What is the best method for implementing master/slave LDAP servers within the context of a distributed 2000 user network is a - question that remains to be answered.
+ question that remains to be answered.
One possibility that has great appeal is to create one single large distributed domain. The practical implications of this design (see ???) demands the placement of @@ -286,7 +286,7 @@ over the wide-area links, except as a totally unavoidable measure. Network design must balance the risk of loss of user productivity against the cost of network management and - maintenance.
The network design in ??? takes the approach that management of networks that are too remote to be capable of being managed effectively from New York ought @@ -296,15 +296,15 @@ and can be independently managed and controlled. One of the key drawbacks of this design is that it flies in the face of the ability for network users to roam globally without some compromise - in how they may access global resources.
+ in how they may access global resources.
Desk-bound users need not be negatively affected by this design, since the use of interdomain trusts can be used to satisfy - the need for global data sharing.
+ the need for global data sharing.
When Samba-3 is configured to use an LDAP backend, it stores the domain account information in a directory entry. This account entry contains the domain SID. An unintended but exploitable side effect is that this makes it possible to operate with more than one PDC on a - distributed network.
How might this peculiar feature be exploited? The answer is simple. It is imperative that each network segment should have its own WINS server. Major servers on remote network segments can be @@ -314,7 +314,7 @@ as if it is an independent domain, while all sharing the same domain SID. Since all domain account information can be stored in a single LDAP backend, users have unfettered ability to - roam.
This concept has not been exhaustively validated, though we can see no reason why this should not work. The important facets are: The name of the domain must be identical in all @@ -325,7 +325,7 @@ primary name. A single master LDAP server can be based in New York, with multiple LDAP slave servers located on every network segment. Finally, the BDCs should each use fail-over LDAP servers - that are in fact slave LDAP servers on the local segments.
+ that are in fact slave LDAP servers on the local segments.
With a single master LDAP server, all network updates are effected on a single server. In the event that this should become excessively fragile or network bandwidth limiting, one could @@ -337,25 +337,25 @@ referential traffic. It should be noted that all directory administrators must of necessity follow the same standard procedures for managing the directory, as retroactive correction of - inconsistent directory information can be exceedingly difficult.
As organizations grow, the number of points of control increase also. In a large distributed organization, it is important that the Identity Management system must be capable of being updated from many locations, and it is equally important that changes made should become capable of being used in a reasonable period, typically minutes rather than days (the old limitation of highly manual - systems).
Samba-3 has the ability to use multiple password (authentication and identity resolution) backends. The diagram in ??? demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system password database. The diagram only documents the mechanisms for authentication and identity resolution (obtaining a UNIX UID/GID) using the specific systems shown. -
Samba is capable of using the smbpasswd, tdbsam, xmlsam, and mysqlsam authentication databases. The SMB passwords can, of course, also be stored in an LDAP ldapsam backend. LDAP is the preferred passdb backend for distributed network - operations.
Additionally, it is possible to use multiple passdb backends concurrently as well as have multiple LDAP backends. As a result, one can specify a fail-over LDAP backend. The syntax for specifying a @@ -368,7 +368,7 @@ This configuration tells Samba to use a single LDAP server as shown in ???.
- + The addition of a fail-over LDAP server can simply be done by adding a second entry for the fail-over server to the single ldapsam entry as shown here (note the particular @@ -391,7 +391,7 @@ ldapsam:ldap://slave.abmas.biz ...
- + The effect of this style of entry is that Samba lists the users that are in both LDAP databases. If both contain the same information, it results in each record being shown twice. This is, of course, not the @@ -411,7 +411,7 @@
It is assumed that the network you are working with follows in a pattern similar to what has been covered in Chapter 6. The following steps permit the operation of a Master/Slave OpenLDAP arrangement.
- + Log onto the master LDAP server as root. You are about to change the configuration of the LDAP server, so it makes sense to temporarily halt it. Stop OpenLDAP from running on @@ -423,7 +423,7 @@
root# service ldap stop
-
Edit the /etc/openldap/slapd.conf file so it matches the content of ???.
@@ -447,7 +447,7 @@
root# slapadd -v -l admin-accts.ldif
-
Change directory to a suitable place to dump the contents of the LDAP server. The dump file (and LDIF file) is used to preload the Slave LDAP server database. You can dump the database by executing: @@ -455,7 +455,7 @@ root# slapcat -v -l LDAP-transfer-LDIF.txt
Each record is written to the file. -
Copy the file LDAP-transfer-LDIF.txt to the intended slave LDAP server. A good location could be in the directory /etc/openldap/preload. @@ -505,7 +505,7 @@ root# service ldap start root# chkconfig ldap on
Go back to the master LDAP server. Execute the following to start LDAP as well as slurpd, the synchronization daemon, as shown here: @@ -515,13 +515,13 @@ root# rcslurpd start root# chkconfig slurpd on
- + On Red Hat Linux, check the equivalent command to start slurpd. -
On the master ldap server you may now add an account to validate that replication is working. Assuming the configuration shown in Chapter 6, execute:
-root# /var/lib/samba/sbin/smbldap-useradd.pl -a fruitloop +root# /var/lib/samba/sbin/smbldap-useradd -a fruitloop
On the slave LDAP server, change to the directory /var/lib/ldap. @@ -632,299 +632,299 @@ index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub -
Example 7.3. Primary Domain Controller smb.conf File Part A
+
Where Samba-3 is used as a Domain Controller, the use of LDAP is an essential component necessary to permit the use of BDCs. -
Replication of the LDAP master server to create a network of BDCs is an important mechanism for limiting wide-area network traffic.
@@ -936,40 +936,40 @@ Roaming profiles must be contained to the local network segment. Any departure from this may clog wide-area arteries and slow legitimate network traffic to a crawl. -
There is much rumor and misinformation regarding the use of MS Windows networking protocols. These questions are just a few of those frequently asked. -
- DHCPnetworkbandwidth
+
- DHCPnetworkbandwidth Is it true that DHCP uses lots of wide-area network bandwidth? -
- background communicationLDAPmaster/slavebackground communication +
- background communicationLDAPmaster/slavebackground communication How much background communication takes place between a Master LDAP server and its slave LDAP servers? -
- +
- LDAP has a database. Is LDAP not just a fancy database front end? -
- OpenLDAP +
- OpenLDAP Can Active Directory obtain account information from an OpenLDAP server? -
- +
- What are the parts of a roaming profile? How large is each part? -
- +
- Can the My Documents folder be stored on a network drive? -
- wide-areanetworkbandwidthWINS +
- wide-areanetworkbandwidthWINS How much wide-area network bandwidth does WINS consume? -
- +
- How many BDCs should I have? What is the right number of Windows clients per server? -
- NIS serverLDAP +
- NIS serverLDAP I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server? -
- +
- Can I use NIS in place of LDAP? -
Is it true that DHCP uses lots of wide-area network bandwidth? -
It is a smart practice to localize DHCP servers on each network segment. As a rule, there should be two DHCP servers per network segment. This means that if one server fails, there is always another to service user needs. DHCP requests use only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network routers. This makes it possible to run fewer DHCP servers. -
A DHCP network address request and confirmation usually results in about six UDP packets. The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP clients and that uses a 24-hour IP address lease. This means that all clients renew @@ -986,21 +986,21 @@ x 512 (bytes/packet) = 0.9 Mbytes/day.
From this can be seen that the traffic impact would be minimal. -
Even when DHCP is configured to do DNS update (Dynamic DNS) over a wide-area link, the impact of the update is no more than the DHCP IP address renewal traffic and, thus, still insignificant for most practical purposes. -
How much background communication takes place between a Master LDAP server and its slave LDAP servers? -
The process that controls the replication of data from the Master LDAP server to the Slave LDAP servers is called slurpd. The slurpd remains nascent (quiet) until an update must be propagated. The propagation traffic per LDAP salve to update (add/modify/delete) two user accounts requires less than 10Kbytes traffic. -
+
LDAP has a database. Is LDAP not just a fancy database front end? -
LDAP does store its data in a database of sorts. In fact the LDAP backend is an application-specific data storage system. This type of database is indexed so that records can be rapidly located, but the database is not generic and can be used only in particular pre-programmed ways. General external @@ -1009,41 +1009,41 @@ orientation and typically allows external programs to perform ad-hoc queries, even across data tables. An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific simple queries. The term database is heavily overloaded and, thus, much misunderstood. -
Can Active Directory obtain account information from an OpenLDAP server? -
No, at least not directly. It is possible to provision Active Directory from/to an OpenLDAP database through use of a meta-directory server. Microsoft MMS (now called MIIS) can interface to OpenLDAP using standard LDAP queries/updates. -
+
What are the parts of a roaming profile? How large is each part? -
A roaming profile consists of:
Desktop folders such as: Desktop, My Documents, My Pictures, My Music, Internet Files, Cookies, Application Data, Local Settings, and more. See ???. -
Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all such folders can be redirected to network drive resources. See ??? for more information regarding folder redirection.
A static or re-writable portion that is typically only a few files (2-5 Kbytes of information). -
The registry load file that modifies the HKEY_LOCAL_USER hive. This is the NTUSER.DAT file. It can be from 0.4-1.5 MBytes. -
Microsoft Outlook PST files may be stored in the Local Settings\Application Data folder. It can be up to 2 Gbytes in size per PST file. -
+
Can the My Documents folder be stored on a network drive? -
Yes. More correctly, such folders can be redirected to network shares. No specific network drive connection is required. Registry settings permit this to be redirected directly to a UNC (Universal Naming Convention) resource, though it is possible to specify a network drive letter instead of a UNC name. See ???. -
MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS server, the total bandwidth demand measured at the WINS server, averaged over an eight-hour working day, @@ -1055,7 +1055,7 @@
In conclusion, the total load afforded through WINS traffic is again marginal to total operational usage as it should be. -
+
How many BDCs should I have? What is the right number of Windows clients per server?
It is recommended to have at least one BDC per network segment, including the segment served @@ -1069,16 +1069,16 @@
As unsatisfactory as the answer might sound, it all depends on network and server load characteristics. -
I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server?
The correct answer to both questions is yes. But do understand that an LDAP server has a configurable schema that can store far more information for many more purposes than just NIS. -
+
Can I use NIS in place of LDAP? -
No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal with the types of data necessary for interoperability with Microsoft Windows networking. The use of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/appendix.html samba-3.0.14a/docs/htmldocs/Samba-Guide/appendix.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/appendix.html 2005-03-23 10:19:24.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/appendix.html 2005-04-11 11:18:51.000000000 -0500 @@ -1,10 +1,10 @@ -
Appendix A. Appendix: A Collection of Useful Tid-bits Table of Contents
Appendix A. Appendix: A Collection of Useful Tid-bits Table of Contents
Information presented here is considered to be either basic or well-known material that is informative yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that the process for joining a Windows client to a Samba-controlled Windows Domain may somehow involve steps different from doing so with Windows NT4 or a Windows ADS Domain. Be assured that the steps are identical, as shown in the example given below. -
Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. This section steps through the process for making a Windows 200x/XP Professional machine a member of a Domain Security environment. It should be noted that this process is identical @@ -46,27 +46,27 @@
The “Welcome to the MIDEARTH domain” dialog box should appear. At this point, the machine must be rebooted. Joining the domain is now complete. -
The screen capture shown in ??? has a button labeled . This button opens a panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members of Microsoft Active Directory. Active Directory is heavily oriented around the DNS name space. -
Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server to find the services (like which machines are Domain Controllers or which machines have the Netlogon service running). -
The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, this does not affect Domain Membership, but it can break network browsing and the ability to resolve your computer name to a valid IP address.
The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain. Where the client is a member of a Samba Domain, it is preferable to leave this field blank. -
According to Microsoft documentation, “If this computer belongs to a group with Group Policy enabled on Primary DNS suffice of this computer, the string specified in the Group Policy is used as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is used only if Group Policy is disabled or unspecified.” -
One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is in the /usr/local/samba directory. This is a perfectly reasonable location, particularly given all the other @@ -74,7 +74,7 @@
Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team default. -
Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy System (FHS), have elected to locate the configuration files under the /etc/samba directory, common binary files (those used by users) in the /usr/bin directory, and the administrative files (daemons) in the @@ -83,13 +83,13 @@ /usr/share/swat. There are additional support files for smbd in the /usr/lib/samba directory tree. The files located there include the dynamically loadable modules for the passdb backend as well as for the VFS modules. -
Samba creates run-time control files and generates log files. The run-time control files (tdb and dat files) are stored in the /var/lib/samba directory. Log files are created in /var/log/samba.
When Samba is built and installed using the default Samba Team process, all files are located under the /usr/local/samba directory tree. This makes it simple to find the files that Samba owns. -
One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location of all files called smbd. Here is an example:
@@ -122,7 +122,7 @@
Many people have been caught by installation of Samba using the default Samba Team process when it was already installed by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by - executing: + executing:
root# rpm -qa | grep samba samba3-pdb-3.0.12-1 @@ -134,9 +134,9 @@ samba3-doc-3.0.12-1 samba3-client-3.0.12-1 samba3-cifsmount-3.0.12-1 -
The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. -
Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba, there are three daemons, two of which are needed as a minimum. @@ -177,19 +177,19 @@ fi exit 0
- nmbd
- - + + This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.
- smbd
- - + + This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.
- winbindd
- - + + This daemon should be started when Samba is a member of a Windows NT4 or ADS Domain. IT is also needed when Samba has trust relationships with another Domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid @@ -243,22 +243,22 @@ echo "Usage: smb {start|stop|restart|status}" exit 1 esac -
SUSE Linux implements individual control over each Samba daemon. A samba control script that can be conveniently executed from the command line is shown in ???. This can be located in the directory /sbin in a file called samba. This type of control script should be owned by user root and group root, and set so that only root can execute it. -
A sample startup script for a Red Hat Linux system is shown in ???. This file could be located in the directory /etc/rc.d and can be called samba. A similar startup script is required to control winbind. If you want to find more information regarding startup scripts please refer to the packaging section of the Samba source code distribution tarball. The packaging files for each platform include a startup control file. -
The following files are common to all DNS server configurations. Rather than repeat them multiple times, they are presented here for general reference. -
+
The forward zone file for the loopback address never changes. An example file is shown in ???. All traffic destined for an IP address that is hosted on a physical interface on the machine itself is routed to the loopback adaptor. This is @@ -275,7 +275,7 @@ IN NS @ IN A 127.0.0.1 -
The reverse zone file for the loopback address as shown in ??? is necessary so that references to the address 127.0.0.1 can be resolved to the correct name of the interface. @@ -335,15 +335,15 @@ . 3600000 NS M.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 ; End of File -
The content of the root hints file as shown in ??? changes slowly over time. Periodically this file should be updated from the source shown. Because of its size this file is located at the end of this appendix. -
The following procedure may be used as an alternative means of configuring the initial LDAP database. Many administrators prefer to have greater control over how system files get configured. -
The first step to get the LDAP server ready for action is to create the LDIF file from which the LDAP database will be preloaded. This is necessary to create the containers into which the user, group, and so on, accounts is written. It is also necessary to @@ -691,7 +691,7 @@ sambaGroupType: 2 displayName: Domain Users description: Domain Users -
The LDAP Account Manager (LAM) is an application suite that has been written in PHP. LAM can be used with any Web server that has PHP4 support. It connects to the LDAP server either using unencrypted connections or via SSL. LAM can be used to manage @@ -702,16 +702,16 @@ home page and from its mirror sites. LAM has been released under the GNU GPL version 2. The current version of LAM is 0.4.3. Release of version 0.5 is expected some time early in 2004. -
A web server that will work with PHP4.
PHP4 (available from the PHP home page.)
OpenLDAP 2.0 or later.
A Web browser that supports CSS.
Perl.
The gettext package.
mcrypt + mhash (optional since version 0.4.3).
It is also a good idea to install SSL support.
LAM is a useful tool that provides a simple Web-based device that can be used to - manage the contents of the LDAP directory to: + manage the contents of the LDAP directory to:
Display user/group/host and Domain entries.
Manages entries (Add/Delete/Edit).
Filter and sort entries.
Set LAM administrator accounts.
Store and use multiple operating profiles.
Edit organizational units (OUs).
Upload accounts from a file.
- Is compatible with Samba-2.2.x and Samba-3.
When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba user, group, and windows domain member machine accounts. -
The default password is “lam.” It is highly recommended that you use only an SSL connection to your Web server for all remote operations involving LAM. If you want secure connections, you must configure your Apache Web server to permit connections @@ -730,7 +730,7 @@ Copy the extracted files to the document root directory of your Web server. For example, on SuSE Linux Enterprise Server 8, copy to the /srv/web/htdocs directory. -
Set file permissions using the following commands:
root# chown -R wwwrun.www /srv/www/htdocs/lam @@ -739,14 +739,14 @@ root# chmod 755 /srv/www/htdocs/lam/config root# chmod 755 /srv/www/htdocs/lam/lib/*pl
-
Using your favorite editor create the following config.cfg LAM configuration file:
root# cd /srv/www/htdocs/lam/config root# cp config.cfg_sample config.cfg root# vi config.cfg -
An example file is shown in ???. This is the minimum configuration that must be completed. The LAM profile file can be created using a convenient wizard that is part of the LAM @@ -760,18 +760,18 @@ lam.conf_sample file to a file called lam.conf then, using your favorite editor, change the settings to match local site needs. -
An example of a working file is shown here in ???. This file has been stripped of comments to keep the size small. The comments and help information provided in the profile file that the wizard creates is very useful and will help many administrators to avoid pitfalls. Your configuration file obviously reflects the configuration options that are preferred at your site. -
It is important that your LDAP server is running at the time that LAM is being configured. This permits you to validate correct operation. An example of the LAM login screen is provided in ???. -
The LAM configuration editor has a number of options that must be managed correctly. An example of use of the LAM configuration editor is shown in ???. It is important that you correctly set the minimum and maximum UID/GID values that are @@ -780,12 +780,12 @@ The best work-around is to temporarily set the minimum values to zero (0) to permit the initial settings to be made. Do not forget to reset these to sensible values before using LAM to add additional users and groups. -
LAM has some nice, but unusual features. For example, one unexpected feature in most application screens permits the generation of a PDF file that lists configuration information. This is a well thought out facility. This option has been edited out of the following screen shots to conserve space. -
When you log onto LAM the opening screen drops you right into the user manager as shown in ???. This is a logical action as it permits the most-needed facility to be used immediately. The editing of an existing user, as with the addition of a new user, @@ -798,7 +798,7 @@ for user accounts, group accounts may be rapidly dealt with. ??? shown a sub-screen from the group editor that permits users to be assigned secondary group memberships. -
The final screen presented here is one that you should not normally need to use. Host accounts will be automatically managed using the smbldap-tools scripts. This means that the screen ??? will, in most cases, not be used. @@ -839,7 +839,7 @@ samba3: yes cachetimeout: 5 pwdhash: SSHA -
The setting of the SUID/SGID bits on the file or directory permissions flag has particular consequences. If the file is executable and the SUID bit is set, it executes with the privilege of (with the UID of) the owner of the file. For example, if you are logged onto a system as @@ -909,34 +909,34 @@ total 1 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
-
The integrity of shared data is often viewed as a particularly emotional issue, especially where there are concurrent problems with multi-user data access. Contrary to the assertions of some who have experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
The solution to concurrent multi-user data access problems must consider three separate areas - from which the problem may stem: -
application level locking controls.
client side locking controls.
server side locking controls.
+ from which the problem may stem: +
application level locking controls.
client side locking controls.
server side locking controls.
Many database applications use some form of application-level access control. An example of one well-known application that uses application-level locking is Microsoft Access. Detailed guidance is provided given that this is the most common application for which problems have been reported. -
Common applications that are affected by client- and server-side locking controls include MS Excel and Act!. Important locking guidance is provided here. -
+
The best advice that can be given is to carefully read the Microsoft knowledge base articles that cover this area. Examples of relevant documents includes: -
http://support.microsoft.com/default.aspx?scid=kb;en-us;208778
http://support.microsoft.com/default.aspx?scid=kb;en-us;299373
http://support.microsoft.com/default.aspx?scid=kb;en-us;208778
http://support.microsoft.com/default.aspx?scid=kb;en-us;299373
Make sure that your MS Access database file is configured for multi-user access (not set for exclusive open). Open MS Access on each client workstation then set the following: ++. Set network path to Default database folder: \\server\share\folder.
You can configure MS Access file sharing behavior as follows: click . - Set: -
Default open mode: Shared
Default Record Locking: Edited Record
Open databases using record_level locking
Default open mode: Shared
Default Record Locking: Edited Record
Open databases using record_level locking
You must now commit the changes so that they will take effect. To do so, click . At this point, you should exit MS Access, restart it and then validate that these settings have not changed. -
Where the server sharing the ACT! database(s) is running Samba, Windows NT, 200x or XP, you must disable opportunistic locking on the server and all workstations. Failure to do so results in data corruption. This information is available from the Act! Web site @@ -944,7 +944,7 @@ 1998223162925 as well as from article 200110485036. -
These documents clearly state that opportunistic locking must be disabled on both the server (Samba in the case we are interested in here), as well as on every workstation from which the centrally shared Act! database will be accessed. Act! provides @@ -952,18 +952,18 @@ registry settings that may otherwise interfere with the operation of Act! Registered Act! users may download this utility from the Act! Web site. -
Third-party Windows applications may not be compatible with the use of opportunistic file - and record locking. For applications that are known not to be compatible,[14] oplock + and record locking. For applications that are known not to be compatible,[14] oplock support may need to be disabled both on the Samba server and on the Windows workstations. -
Oplocks enable a Windows client to cache parts of a file that are being edited. Another windows client may then request to open the file with the ability to write to it. The server will then ask the original workstation that had the file open with a write lock to release it's lock. Before doing so, that workstation must flush the file from cache memory to the disk or network drive. -
Disabling of Oplocks usage may require server and client changes. Oplocks may be disabled by file, by file pattern, on the share, or on the samba server. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/DomApps.html samba-3.0.14a/docs/htmldocs/Samba-Guide/DomApps.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/DomApps.html 2005-03-23 10:19:23.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/DomApps.html 2005-04-11 11:18:49.000000000 -0500 @@ -1,4 +1,4 @@ -
Chapter 12. Integrating Additional Services Table of Contents
Chapter 12. Integrating Additional Services Table of Contents
You've come a long way now. You have pretty much mastered Samba-3 for most uses it can be put to. Up until now, you have cast Samba-3 in the leading role and where authentication was required, you have used one or another of @@ -9,7 +9,7 @@ implementing Samba and Samba-supported services in a domain controlled by the latest Windows authentication technologies. Let's get started this is leading edge. -
+
Abmas has continued its miraculous growth; indeed, nothing seems to be able to stop its diversification into multiple (and seemingly unrelated) fields. Its latest acquisition is Abmas Snack Foods, a big player in the snack-food @@ -25,13 +25,13 @@ You have decided to set the ball rolling by introducing Samba-3 into the network gradually, taking over key services and easing the way to a full migration and, therefore, integration into Abmas's existing business later. -
You've promised the skeptical Abmas Snack Foods management team that you can show them how Samba can ease itself and other Open Source technologies into their existing infrastructure and deliver sound business advantages. Cost cutting is high on their agenda (a major promise of the acquisition). You have chosen Web proxying and caching as your proving ground. -
Abmas Snack Foods has several thousand users housed at their Head Office and multiple regional offices, plants, and warehouses. A high proportion of the business's work is done online, so Internet access for most of these @@ -40,7 +40,7 @@ team. The bandwidth requirements were horrific (comparable to a small ISP), and the team soon discovered proxying and caching. In fact, they became one of the earliest commercial users of Microsoft ISA. -
The team is not happy with ISA. Because it never lived up to its marketing promises, it under-performed and had reliability problems. You have pounced on the opportunity to show what Open Source can do. The one thing they do like, however, is ISA's @@ -51,7 +51,7 @@
This is a hands-on exercise. You build software applications so that you obtain the functionality Abmas needs. -
The key requirements in this business example are straightforward. You are not required to do anything new, just to replicate an existing system, not lose any existing features, and improve performance. The key points are: @@ -61,7 +61,7 @@ Distributed system to accommodate load and geographical distribution of users
Seamless and transparent interoperability with the existing Active Directory domain -
Functionally, the user's Internet Explorer requests a browsing session with the Squid proxy, for which it offers its AD authentication token. Squid hands off the authentication request to the Samba-3 authentication helper application @@ -82,21 +82,21 @@ Configuring, compiling, and then installing the supporting Samba-3 components
Tying it all together -
You are a stranger in a strange land and all eyes are upon you. Some would even like to see you fail. For you to gain the trust of your newly acquired IT people, it is essential that your solution does everything the old one did, but does it better in every way. Only then will the entrenched positions consider taking up your new way of doing things on a wider scale. -
First, your system needs to be prepared and in a known good state to proceed. This consists of making sure that everything the system depends on is present and that everything that could interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3 packages and updating them if necessary. If conflicting packages of these programs are installed, they must be removed. -
The following packages should be available on your Red Hat Linux system: -
In the case of SUSE Linux, these packages are called:
heimdal-lib
heimdal-devel -
pam_krb5 @@ -120,18 +120,18 @@ If the required packages are not present on your system, you must install them from the vendor's installation media. Follow the administrative guide for your Linux system to ensure that the packages are correctly updated. -
Note
Note
If the requirement is for interoperation with MS Windows Server 2003, it will be necessary to ensure that you are using MIT Kerberos version 1.3.1 or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires updating. -
Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. -
If Samba and/or Squid rpms are installed, they should be updated. You can build both from source. -
Locating the packages to be uninstalled can be achieved by running:
root# rpm -qa | grep -i samba @@ -141,14 +141,14 @@
root# rpm -e samba-common
-
The systems Kerberos installation must be configured to communicate with your primary Active Directory server (ADS KDC).
Strictly speaking, MIT Kerberos version 1.3.1 currently gives the best results, although the current default Red Hat MIT version 1.2.7 gives acceptable results unless you are using Windows 2003 servers. -
Officially, neither MIT (1.3.1) nor Heimdal (0.6) Kerberos needs an /etc/krb5.conf file in order to work correctly. All ADS domains automatically create SRV records in the DNS zone Kerberos.REALM.NAME for each KDC in the realm. Since both @@ -156,11 +156,11 @@ automatically find the KDCs. In addition, krb5.conf only allows specifying a single KDC, even there if there is more than one. Using the DNS lookup allows the KRB5 libraries to use whichever KDCs are available. -
If you find the need to manually configure the krb5.conf, you should edit it to have the contents shown in ???. The final fully qualified path for this file should be /etc/krb5.conf. -
The following gotchas often catch people out. Kerberos is case sensitive. Your realm must be in UPPERCASE, or you will get an error: “Cannot find KDC for requested realm while getting initial credentials”. Kerberos is picky about time synchronization. The time @@ -175,7 +175,7 @@ /etc/hosts entry mapping the IP address of your KDC to its NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error when you try to join the realm. -
You are now ready to test your installation by issuing the command:
root# kinit [USERNAME@REALM] @@ -195,21 +195,21 @@ LONDON.ABMAS.BIZ = { kdc = w2k3s.london.abmas.biz } -
root# klist -e
shows the Kerberos tickets cached by the system: -
Samba must be configured to correctly use Active Directory. Samba-3 must be used, as this has the necessary components to interface with Active Directory. -
Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team FTP site. The official Samba Team RPMs for Red Hat Fedora Linux contain the ntlm_auth tool needed, and are linked against MIT KRB5 version 1.3.1 and, therefore, are ready for use. -
The necessary, validated RPM packages for SUSE Linux may be obtained from the SerNet FTP site that is located in Germany. All SerNet RPMs are validated, have the necessary @@ -218,7 +218,7 @@
Using your favorite editor, change the /etc/samba/smb.conf file so it has contents similar to the example shown in ???. -
Next you need to create a computer account in the Active Directory. This sets up the trust relationship needed for other clients to authenticate to the Samba server with an Active Directory Kerberos ticket. @@ -227,7 +227,7 @@
root# net ads join -U administrator%vulcon
-
Your new Samba binaries must be started in the standard manner as is applicable to the platform you are running on. Alternately, start your Active Directory enabled Samba with the following commands: @@ -236,7 +236,7 @@ root# nmbd -D root# winbindd -B
-
We now need to test that Samba is communicating with the Active Directory domain; most specifically, we want to see whether winbind is enumerating users and groups. Issue the following commands: @@ -268,7 +268,7 @@ LONDON+DnsUpdateProxy
This enumerates all the groups in your Active Directory tree. -
Squid uses the ntlm_auth helper build with Samba-3. You may test ntlm_auth with the command:
@@ -279,7 +279,7 @@
root# NT_STATUS_OK: Success (0x0)
-
The ntlm_auth helper, when run from a command line as the user “root”, authenticates against your Active Directory domain (with the aid of winbind). It manages this by reading from the winbind privileged pipe. @@ -297,61 +297,61 @@ root# chgrp squid /var/lib/samba/winbindd_privileged root# chmod 750 /var/lib/samba/winbindd_privileged
-
For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
Edit your /etc/nsswitch.conf file so it has the parameters shown in ???. -
Example 12.2. Samba Configuration File: /etc/samba/smb.conf
[global] + Example 12.2. Samba Configuration File: /etc/samba/smb.conf
[global] - workgroup = LONDON + workgroup = LONDON - netbios name = W2K3S + netbios name = W2K3S - realm = LONDON.ABMAS.BIZ + realm = LONDON.ABMAS.BIZ - security = ads + security = ads - encrypt passwords = yes + encrypt passwords = yes - password server = w2k3s.london.abmas.biz # separate domain and username with '/', like DOMAIN/username + password server = w2k3s.london.abmas.biz # separate domain and username with '/', like DOMAIN/username - winbind separator = / # use UIDs from 10000 to 20000 for domain users + winbind separator = / # use UIDs from 10000 to 20000 for domain users - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 # allow enumeration of winbind users and groups + idmap gid = 10000-20000 # allow enumeration of winbind users and groups - winbind enum users = yes + winbind enum users = yes - winbind enum groups = yes + winbind enum groups = yes winbind user default domain = yes Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf
passwd: files winbind shadow: files group: files winbind -
Squid must be configured correctly to interact with the Samba-3 components that handle Active Directory authentication. -
If your Linux distribution is SUSE Linux 9, the version of Squid supplied is already enabled to use the winbind helper agent. You can, therefore, omit the steps that would build the Squid binary programs. -
Squid, by default, runs as the user nobody. You need to add a system user squid and a system group squid if they are not set up already (if the default Red Hat squid rpms were installed, they will be). Set up a squid user in /etc/passwd and a squid group in /etc/group if these aren't there already. -
You now need to change the permissions on Squid's var directory. Enter the following command:
root# chown -R squid /var/cache/squid
-
Squid must also have control over its logging. Enter the following commands:
root# chown -R chown squid:squid /var/log/squid @@ -364,10 +364,10 @@ root# chown -R chown squid:squid /var/cache/squid root# chmod 770 /var/cache/squid
-
The /etc/squid/squid.conf file must be edited to include the lines from ??? and ???. -
You must create Squid's cache directories before it may be run. Enter the following command:
root# squid -z @@ -394,14 +394,14 @@ auth_param basic credentialsttl 2 hours acl AuthorizedUsers proxy_auth REQUIRED http_access allow all AuthorizedUsers -
Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft Windows clients use, even when accessing traditional services such as Web browsers. Depending on whom you discuss this with, this is either good or bad. No matter how you might evaluate this, the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over the cookie-based authentication regime used by all competing browsers. It is Samba's implementation of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. -
The development of the ntlm_auth module was first discussed in many Open Source circles in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of ntlm_auth during one of the late developer meetings that took place. Since that time, the @@ -420,44 +420,44 @@ You would be well advised to recognize the fact that all cache-intensive proxying solutions demand a lot of memory. Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. -
-
+
- What does Samba have to do with Web proxy serving? -
- +
- What other services does Samba provide? -
- +
- Does use of Samba (ntlm_auth) improve the performance of Squid? -
+
What does Samba have to do with Web proxy serving? -
To provide transparent interoperability between Windows clients and the network services that are used from them, Samba has had to develop tools and facilities that deliver that. The benefit of Open Source software is that it can readily be reused. The current ntlm_auth module is basically a wrapper around authentication code from the core of the Samba project. -
The ntlm_auth module supports basic plain-text authentication and NTLMSSP protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without the user being interrupted via his/her Windows logon credentials. This facility is available with MS Windows explorer and is one of the key benefits claimed for Microsoft Internet Information Server. There are a few open source initiatives to provide support for these protocols in the Apache Web server also. -
The short answer is that by adding a wrapper around key authentication components of Samba, other projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. -
+
What other services does Samba provide? -
Samba-3 is a file and print server. The core components that provide this functionality are smbd, nmbd, and the Identity resolver daemon, winbindd. -
Samba-3 is an SMB/CIFS client. The core component that provides this is called smbclient. -
Samba-3 includes a number of helper tools, plug-in modules, utilities, and test/validation facilities. Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux servers and client. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switcher modules to permit Identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial server products). -
+
Does use of Samba (ntlm_auth) improve the performance of Squid?
Not really. Samba's ntlm_auth module handles only authentication. It requires that diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/go01.html samba-3.0.14a/docs/htmldocs/Samba-Guide/go01.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/go01.html 2005-03-23 10:19:25.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/go01.html 2005-04-11 11:18:51.000000000 -0500 @@ -1,4 +1,4 @@ -
Glossary - Access Control List
+
Glossary - Access Control List
A detailed list of permissions granted to users or groups with respect to file and network resource access.
- Active Directory Service
diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/HA.html samba-3.0.14a/docs/htmldocs/Samba-Guide/HA.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/HA.html 2005-03-23 10:19:23.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/HA.html 2005-04-11 11:18:50.000000000 -0500 @@ -1,4 +1,4 @@ -
Chapter 13. Performance, Reliability, and Availability Chapter 13. Performance, Reliability, and Availability Well, you have reached the chapter before the Appendix. It is customary to attempt to wrap up the theme and contents of a book in what is generally regarded as the chapter that should draw conclusions. This book is a suspense thriller and since @@ -7,7 +7,7 @@ regarding some of the things everyone can do to deliver a reliable Samba-3 network.
In a world so full of noise, how can the sparrow be heard? -
--Anonymous
--Anonymous The sparrow is a small bird whose sounds are drowned out by the noise of the busy world it lives in. Likewise, the simple steps that can be taken to improve the reliability and availability of a Samba network are often drowned out by the volume @@ -15,17 +15,17 @@ suggest that clustering is not important, because clearly it is. This chapter does not devote itself to discussion of clustering because each clustering methodology uses its own custom tools and methods. Only passing comments are offered concerning these methods. -
A search for “samba cluster” produced 71,600 hits. And a search for “highly available samba” and “highly available windows” produced an amazing number of references. It is clear from the resources on the Internet that Windows file and print services availability, reliability, and scalability are of vital interest to corporate network users. -
So without further background, you can review a checklist of simple steps that can be taken to ensure acceptable network performance while keeping costs of ownership well under control. -
If it is your purpose to get the best mileage out of your Samba servers, there is one rule that must be obeyed. If you want the best, keep your implementation as simple as possible. You may well be forced to introduce some complexities, but you should do so only as a last resort. @@ -33,7 +33,7 @@ Simple solutions are likely to be easier to get right than are complex ones. They certainly make life easier for your successor. Simple implementations can be more readily audited than can complex ones. -
Problems reported by users fall into three categories: configurations that do not work, those that have broken behavior, and poor performance. The term broken behavior means that the function of a partciluar Samba component appears to work sometimes, but not at @@ -41,7 +41,7 @@ broken behavior known to many Windows networking users occurs when the list of Windows machines in MS Explorer changes, sometimes listing machines that are running and at other times not listing them even though the machines are in use on the network. -
A significant number of reports concern problems with the smbfs file system driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that smbfs is part of Samba, simply because Samba includes the front-end tools @@ -50,24 +50,24 @@ facilities to core drivers that are supplied as part of the Linux kernel. These tools share a common infrastructure with some Samba components, but they are not maintained as part of Samba and are really foreign to it. -
The new project, cifsfs, is destined to replace smbfs. It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in this project.
The following table lists typical causes of: -
Not Working (NW)
Broken Behavior (BB)
Poor Performance (PP)
Table 13.1. Effect of Common Problems
Problem
NW
BB
PP
File Locking
-
X
-
Hardware Problems
X
X
X
Incorrect Authentication
X
X
-
Incorrect Configuration
X
X
X
LDAP Problems
X
X
-
Name Resolution
X
X
X
Printing Problems
X
X
-
Slow File Transfer
-
-
X
Winbind Problems
X
X
-
Not Working (NW)
Broken Behavior (BB)
Poor Performance (PP)
Table 13.1. Effect of Common Problems
Problem
NW
BB
PP
File Locking
-
X
-
Hardware Problems
X
X
X
Incorrect Authentication
X
X
-
Incorrect Configuration
X
X
X
LDAP Problems
X
X
-
Name Resolution
X
X
X
Printing Problems
X
X
-
Slow File Transfer
-
-
X
Winbind Problems
X
X
-
It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate problems that affect basic network operation. This book has provided sufficient working examples to help you to avoid all these problems. -
Your objective is to provide a network that works correctly, can grow at all times, is resilient at times of extreme demand, and can scale to meet future needs. The following subject areas provide pointers that can help you today. -
+
There are three basic current problem areas: bad hostnames, routed networks, and network collisions. These are covered in the discussion below. -
When configured as a DHCP client, a number of Linux distributions set the system hostname to localhost. If the parameter netbios name is not specified to something other than localhost, the Samba server appears @@ -78,11 +78,11 @@ set up a NetBIOS over TCP/IP connection to it. This cannot work, because that IP address is the local Windows machine itself. Hostnames must be valid for Windows networking to function correctly. -
A few sites have tried to name Windows clients and Samba servers with a name that begins with the digits 1-9. This does not work either because it may result in the client or server attempting to use that name as an IP address. -
A Samba server called FRED, in a NetBIOS Domain called COLLISION in a network environment that is part of the fully qualified Internet domain name space known as parrots.com, results in DNS name lookups for: fred.parrots.com @@ -90,31 +90,31 @@ (workgroup) collision.parrots.com since this results in DNS lookup attempts to resolve: fred.parrots.com.parrots.com, which most likely fails given that you probably do not have this in your DNS name space. -
Note
NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use of UDP-based broadcast traffic. You saw that during the exercises in Chapter 1. -
UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based networking cannot function across routed networks (i.e., multi-subnet networks) unless special provisions are made: -
Either install on every Windows client an LMHOSTS file (located in the directory C:\windows\system32\drivers\etc). It is also necessary to add to the Samba server smb.conf file the parameters: remote announce and remote browse sync. For more information, refer to the on-line manual page for the smb.conf file. -
Or configure Samba as a WINS server, and configure all network clients to use that WINS server in their TCP/IP configuration. -
Excessive network activity causes NetBIOS network time-outs. Time-outs may result in blue screen of death (BSOD) experiences. High collision rates may be caused by excessive UDP broadcast activity, by defective networking hardware, or through excessive network @@ -122,7 +122,7 @@
The use of WINS is highly recommended to reduce network broadcast traffic, as outlined in Chapter 1. -
Under no circumstances should the facility be supported by many routers, known as NetBIOS forwarding, unless you know exactly what you are doing. Inappropriate use of this facility can result in UDP broadcast storms. In one case in 1999, a university network became @@ -130,10 +130,10 @@ testing of a Samba server. The maximum throughput on a 100-Base-T (100 MBit/sec) network was less than 15 KBytes/sec. After the NetBIOS forwarding was turned off, file transfer performance immediately returned to 11 MBytes/sec. -
As a general rule, the contents of the smb.conf file should be kept as simple as possible. No parameter should be specified unless you know it is essential to operation. -
Many UNIX administrators like to fully document the settings in the smb.conf file. This is a bad idea because it adds content to the file. The smb.conf file is re-read by every smbd process every time the file time stamp changes (or, on systems where this does not work, every 20 seconds or so). @@ -141,7 +141,7 @@ As the size of the smb.conf file grows the risk of introduction of parsing errors increases also. It is recommended to keep a fully documented smb.conf file on hand, and then to operate Samba only with an optimized file. -
The preferred way to maintain a documented file is to call it something like smb.conf.master. You can generate the optimized file by executing:
@@ -167,7 +167,7 @@ Server role: ROLE_DOMAIN_PDC Press enter to see a dump of your service definitions
- + You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. The important thing to note is the noted Server role, as well as warning messages. Noted configuration conflicts must be remedied before proceeding. For example, the following error message represents a @@ -176,18 +176,18 @@ ERROR: both 'wins support = true' and 'wins server = <server list>' cannot be set in the smb.conf file. nmbd will abort with this setting.
-
There are two parameters that can cause severe network performance degradation, socket options and socket address. The socket options parameter was often necessary when Samba was used with the Linux 2.2.x kernels. Later kernels are largely self-tuning and seldom benefit from this parameter being set. Do not use either parameter unless it has been proven necessary to use them. -
Another smb.conf parameter that may cause severe network performance degradation is the strict sync parameter. Do not use this at all. There is no good reason to use this with any modern Windows client. The strict sync is often used together with the sync always parameter. This, too, can severely degrade network performance, so do not set it or if you must, do so with caution. -
Finally, many network administrators deliberately disable opportunistic locking support. While this does not degrade Samba performance, it significantly degrades Windows client performance because this disables local file caching on Windows clients and forces every file read and written to @@ -195,19 +195,19 @@ support, do so on the share on which it is required only. That way, all other shares can provide oplock support for operations that are tolerant of it. See ??? for more information. -
On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of authentication and logon processing. When a sole BDC on a routed network segment gets heavily loaded, it is possible that network logon requests and authentication requests may be directed to a BDC on a distant network segment. This significantly hinders wide-area network operations and is undesirable. -
As a general guide, instead of adding Domain Member servers to a network, you would be better advised to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add Domain Member servers. This practice ensures that there is always sufficient Domain Controllers to handle logon requests and authentication traffic. -
Every network client has its own peculiarities. From a management perspective, it is easier to deal with one version of MS Windows that is maintained to a consistent update level, than it is to deal with a mixture of clients. @@ -215,37 +215,37 @@ On a number of occasions, particular Microsoft service pack updates of a Windows server or client have necessitated special handling from the Samba server end. If you want to remain sane, keep you client workstation configurations consistent. -
Many SAN-based storage systems permit more than one server to share a common data store. Use of a shared SAN data store means that you do not need to use time- and resource-hungry data synchronization techniques. -
The use of a collection of relatively low-cost front-end Samba servers that are coupled to a shared backend SAN data store permits load distribution while containing costs below that of installing and managing a complex clustering facility. -
Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits data to be accessed from a single share and yet to actually be distributed across multiple actual servers. Refer to TOSHARG, Chapter 16, for information regarding implementation of an MSDFS installation. -
The combination of multiple back end servers together with a front-end server and use of MSDFS can achieve almost the same as you would obtain with a clustered Samba server. -
Consider using rsync to replicate data across the wide-area network during times of low utilization. Users can then access the replicated data store rather than needing to do so across the wide-area network. This works best for read-only data, but with careful planning can be implemented so that modified files get replicated back to the point of origin. Be careful with your implementation if you choose to permit modification and return replication of the modified file; otherwise, you may inadvertently overwrite important data. -
Networking hardware prices have fallen sharply over the past five years. A surprising number of Samba networking problems over this time have been traced to defective network interface cards (NICs) or defective hubs, switches, and cables. -
Not surprising is the fact that network administrators do not like to be shown to have made a bad decision. Money saved in buying low-cost hardware may result in high costs incurred in corrective action. -
Defective NICs, hubs, and switches may appear as intermittent network access problems, intermittent or persistent data corruption, slow network throughput, low performance, or even as blue-screen-of-death (BSOD) problems with MS Windows clients. In one case, a company updated several workstations with newer, faster @@ -253,14 +253,14 @@ an older PC that was unaffected so long as the new machines were kept shut down.
Defective hardware problems may take patience and persistence before the real cause can be discovered. -
Networking hardware defects can significantly impact perceived Samba performance, but defective RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server operations. One business came to this realization only after replacing a Samba installation with MS Windows Server 2000 running on the same hardware. The root of the problem completely eluded the network administrator until the entire server was replaced. While you may well think that this would never happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. -
This chapter has touched in broad sweeps on a number of simple steps that can be taken to ensure that your Samba network is resilient, scalable, and reliable, and that it performs well. @@ -268,7 +268,7 @@ Always keep in mind that someone is responsible to maintain and manage your design. In the long term, that may not be you. Spare a thought for your successor and give him or her an even break. -
Last, but not least, you should not only keep the network design simple, but it should be well documented. This book may serve as your pattern for documenting every aspect of your design, its implementation, and particularly the objects and assumptions diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/happy.html samba-3.0.14a/docs/htmldocs/Samba-Guide/happy.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/happy.html 2005-03-23 10:19:18.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/happy.html 2005-04-11 11:18:46.000000000 -0500 @@ -1,4 +1,4 @@ -
Chapter 6. Making Happy Users Table of Contents
+
Chapter 6. Making Happy Users Table of Contents
It has been said, “A day that is without troubles is not fulfilling. Rather, give me a day of troubles well handled so that I can be content with my achievements.”
@@ -66,13 +66,11 @@ MS Outlook PST files, as well as by not storing files on the desktop. These are old bad habits that require much discipline and vigilance on the part of network management. -
- - <listitem>
You should verify that the Windows XP WebClient service is not running. The use of the WebClient service has been implicated in many Windows networking related problems. -
</listitem>- Loss of access to network drives and printer resources
Loss of access to network resources during client operation may be caused by a number @@ -650,7 +648,7 @@ frequently review the steps ahead while making at least a mental note of what has already been completed. The following task list may help you to keep track of the task items that are covered: -
Samba-3 PDC Server Configuration
DHCP and DNS Servers
OpenLDAP Server
PAM and NSS Client Tools
Samba-3 PDC
Idealx SMB-LDAP Scripts
LDAP Initialization
Create User and Group Accounts
Printers
Share Point Directory Roots
Profile Directories
Samba-3 BDC Server Configuration
DHCP and DNS Servers
PAM and NSS Client Tools
Printers
Share Point Directory Roots
Profiles Directories
Samba-3 BDC Server Configuration
Windows XP Client Configuration
Default Profile Folder Redirection
MS Outlook PST File Relocation
Delete Roaming Profile on Logout
Upload Printer Drivers to Samba Servers
Install Software
Creation of Roll-out Images
Samba-3 PDC Server Configuration
DHCP and DNS Servers
OpenLDAP Server
PAM and NSS Client Tools
Samba-3 PDC
Idealx SMB-LDAP Scripts
LDAP Initialization
Create User and Group Accounts
Printers
Share Point Directory Roots
Profile Directories
Configuration of User Rights and Privileges
Samba-3 BDC Server Configuration
DHCP and DNS Servers
PAM and NSS Client Tools
Printers
Share Point Directory Roots
Profiles Directories
Windows XP Client Configuration
Default Profile Folder Redirection
MS Outlook PST File Relocation
Delete Roaming Profile on Logout
Upload Printer Drivers to Samba Servers
Install Software
Creation of Roll-out Images
The network design shown in ??? is not comprehensive. It is assumed that you will install additional file servers, and possibly additional BDCs.
@@ -668,7 +666,7 @@ in that chapter. If you are starting with newly installed Linux servers, you must complete the steps shown in ??? before commencing at ???: -
Confirm that the packages shown in ??? are installed on your system.
Table 6.2. Required OpenLDAP Linux Packages
SUSE Linux 8.x SUSE Linux 9.x Red Hat Linux nss_ldap nss_ldap nss_ldap pam_ldap pam_ldap pam_ldap openldap2 openldap2 openldap openldap2-client openldap2-client Samba-3 and OpenLDAP will have a degree of inter-dependence that is unavoidable. The method @@ -677,7 +675,7 @@
Install the file shown in ??? in the directory /etc/openldap. -
Remove all files from the directory /data/ldap, making certain that the directory exists with permissions:
@@ -691,7 +689,7 @@ has been started, it is possible to cause the new settings to take effect by shutting down the LDAP server, executing the db_recover command inside the /data/ldap directory, and then restarting the LDAP server. -Performance logging can be enabled and should preferrably be sent to a file on a file system that is large enough to handle significantly sized logs. To enable the logging at a verbose level to permit detailed analysis uncomment the entry in @@ -774,12 +772,12 @@ Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely that you may want to use them for UNIX system (Linux) local machine logons. This necessitates correct configuration of the Pluggable Authentication - Modules + Modules (PAM). The pam_ldap open source package provides the PAM modules that most people would use. On SUSE Linux systems, the pam_unix2.so module also has the ability to redirect authentication requests through LDAP. -
You have chosen to configure these services by directly editing the system files but, of course, you know that this configuration can be done using system tools provided by the Linux system vendor. SUSE Linux has a facility in YaST (the system admin tool) through ->-> that permits @@ -828,7 +826,7 @@ nss_base_group ou=Groups,dc=abmas,dc=biz?one ssl off -
Execute the following command to find where the nss_ldap module expects to find its control file:
@@ -840,7 +838,7 @@ ??? into the path that was obtained from the step above. On the servers called BLDG1 and BLDG2, install the file shown in ??? into the path that was obtained from the step above. -
Edit the NSS control file (/etc/nsswitch.conf) so that the lines that control user and group resolution will obtain information from the normal system files as well as from ldap as follows: @@ -854,7 +852,7 @@ added, you can validate resolution of the LDAP resolver process. The inclusion of WINS-based hostname resolution is deliberate so that all MS Windows client hostnames can be resolved to their IP addresses, whether or not they are DHCP clients. -
For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following files in the /etc/pam.d directory: login, password, samba, sshd. @@ -877,7 +875,7 @@ session required pam_unix2.so none use_ldap # debug or trace session required pam_limits.so
-
On other Linux systems that do not have an LDAP-enabled pam_unix2.so module, you must edit these files by adding the pam_ldap.so modules as shown here:
@@ -900,14 +898,14 @@ demonstrates the use of the pam_ldap.so module. You can use either implementation, but if the pam_unix2.so on your system supports LDAP, you probably want to use it, rather than add an additional module. -
Verify that the Samba-3.0.12 (or later) packages are installed on each SUSE Linux server before following the steps below. If Samba-3.0.12 (or later) is not installed, you have the choice to either build your own or to obtain the packages from a dependable source. Packages for SUSE Linux 8.x, 9.x and SUSE Linux Enterprise Server 9, as well as for Red Hat Fedora Core and Red Hat Enteprise Linux Server 3 and 4 are included on the CD-ROM that is included at the back of this book. -
Procedure 6.4. Configuration of PDC Called: MASSIVE
+
Procedure 6.4. Configuration of PDC Called: MASSIVE
Install the files in ???, ???, ???, and ??? into the /etc/samba/ @@ -916,7 +914,7 @@ smb.conf.master, and then to perform all file edits on the master file. The operational smb.conf is then generated as shown in the next step. -
Create and verify the contents of the smb.conf file that is generated by:
root# testparm -s smb.conf.master > smb.conf @@ -952,7 +950,7 @@ root# rm /var/lib/samba/*dat root# rm /var/log/samba/*
-
Samba-3 communicates with the LDAP server. The password that it uses to authenticate to the LDAP server must be stored in the secrets.tdb file. Execute the following to create the new secrets.tdb files @@ -964,7 +962,7 @@
Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb
-
Samba-3 generates a Windows Security Identifier only when smbd has been started. For this reason, you start Samba. After a few seconds delay, execute: @@ -997,10 +995,10 @@
When a positive Domain SID has been reported, stop Samba.
- - - - + + + + Configure the NFS server for your Linux system. So you can complete the steps that follow, enter into the /etc/exports the following entry:
@@ -1018,93 +1016,93 @@
Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with configuration of the LDAP server. -
Example 6.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A
# Global parameters [global] + Example 6.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A
# Global parameters [global] - unix charset = LOCALE + unix charset = LOCALE - workgroup = MEGANET2 + workgroup = MEGANET2 - netbios name = MASSIVE + netbios name = MASSIVE - interfaces = eth1, lo + interfaces = eth1, lo - bind interfaces only = Yes + bind interfaces only = Yes - passdb backend = ldapsam:ldap://massive.abmas.biz + passdb backend = ldapsam:ldap://massive.abmas.biz - enable privileges = Yes + enable privileges = Yes - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 1 + log level = 1 - syslog = 0 + syslog = 0 - log file = /var/log/samba/%m + log file = /var/log/samba/%m - max log size = 50 + max log size = 50 - smb ports = 139 445 + smb ports = 139 445 - name resolve order = wins bcast hosts + name resolve order = wins bcast hosts - time server = Yes + time server = Yes - printcap name = CUPS + printcap name = CUPS - show add printer wizard = No + show add printer wizard = No - add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" + add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" - delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u" + delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u" - add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" + add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" - delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g" + delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g" - add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m "%u" "%g" + add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m "%u" "%g" - delete user from group script = /opt/IDEALX/sbin/ smbldap-groupmod -x "%u" "%g" + delete user from group script = /opt/IDEALX/sbin/ smbldap-groupmod -x "%u" "%g" - set primary group script = /opt/IDEALX/sbin/ smbldap-usermod -g "%g" "%u" + set primary group script = /opt/IDEALX/sbin/ smbldap-usermod -g "%g" "%u" - add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u" Example 6.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B
+ add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u" Example 6.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B
- logon script = scripts\logon.bat + logon script = scripts\logon.bat - logon path = \\%L\profiles\%U + logon path = \\%L\profiles\%U - logon drive = X: + logon drive = X: - domain logons = Yes + domain logons = Yes - preferred master = Yes + preferred master = Yes - wins support = Yes + wins support = Yes - ldap suffix = dc=abmas,dc=biz + ldap suffix = dc=abmas,dc=biz - ldap machine suffix = ou=People + ldap machine suffix = ou=People - ldap user suffix = ou=People + ldap user suffix = ou=People - ldap group suffix = ou=Groups + ldap group suffix = ou=Groups - ldap idmap suffix = ou=Idmap + ldap idmap suffix = ou=Idmap - ldap admin dn = cn=Manager,dc=abmas,dc=biz + ldap admin dn = cn=Manager,dc=abmas,dc=biz - idmap backend = ldap:ldap://massive.abmas.biz + idmap backend = ldap:ldap://massive.abmas.biz - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 + idmap gid = 10000-20000 - map acl inherit = Yes + map acl inherit = Yes - printing = cups + printing = cups - printer admin = root, chrisr
The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts on the LDAP server. You have chosen the Idealx scripts since they are the best known LDAP configuration scripts. The use of these scripts will help avoid the necessity @@ -1121,7 +1119,7 @@ The smbldap-tools are located in /opt/IDEALX/sbin. The scripts are not needed on BDC machines because all LDAP updates are handled by the PDC alone. -
+
To perform a manual installation of the smbldap-tools scripts the following procedure may be used:
Create the /opt/IDEALX/sbin directory, and set its permissions @@ -1173,7 +1171,7 @@
The smbldap-tools scripts are now ready for the configuration step outlined in Configuration of smbldap-tools. -
In the event that you have elected to use the RPM package provided by Idealx, download the source RPM smbldap-tools-0.8.7-3.src.rpm, then follow the following procedure:
@@ -1340,7 +1338,7 @@ then verify its contents.
The smbldap-tools are now ready for use. -
The LDAP database must be populated with well-known Windows Domain user accounts and Domain Group accounts before Samba can be used. The following procedures step you through the process.
@@ -1352,7 +1350,7 @@ does not need to ask LDAP.
Addition of an account to the LDAP backend can be done in a number of ways: -
If you always have a user account in the /etc/passwd on every server or in a NIS(+) backend, it is not necessary to add Posix accounts for them in LDAP. In this case, you can add Windows Domain user accounts using the @@ -1364,24 +1362,31 @@ In the example system you are installing in this exercise, you are making use of the Idealx smbldap-tools scripts. A copy of these tools, pre-configured for this system, is included on the enclosed CD-ROM under Chap06/Tools. -
If you wish to have more control over how the LDAP database is initialized or want not to use the Idealx smbldap-tools, you should refer to ???. -
The following steps initialize the LDAP database, and then you can add user and group accounts that Samba can use. You use the smbldap-populate to seed the LDAP database. You then manually add the accounts shown in ???. The list of users does not cover all 500 network users; it provides examples only. -
Note
Note
In the following examples, as the LDAP database is initialized, we do create a container for Computer (machine) accounts. In the Samba-3 smb.conf files, specific use is made of the People container, not the Computers container, for domain member accounts. This is not a - mistake; it is a deliberate action that is necessitated by the fact that there is a bug in Samba-3 - that prevents it from being able to search the LDAP database for computer accounts if they are - placed in the Computers container. By placing all machine accounts in the People container, we - are able to side-step this bug. It is expected that at some time in the future this problem will - be resolved. At that time, it will be possible to use the Computers container in order to keep - machine accounts separate from user accounts. + mistake; it is a deliberate action that is necessitated by the fact that the resolution of + a machine (computer) account to a UID is done via NSS. The only way this can be handled is + using the NSS (/etc/nsswitch.conf) entry for passwd + which is resolved using the nss_ldap library. The configuration file for + the nss_ldap library is the file /etc/ldap.conf that + provides only one possible LDAP search command that is specified by the entry called + nss_base_passwd. This means that the search path must take into account + the directory structure so that the LDAP search will commence at a level that is above + both the Computers container and the Users (or People) container. If this is done, it is + necessary to use a search that will descend the directory tree so that the machine account + can be found. Alternately, by placing all machine accounts in the People container, we + are able to side-step this limitation. This is the simpler solution that has been adopted + in this chapter.
Table 6.3. Abmas Network Users and Groups
Account Name Type ID Password Robert Jordan User bobj n3v3r2l8 Stanley Soroka User stans impl13dst4r Christine Roberson User chrisr S9n0nw4ll Mary Vortexis User maryv kw13t0n3 Accounts Group Accounts Finances Group Finances Insurance Group PIOps Start the LDAP server by executing:
@@ -1441,7 +1446,7 @@ Shutting down ldap-server done Starting ldap-server done
-
So that we can use a global IDMAP repository the LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -1450,7 +1455,7 @@ dn: ou=Idmap,dc=abmas,dc=biz ou: idmap
- + If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see ???). You can add the required entries using the following command: @@ -1459,7 +1464,7 @@ -w not24get < /etc/openldap/idmap.LDIF
Samba automatically populates this LDAP directory container when it needs to. -
It looks like all has gone well, as expected. Let's confirm that this is the case by running a few tests. First we check the contents of the database directly by running slapcat as follows (the output has been cut down): @@ -1496,7 +1501,7 @@ modifyTimestamp: 20031217234206Z
This looks good so far. -
The next step is to prove that the LDAP server is running and responds to a search request. Execute the following as shown (output has been cut to save space):
@@ -1540,7 +1545,7 @@ # numEntries: 19
Good. It is all working just fine. -
You must now make certain that the NSS resolver can interrogate LDAP also. Execute the following commands:
@@ -1552,10 +1557,10 @@ Domain Users:x:513: Domain Guests:x:514: Domain Computers:x:553: -
This demonstrates that the nss_ldap library is functioning as it should. -
Our database is now ready for the addition of network users. For each user for whom an account must be created, execute the following:
@@ -1570,7 +1575,7 @@ Retype new SMB password: XXXXXXXX
Where username is the login ID for each user. -
Now verify that the UNIX (Posix) accounts can be resolved via NSS by executing the following:
@@ -1594,7 +1599,7 @@
This confirms that the UNIX (Posix) user account information can be resolved from LDAP by system tools that make a getentpw() system call. -
The 'root' account must have UID=0, if not this means that operations conducted from a Windows client using tools such as the Domain User Manager fails under UNIX because the management of user and group accounts requires that the UID=0. Additionally, it is @@ -1627,7 +1632,7 @@ drwx------ 7 stans Domain Users 568 Dec 17 01:43 stans/
This is precisely what we want to see. -
The final validation step involves making certain that Samba-3 can obtain the user accounts from the LDAP ldapsam passwd backend. Execute the following command as shown:
@@ -1657,7 +1662,7 @@ Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
This looks good. Of course, you fully expected that it would all work, didn't you? -
Now you add the group accounts that are used on the Abmas network. Execute the following exactly as shown:
@@ -1667,7 +1672,7 @@
The addition of groups does not involve keyboard interaction, so the lack of console output is of no concern. -
You really do want to confirm that UNIX group resolution from LDAP is functioning as it should. Let's do this as shown here:
@@ -1683,7 +1688,7 @@
The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well as our own site-specific group accounts, are correctly listed. This is looking good. -
The final step we need to validate is that Samba can see all the Windows Domain Groups and that they are correctly mapped to the respective UNIX group account. To do this, just execute the following command: @@ -1737,7 +1742,7 @@
root# rcwinbind restart
-
You may now check Samba-3 operation as follows:
root# smbclient -L massive -U% @@ -1782,7 +1787,7 @@ Well done. All is working fine.
The server MASSIVE is now configured, and it is time to move onto the next task. -
The configuration for Samba-3 to enable CUPS raw-print-through printing has already been taken care of in the smb.conf file. The only preparation needed for smart @@ -1800,17 +1805,17 @@ Follow the instructions in the printer manufacturers' manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - - -
+ Only on the server to which the printer is attached, configure the CUPS Print Queues as follows:
root# lpadmin -p printque -v socket://printer-name.abmas.biz:9100 -E
- + This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, i.e., printing without use of filters. The name printque is the name you have assigned for @@ -1830,15 +1835,15 @@ root# /usr/bin/accept printque
- - - + + + Edit the file /etc/cups/mime.convs to uncomment the line:
application/octet-stream application/vnd.cups-raw 0 -
- + Edit the file /etc/cups/mime.types to uncomment the line:
application/octet-stream @@ -1857,7 +1862,7 @@ root# chown -R root.root /var/lib/samba/drivers root# chmod -R ug=rwx,o=rx /var/lib/samba/drivers
-
Procedure 6.10. Configuration of BDC Called: BLDG1
Install the files in ???, ???, and ??? into the /etc/samba/ directory. The three files @@ -1900,7 +1905,7 @@ bldg1$:x:1006:553:bldg1$:/dev/null:/bin/false
This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. -
The next step in the verification process involves testing the operation of UNIX group resolution via the NSS LDAP resolver. Execute these commands:
@@ -1930,7 +1935,7 @@ This is also the correct and desired output, because it demonstrates that the LDAP client is able to communicate correctly with the LDAP server (MASSIVE). -
You must now set the LDAP administrative password into the Samba-3 secrets.tdb file by executing this command: @@ -1963,7 +1968,7 @@
This indicates that the Domain security account for the BDC has been correctly created.
- + Verify that user and group account resolution works via Samba-3 tools as follows:
root# pdbedit -L @@ -2045,223 +2050,223 @@ should be added together to form the smb.conf file.
Follow carefully the steps shown in ???, starting at step 2. -
Example 6.8. LDAP Based smb.conf File, Server: BLDG1
# Global parameters [global] + Example 6.8. LDAP Based smb.conf File, Server: BLDG1
# Global parameters [global] - unix charset = LOCALE + unix charset = LOCALE - workgroup = MEGANET2 + workgroup = MEGANET2 - netbios name = BLDG1 + netbios name = BLDG1 - passdb backend = ldapsam:ldap://massive.abmas.biz + passdb backend = ldapsam:ldap://massive.abmas.biz - enable privileges = Yes + enable privileges = Yes - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 1 + log level = 1 - syslog = 0 + syslog = 0 - log file = /var/log/samba/%m + log file = /var/log/samba/%m - max log size = 50 + max log size = 50 - smb ports = 139 445 + smb ports = 139 445 - name resolve order = wins bcast hosts + name resolve order = wins bcast hosts - printcap name = CUPS + printcap name = CUPS - show add printer wizard = No + show add printer wizard = No - logon script = scripts\logon.bat + logon script = scripts\logon.bat - logon path = \\%L\profiles\%U + logon path = \\%L\profiles\%U - logon drive = X: + logon drive = X: - domain logons = Yes + domain logons = Yes - domain master = No + domain master = No - wins server = 172.16.0.1 + wins server = 172.16.0.1 - ldap suffix = dc=abmas,dc=biz + ldap suffix = dc=abmas,dc=biz - ldap machine suffix = ou=People + ldap machine suffix = ou=People - ldap user suffix = ou=People + ldap user suffix = ou=People - ldap group suffix = ou=Groups + ldap group suffix = ou=Groups - ldap idmap suffix = ou=Idmap + ldap idmap suffix = ou=Idmap - ldap admin dn = cn=Manager,dc=abmas,dc=biz + ldap admin dn = cn=Manager,dc=abmas,dc=biz - idmap backend = ldap:ldap://massive.abmas.biz + idmap backend = ldap:ldap://massive.abmas.biz - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 + idmap gid = 10000-20000 - printing = cups + printing = cups - printer admin = root, chrisr Example 6.9. LDAP Based smb.conf File, Server: BLDG2
# Global parameters [global] + printer admin = root, chrisr Example 6.9. LDAP Based smb.conf File, Server: BLDG2
# Global parameters [global] - unix charset = LOCALE + unix charset = LOCALE - workgroup = MEGANET2 + workgroup = MEGANET2 - netbios name = BLDG2 + netbios name = BLDG2 - passdb backend = ldapsam:ldap://massive.abmas.biz + passdb backend = ldapsam:ldap://massive.abmas.biz - enable privileges = Yes + enable privileges = Yes - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 1 + log level = 1 - syslog = 0 + syslog = 0 - log file = /var/log/samba/%m + log file = /var/log/samba/%m - max log size = 50 + max log size = 50 - smb ports = 139 445 + smb ports = 139 445 - name resolve order = wins bcast hosts + name resolve order = wins bcast hosts - printcap name = CUPS + printcap name = CUPS - show add printer wizard = No + show add printer wizard = No - logon script = scripts\logon.bat + logon script = scripts\logon.bat - logon path = \\%L\profiles\%U + logon path = \\%L\profiles\%U - logon drive = X: + logon drive = X: - domain logons = Yes + domain logons = Yes - domain master = No + domain master = No - wins server = 172.16.0.1 + wins server = 172.16.0.1 - ldap suffix = dc=abmas,dc=biz + ldap suffix = dc=abmas,dc=biz - ldap machine suffix = ou=People + ldap machine suffix = ou=People - ldap user suffix = ou=People + ldap user suffix = ou=People - ldap group suffix = ou=Groups + ldap group suffix = ou=Groups - ldap idmap suffix = ou=Idmap + ldap idmap suffix = ou=Idmap - ldap admin dn = cn=Manager,dc=abmas,dc=biz + ldap admin dn = cn=Manager,dc=abmas,dc=biz - idmap backend = ldap:ldap://massive.abmas.biz + idmap backend = ldap:ldap://massive.abmas.biz - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 + idmap gid = 10000-20000 - printing = cups + printing = cups - printer admin = root, chrisr Example 6.10. LDAP Based smb.conf File, Shares Section Part A
[accounts] + printer admin = root, chrisr Example 6.10. LDAP Based smb.conf File, Shares Section Part A
[accounts] - comment = Accounting Files + comment = Accounting Files - path = /data/accounts + path = /data/accounts - read only = No [service] + read only = No [service] - comment = Financial Services Files + comment = Financial Services Files - path = /data/service + path = /data/service - read only = No [pidata] + read only = No [pidata] - comment = Property Insurance Files + comment = Property Insurance Files - path = /data/pidata + path = /data/pidata - read only = No [homes] + read only = No [homes] - comment = Home Directories + comment = Home Directories - valid users = %S + valid users = %S - read only = No + read only = No - browseable = No [printers] + browseable = No [printers] - comment = SMB Print Spool + comment = SMB Print Spool - path = /var/spool/samba + path = /var/spool/samba - guest ok = Yes + guest ok = Yes - printable = Yes + printable = Yes - browseable = No Example 6.11. LDAP Based smb.conf File, Shares Section Part B
[apps] - comment = Application Files + comment = Application Files - path = /apps + path = /apps - admin users = bjordan + admin users = bjordan - read only = No [netlogon] + read only = No [netlogon] - comment = Network Logon Service + comment = Network Logon Service - path = /var/lib/samba/netlogon + path = /var/lib/samba/netlogon - guest ok = Yes + guest ok = Yes - locking = No [profiles] + locking = No [profiles] - comment = Profile Share + comment = Profile Share - path = /var/lib/samba/profiles + path = /var/lib/samba/profiles - read only = No + read only = No - profile acls = Yes [profdata] + profile acls = Yes [profdata] - comment = Profile Data Share + comment = Profile Data Share - path = /var/lib/samba/profdata + path = /var/lib/samba/profdata - read only = No + read only = No - profile acls = Yes [print$] + profile acls = Yes [print$] - comment = Printer Drivers + comment = Printer Drivers - path = /var/lib/samba/drivers + path = /var/lib/samba/drivers - browseable = yes + browseable = yes - guest ok = no + guest ok = no - read only = yes + read only = yes write list = root, chrisr Example 6.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
dn: ou=Idmap,dc=abmas,dc=biz objectClass: organizationalUnit ou: idmap structuralObjectClass: organizationalUnit -
My father would say, “Dinner is not over until the dishes have been done.” The makings of a great network environment take a lot of effort and attention to detail. So far you have completed most of the complex (and to many administrators, the interesting part of server configuration) steps, but remember to tie it all together. Here are a few more steps that must be completed so that your network runs like a well-rehearsed orchestra. -
+
In your smb.conf file, you have specified Windows shares. Each has a path parameter. Even though it is obvious to all, one of the common Samba networking problems is @@ -2280,7 +2285,7 @@ root# chmod -R ug+rwxs,o-rwx /data root# chmod -R ug+rwx,o+rx-w /apps
-
You made a conscious decision to do everything it would take to improve network client performance. One of your decisions was to implement folder redirection. This means that Windows user desktop profiles are now made up of two components a dynamically loaded part and a set of file @@ -2304,7 +2309,7 @@ root# chown -R username.Domain\ Users username root# chmod -R 750 username
-
You have three options insofar as the dynamically loaded portion of the roaming profile is concerned:
You may permit the user to obtain a default profile.
You can create a mandatory profile.
You can create a group profile (which is almost always a mandatory profile).
@@ -2313,7 +2318,7 @@ NTUSER.DAT to NTUSER.MAN, i.e., just by changing the filename extension. -
The location of the profile that a user can obtain is set in the users' account in the LDAP passdb backend. You can manage this using the Idealx smbldap-tools or using the Windows NT4 Domain User Manager. @@ -2326,7 +2331,7 @@ /var/lib/samba/profiles/username root# chmod 700 /var/lib/samba/profiles/username
-
The use of a logon script with Windows XP Professional is an option that every site should consider. Unless you have locked down the desktop so the user cannot change anything, there is risk that a vital network drive setting may be broken or that printer connections may be lost. Logon scripts @@ -2354,7 +2359,7 @@ You should research the options for logon script implementation by referring to TOSHARG, Chapter 21, Section 21.4. A quick Web search will bring up a host of options. One of the most popular logon facilities in use today is called KiXtart. -
The ability to perform tasks such as joining Windows clients to the domain can be assigned to normal user accounts. By default, only the domain administrator account (root on UNIX systems because it has UID=0) can add accounts. New to Samba 3.0.11 is the ability to grant @@ -2424,7 +2429,7 @@ SeRemoteShutdownPrivilege SeDiskOperatorPrivilege
-
In the next few sections, you can configure a new Windows XP Professional disk image on a staging machine. You will configure all software, printer settings, profile and policy handling, and desktop default profile settings on this system. When it is complete, you copy the contents of the @@ -2436,23 +2441,23 @@ How to Create a Base Profile for All Users. -
Log onto the Windows XP Professional workstation as the local Administrator. It is necessary to expose folders that are generally hidden to provide access to the Default User folder. -
Procedure 6.13. Expose Hidden Folders
+
-
Procedure 6.14. Redirect Folders in Default System User Profile
Procedure 6.14. Redirect Folders in Default System User Profile
Give focus to HKEY_LOCAL_MACHINE hive entry in the left panel. Click ->->->->->. In the dialog box that opens, enter the key name Default @@ -2465,27 +2470,27 @@
The contents of the right panel reveals the contents as shown in ???. -
You edit hive keys. Acceptable values to replace the %USERPROFILE% variable includes:
A drive letter such as: U:
A direct network path such as: - \\MASSIVE\profdata
A network redirection (UNC name) that contains a macro such as:
\\%LOGONSERVER%\profdata\
-
A network redirection (UNC name) that contains a macro such as:
%LOGONSERVER%\profdata\
+
Set the registry keys as shown in ???. Your implementation makes the assumption that users have statically located machines. Notebook computers (mobile users) need to be accommodated using local profiles. This is not an uncommon assumption.
Click back to the root of the loaded hive Default. Click ->->. -
Now follow the procedure given in ???. Make sure that each folder you have redirected is in the exclusion list.
- You are now ready to copy[11] + You are now ready to copy[11] the Default User profile to the Samba Domain Controllers. Launch Microsoft Windows Explorer, and use it to copy the full contents of the directory Default User @@ -2493,13 +2498,13 @@ NETLOGON share. If the NETLOGON share has the defined UNIX path of /var/lib/samba/netlogon, when the copy is complete there must be a directory in there called Default User. -
Procedure 6.15. Reset Folder Display to Original Behavior
To launch the Windows Explorer, click ->->->->. Deselect Show hidden files and folders, and click . Exit Windows Explorer. -
Table 6.4. Default Profile Redirections
Registry Key Redirected Value Cache %LOGONSERVER%\profdata\%USERNAME%\InternetFiles Cookies %LOGONSERVER%\profdata\%USERNAME%\Cookies History %LOGONSERVER%\profdata\%USERNAME%\History Local AppData %LOGONSERVER%\profdata\%USERNAME%\AppData Local Settings %LOGONSERVER%\profdata\%USERNAME%\LocalSettings My Pictures %LOGONSERVER%\profdata\%USERNAME%\MyPictures Personal %LOGONSERVER%\profdata\%USERNAME%\MyDocuments Recent %LOGONSERVER%\profdata\%USERNAME%\Recent
Table 6.4. Default Profile Redirections
Registry Key Redirected Value Cache %LOGONSERVER%\profdata\%USERNAME%\InternetFiles Cookies %LOGONSERVER%\profdata\%USERNAME%\Cookies History %LOGONSERVER%\profdata\%USERNAME%\History Local AppData %LOGONSERVER%\profdata\%USERNAME%\AppData Local Settings %LOGONSERVER%\profdata\%USERNAME%\LocalSettings My Pictures %LOGONSERVER%\profdata\%USERNAME%\MyPictures Personal %LOGONSERVER%\profdata\%USERNAME%\MyDocuments Recent %LOGONSERVER%\profdata\%USERNAME%\Recent Microsoft Outlook can store a Personal Storage file, generally known as a PST file. It is the nature of email storage that this file grows, at times quite rapidly. So that users' email is available to them at every workstation they may log onto, @@ -2512,9 +2517,9 @@ ->->->->.
Follow the on-screen prompts to relocate the PST file to the desired location. -
To configure the Windows XP Professional client to auto-delete roaming profiles on logout: -
Click ->. In the dialog box, enter: MMC and click . @@ -2522,7 +2527,7 @@ Follow these steps to set the default behavior of the staging machine so that all roaming profiles are deleted as network users log out of the system. Click ->->->->->->->. -
The Microsoft Management Console now shows the utility that enables you to set the policies needed. In the left panel, click ->->->. In the right panel, set the properties shown here by double-clicking on each @@ -2530,7 +2535,7 @@
Do not check for user ownership of Roaming Profile Folders = Enabled
Delete cached copies of roaming profiles = Enabled
Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies made of this system to deploy the new standard desktop system. -
Users want to be able to use network printers. You have a vested interest in making it easy for them to print. You have chosen to install the printer drivers onto the Samba servers and to enable point-and-click (drag-and-drop) printing. This process results in @@ -2561,7 +2566,7 @@ MASSIVE is displayed. Click the tab. Note that the box labelled is empty. Click the button that is next to the box. This launches the quote“Add Printer Wizard”. -
The “Add Printer Driver Wizard on MASSIVE” panel is now presented. Click to continue. From the left panel, select the Printer Manufacturer. In your case, you are adding a driver for a printer manufactured by @@ -2570,12 +2575,12 @@ progress bar appears and instructs you as each file is being uploaded and that it is being directed at the network server \\massive\ps01-color.
- - - - - - + + + + + + The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, you are returned to the tab in the panel. You can set the Location (under the tab), and Security settings (under @@ -2584,7 +2589,7 @@ directory”. When this box is checked the printer will be published in Active Directory (Applicable to Active Directory use only.)
- + Click . It will take a minute or so to upload the settings to the server. You are now returned to the monitor. Right-click on the printer, click ->. Now change the settings to suit @@ -2596,7 +2601,7 @@ just to initialize the Samba printers database entry for this printer. If you need to revert a setting, Click again.
- + Verify that all printer settings are at the desired configuration. When you are satisfied that they are, click the tab. Now click the button. A test page should print. Verify that it has printed correctly. Then click @@ -2606,7 +2611,7 @@ You must repeat this process for all network printers (i.e., for every printer, on each server). When you have finished uploading drivers to all printers, close all applications. The next task is to install software your users require to do their work. -
Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. Notebooks require special handling that is beyond the scope of this chapter. @@ -2621,7 +2626,7 @@ When you believe that the overall configuration is complete, be sure to create a shared group profile and migrate that to the Samba server for later re-use when creating custom mandatory profiles, just in case a user may have specific needs you had not anticipated. -
The final steps before preparing the distribution Norton Ghost image file you might follow are:
Un-join the domain Each workstation requires a unique name and must be independently @@ -2630,7 +2635,7 @@ Defragment the hard disk While not obvious to the uninitiated, defragmentation results in better performance and often significantly reduces the size of the compressed disk image. That also means it will take less time to deploy the image onto 500 workstations. -
This chapter has introduced many new concepts. Is it a sad fact that the example presented deliberately avoided any consideration of security. Security does not just happen; you must design it into your total network. Security begins with a systems design and implementation that anticipates hostile behavior from @@ -2638,7 +2643,7 @@ they accept them as challenges. For that reason, if not simply from a desire to establish safe networking practices, you must not deploy the design presented in this book in an environment where there is risk of compromise. -
As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs) and it must be configured to use secure protocols for all communications over the network. Of course, secure networking does not result just from systems design and implementation but involves constant user education @@ -2664,37 +2669,37 @@ Control over roaming profiles, with particular focus on folder redirection to network drives.
Use of the CUPS printing system together with Samba-based printer driver auto-download. -
Well, here we are at the end of this chapter and we have only ten questions to help you to remember so much. There are bound to be some sticky issues here. -
-
+
- Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? -
- +
- You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? -
- +
- You did not use SWAT to configure Samba. Is there something wrong with it? -
- +
- You have exposed a well-used password not24get. Is that not irresponsible? -
- +
- The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing? -
- +
- Can I use LDAP just for Samba accounts and not for UNIX system accounts? -
- +
- Why are the Windows Domain RID portions not the same as the UNIX UID? -
- +
- Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work? -
- +
- Is folder redirection dangerous? I've heard that you can lose your data that way. -
- +
- Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile? -
+
Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions?
@@ -2713,7 +2718,7 @@ This book makes little mention of backup techniques. Does that mean that I am recommending that you should implement a network without provision for data recovery and for disaster management? Back to our focus: The deployment of Samba has been clearly demonstrated. -
+
You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? @@ -2740,7 +2745,7 @@ of open source software. I favor neither and respect both. I like particular features of both products (companies also). No bias in presentation is intended. Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. -
+
You did not use SWAT to configure Samba. Is there something wrong with it?
That is a good question. As it is, the smb.conf file configurations are presented @@ -2751,14 +2756,14 @@ There are people in the Linux and open source community who feel that SWAT is dangerous and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I hope to have brought their interests on board. SWAT is well covered is TOSHARG. -
+
You have exposed a well-used password not24get. Is that not irresponsible?
Well, I had to use a password of some sort. At least this one has been consistently used throughout. I guess you can figure out that in a real deployment it would make sense to use a more secure and original password. -
+
The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing?
@@ -2766,7 +2771,7 @@ Let's give Idealx some credit for the contribution they have made. I appreciate their work and, besides, it does no harm to create accounts that are not now used as at some time Samba may well use them. -
+
Can I use LDAP just for Samba accounts and not for UNIX system accounts?
Yes, you can do that for user accounts only. Samba requires there to be a Posix (UNIX) @@ -2774,7 +2779,7 @@ the system password account, how do you plan to keep all domain controller system password files in sync? I think that having everything in LDAP makes a lot of sense for the UNIX admin who is still learning the craft and is migrating from MS Windows. -
+
Why are the Windows Domain RID portions not the same as the UNIX UID?
Samba uses a well-known public algorithm for assigning RIDs from UIDs and GIDs. @@ -2783,7 +2788,7 @@ assignment used the calculation: RID = UID x 2 + 1000. Of course, Samba does permit you to override that to some extent. See the smb.conf man page entry for algorithmic rid base. -
+
Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work?
@@ -2793,7 +2798,7 @@ Inkjet printer. Use the appropriate device URI (Universal Resource Interface) argument to the lpadmin -v option that is right for your printer. -
+
Is folder redirection dangerous? I've heard that you can lose your data that way.
The only loss of data I know of that involved folder redirection was caused by @@ -2803,13 +2808,13 @@ he declined to move the data because he thought it was still in the local profile folder. That was not the case, so by declining to move the data back, he wiped out the data. You cannot hold the tool responsible for that. Caveat emptor still applies. -
+
Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile?
Yes. If you do not do this, the data will still be copied from the network folder (share) to the local cached copy of the profile. -
[11] There is an alternate method by which a Default User profile can be added to the NETLOGON share. This facility in the Windows System tool permits profiles to be exported. The export target may be a particular user or diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/index.html samba-3.0.14a/docs/htmldocs/Samba-Guide/index.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/index.html 2005-03-23 10:19:49.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/index.html 2005-04-11 11:19:12.000000000 -0500 @@ -1,4 +1,4 @@ -
Samba-3 by Example Table of Contents
- About the Cover Artwork
- Acknowledgments
- Foreword
- Preface
- 1. Networking Primer
- 2. No Frills Samba Servers
- 3. Small Office Networking
- 4. Secure Office Networking
- 5. The 500-User Office
- 6. Making Happy Users
- 7. A Distributed 2000 User Network
- 8. Migrating NT4 Domain to Samba-3
- 9. Migrating NetWare 4.11 Server to Samba-3
- 10. Adding UNIX/LINUX Servers and Clients
- 11. Active Directory, Kerberos, and Security
- 12. Integrating Additional Services
- 13. Performance, Reliability, and Availability
- A. Appendix: A Collection of Useful Tid-bits
- B. GNU General Public License
- Preamble
- TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- Section 0
- Section 1
- Section 2
- Section 3
+
Samba-3 by Example Table of Contents
- About the Cover Artwork
- Acknowledgments
- Foreword
- Preface
- 1. Networking Primer
- 2. No Frills Samba Servers
- 3. Small Office Networking
- 4. Secure Office Networking
- 5. The 500-User Office
- 6. Making Happy Users
- 7. A Distributed 2000 User Network
- 8. Migrating NT4 Domain to Samba-3
- 9. Migrating NetWare 4.11 Server to Samba-3
- 10. Adding Domain Member Servers and Clients
- 11. Active Directory, Kerberos, and Security
- 12. Integrating Additional Services
- 13. Performance, Reliability, and Availability
- A. Appendix: A Collection of Useful Tid-bits
- B. GNU General Public License
- Preamble
- TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
- Section 0
- Section 1
- Section 2
- Section 3
- Section 4
- Section 5
- Section 6
diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/ix01.html samba-3.0.14a/docs/htmldocs/Samba-Guide/ix01.html
--- samba-3.0.13/docs/htmldocs/Samba-Guide/ix01.html 2005-03-23 10:19:49.000000000 -0600
+++ samba-3.0.14a/docs/htmldocs/Samba-Guide/ix01.html 2005-04-11 11:19:12.000000000 -0500
@@ -1,5 +1,5 @@
-
Index +Symbols
- %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
- %USERNAME%, Roaming Profile Background, Profile Changes
- %USERPROFILE%, Configuration of Default Profile with Folder Redirection
- /data/ldap, OpenLDAP Server Configuration
- /etc/cups/mime.convs, Implementation, Implementation
- /etc/cups/mime.types, Implementation, Implementation
- /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
- /etc/exports, Samba-3 PDC Configuration
- /etc/group, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, Removal of Pre-existing Conflicting RPMs
- /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
- /etc/krb5.conf, Kerberos Configuration
- /etc/ldap.conf, PAM and NSS Client Configuration, LDAP Server Configuration
- /etc/mime.convs, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- /etc/mime.types, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- /etc/named.conf, Configuration of DHCP and DNS Servers
- /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
- /etc/openldap/slapd.conf, OpenLDAP Server Configuration, Implementation
- /etc/passwd, Findings and Comments, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Questions and Answers, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
- /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
- /etc/rc.d/rc.local, Implementation
- /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation All Servers
- /etc/samba, Samba System File Location
- /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
- /etc/samba/smbusers, Server Preparation All Servers
- /etc/shadow, Technical Issues
- /etc/squid/squid.conf, Removal of Pre-existing Conflicting RPMs
- /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
- /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
- /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
- /usr/bin, Samba System File Location
- /usr/lib/samba, Samba System File Location
- /usr/local, Samba System File Location
- /usr/local/samba, Samba System File Location
- /usr/sbin, Samba System File Location
- /usr/share, Samba System File Location
- /usr/share/samba/swat, Samba System File Location
- /usr/share/swat, Samba System File Location
- /var/lib/samba, Samba System File Location
- /var/log/samba, Samba System File Location
- , Application Share Configuration, Addition of Machines to the Domain
- Domain account, Technical Issues
- liability, Dissection and Discussion
- logon, Implementation
- problem, Dissection and Discussion
- transparent inter-operability, Questions and Answers
A
- abmas-netfw.sh, Basic System Configuration
- abort shutdown script, Samba Configuration, Implementation, Implementation
- accept, Printer Configuration
- accepts liability, Dissection and Discussion
- access, Technical Issues, Check-point Controls
- access control, Kerberos Exposed, Using the MMC Computer Management Interface
- Access Control Lists (see ACLs)
- access control settings, Share Access Controls
- access controls, Technical Issues, Share Definition Controls
- accessible, Share Point Directory and File Permissions
- account, Regarding LDAP Directories and Windows Computer Accounts, Share Access Controls
- ADS Domain, Technical Issues
- account credentials, Findings and Comments
- account information, Questions and Answers
- account names, Questions and Answers
- account policies, The LDAP Account Manager
- accountable, Introduction, Dissection and Discussion
- accounts
- authoritative, Technical Issues
- Domain, Introduction, Questions and Answers
- group, Introduction, Questions and Answers, Introduction
- machine, Introduction, Questions and Answers
- manage, The LDAP Account Manager
- user, Introduction, Questions and Answers, Introduction
- ACL, Questions and Answers, Check-point Controls
- ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
- acquisitions, Introduction
- Act!, Shared Data Integrity
- ACT! database, Act! Database Sharing
- Act!Diag, Act! Database Sharing
- Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
- authentication, Squid Configuration
- domain, Samba Configuration
- join, Active Directory Domain with Samba Domain Member Server
- management tools, Technical Issues
- realm, Bad Hostnames
- Replacement, Technical Issues
- server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
- Server, Technical Issues
- tree, Samba Configuration
- AD printer publishing, Uploading Printer Drivers to Samba Servers
- ADAM, Dissection and Discussion
- add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- Add Printer Wizard
- add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- administrative installation, Application Share Configuration
- administrative rights, Check-point Controls
- administrator, Implementation, Samba Configuration, Server Preparation All Servers
- ADS, Technical Issues, Kerberos Configuration, Bad Hostnames
- server, Technical Issues
- ADS Domain, Technical Issues
- affordability, The Nature of Windows Networking Protocols
- alarm, Introduction
- algorithm, Technical Issues
- alternative, Dissection and Discussion
- analysis, Technical Issues
- anonymous connection, Validation, Validation
- Apache Web server, Questions and Answers
- appliance mode, Technical Issues
- application server, Technical Issues, Application Share Configuration
- application servers, The Nature of Windows Networking Protocols
- application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- APW, Uploading Printer Drivers to Samba Servers
- arp, Validation
- assessment, Introduction
- assumptions, Key Points Learned
- authconfig, PAM and NSS Client Configuration
- authenticate, LDAP Server Configuration, Samba Configuration
- authenticated, Assignment Tasks
- authenticated connection, Validation, Validation
- authentication, The Nature of Windows Networking Protocols, Dissection and Discussion, Questions and Answers, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
- plain-text, Questions and Answers
- authentication process, Implementation
- authentication protocols, Key Points Learned
- authoritative, Technical Issues
- authorized location, Kerberos Exposed
- auto-generated SID, Questions and Answers
- automatically allocate, Technical Issues
- availability, Performance, Reliability, and Availability
B
- backends, Integrating Additional Services
- background communication, Questions and Answers
- Backup, Introduction
- Backup Domain Controller (see BDC)
- bandwidth, Assignment Tasks
- requirements, User Needs
- bandwidth calculations, Hardware Requirements
- BDC, Technical Issues, Making Happy Users, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
- benefit, Questions and Answers, Dissection and Discussion
- best practices, Introduction
- bias, Questions and Answers
- binary database, Implementation
- bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- broadcast, Questions and Answers, Routed Networks
- broadcast messages, Implementation
- broadcast storms, Network Collisions
- broken, Dissection and Discussion
- broken behavior, Dissection and Discussion
- browse, Technical Issues
- browse master, Findings
- Browse Master, Questions and Answers
- browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- Browser Election Service, Questions and Answers
- browsing, Assignment Tasks, Technical Issues, Technical Issues
- budgetted, Introduction
- bug fixes, Introduction
C
- cache, Opportunistic Locking Controls
- cache directories, Removal of Pre-existing Conflicting RPMs
- caching, Samba Configuration
- case-sensitive, Kerberos Configuration
- centralized storage, Questions and Answers
- check samba - daemons, Validation, Validation
- check-point, Share Definition Controls
- Check-point Controls, Check-point Controls
- check-point controls, Check-point Controls
- chgrp, Samba Configuration
- chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
- chmod, Samba Configuration
- choice, Dissection and Discussion, Technical Issues
- chown, Removal of Pre-existing Conflicting RPMs
- CIFS, Findings
- cifsfs, Dissection and Discussion
- clean database, Questions and Answers
- Clock skew, Kerberos Configuration
- cluster, Introduction
- clustering, Introduction, For Scalability, Use SAN Based Storage on Samba Servers
- collision rates, Network Collisions
- comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- commercial, Dissection and Discussion
- commercial software, Dissection and Discussion
- Common Internet File System (see CIFS)
- comparison
- Active Directory & OpenLDAP, Dissection and Discussion
- compat, Samba Domain with Samba Domain Member Server Using LDAP
- compatible, Technical Issues
- complexities, Dissection and Discussion
- compromise, Introduction, Introduction, Technical Issues
- computer account, Samba Configuration
- Computer Management, Share Access Controls, Questions and Answers
- condemns, Technical Issues
- conferences, Technical Issues
- connection, Share Access Controls
- connectivity, Questions and Answers
- consequential risk, Technical Issues
- consultant, Drafting Office, Introduction, Dissection and Discussion
- consumer, Dissection and Discussion, Technical Issues
- contiguous directory, Implementation
- copy, LDAP Server Configuration, Questions and Answers
- corrective action, Hardware Problems
- cost, Dissection and Discussion
- Courier-IMAP, LDAP Server Configuration
- create mask, LDAP Server Configuration
- credential, Share Definition Controls
- credentials, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Technical Issues
- crippled, Dissection and Discussion
- criticism, Active Directory, Kerberos, and Security, Introduction
- Critics, Technical Issues
- Cryptographic, Technical Issues
- CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
- cupsd, Basic System Configuration
D
- daemon, Validation, Basic System Configuration, Technical Issues, Questions and Answers, Starting Samba
- daemon control, Process Startup Configuration
- data
- corruption, Making Happy Users
- integrity, Questions and Answers
- data corruption, Hardware Problems, Act! Database Sharing
- data integrity, Hardware Problems, Shared Data Integrity
- data storage, Implementation
- database, Dissection and Discussion, Questions and Answers, Dissection and Discussion
- database applications, Shared Data Integrity
- DB_CONFIG, OpenLDAP Server Configuration
- DCE, Kerberos Exposed
- DDNS (see dynamic - DNS)
- Debian, Migrating NetWare 4.11 Server to Samba-3
- default devmode, Samba Configuration, Implementation
- default installation, Samba System File Location
- default password, The LDAP Account Manager
- default profile, Assignment Tasks, Technical Issues
- Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
- defective
- cables, Hardware Problems
- hubs, Hardware Problems
- switches, Hardware Problems
- defects, Technical Issues
- defensible standards, Technical Issues
- defragmentation, Windows Client Configuration
- delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
- delete user from group script, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
- delimiter, Check-point Controls
- dependability, Technical Issues
- desired security setting, Setting Posix ACLs in UNIX/Linux
- development, Technical Issues
- DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
- client, Bad Hostnames
- relay, Technical Issues
- Relay Agent, Questions and Answers
- request, Questions and Answers
- requests, Technical Issues
- servers, Questions and Answers
- traffic, Questions and Answers
- dhcp client validation, Validation, Validation
- DHCP Server, Implementation
- DHCP server, Technical Issues
- diffusion, Technical Issues
- digital rights, Technical Issues
- digital sign'n'seal, Technical Issues
- digits, Bad Hostnames
- diligence, Technical Issues
- directory, Dissection and Discussion, Political Issues
- Computers container, LDAP Initialization and Creation of User and Group Accounts
- management, Dissection and Discussion
- People container, LDAP Initialization and Creation of User and Group Accounts
- replication, Dissection and Discussion
- schema, Dissection and Discussion
- server, Technical Issues
- synchronization, Dissection and Discussion
- directory mask, LDAP Server Configuration
- directory tree, Setting Posix ACLs in UNIX/Linux
- disable, Introduction
- disable spoolss, Implementation, Implementation
- disaster recovery, Introduction
- disk image, Assignment Tasks
- disruptive, Dissection and Discussion
- distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
- distributed domain, Identity Management Needs
- DMB, Questions and Answers
- DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, LDAP Server Configuration, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
- configuration, Questions and Answers
- Dynamic, Questions and Answers
- dynamic, Joining a Domain: Windows 200x/XP Professional
- lookup, Questions and Answers, Kerberos Configuration
- name lookup, Bad Hostnames
- SRV records, Kerberos Configuration
- suffix, Joining a Domain: Windows 200x/XP Professional
- DNS server, Implementation, Configuration of DHCP and DNS Servers
- document the settings, Samba Configuration
- documentation, Dissection and Discussion, Technical Issues
- documented, Samba Configuration
- Domain, Technical Issues, Questions and Answers
- group, Questions and Answers
- groups, Technical Issues
- user, Questions and Answers
- domain
- Active Directory, Technical Issues
- joining, Appendix: A Collection of Useful Tid-bits
- trusted, Questions and Answers
- Domain accounts, Technical Issues
- Domain Administrator, Share Access Controls
- Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
- Domain Controllers, Technical Issues, Questions and Answers
- Domain Groups
- well-known, Initialization of the LDAP Database
- Domain join, Samba Domain with Samba Domain Member Server Using LDAP
- domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- Domain logons, Questions and Answers
- domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
- Domain Master Browser (see DMB)
- Domain Member, Use and Location of BDCs
- authoritative
- local accounts, Technical Issues
- client, Implementation
- desktop, Introduction
- server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
- servers, Technical Issues, Questions and Answers, Check-point Controls
- workstations, Implementation
- Domain Member server, Technical Issues, Questions and Answers
- Domain Member servers, Questions and Answers
- domain members, Questions and Answers
- domain name space, Identity Management Needs
- domain replication, Questions and Answers
- Domain SID, Technical Issues, NT4 Migration Using LDAP Backend, Questions and Answers
- domain tree, Identity Management Needs
- Domain User Manager, Configuring Profile Directories
- Domain users, Technical Issues
- dos2unix, Samba Configuration
- drive letters, LDAP Server Configuration
- drive mapping, Technical Issues
- dumb printing, Installation of Printer Driver Auto-Download
- dump, Technical Issues, Questions and Answers
- duplicate accounts, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- dynamic DNS, Technical Issues
E
- e-Directory, Dissection and Discussion
- economically sustainable, Dissection and Discussion
- eDirectory, Dissection and Discussion
- education, Identity Management Needs
- election, Findings
- employment, Introduction, Dissection and Discussion
- enable, Printer Configuration
- enable privileges, Samba-3 PDC Configuration, Samba-3 BDC Configuration
- encrypt passwords, Questions and Answers, NSS Configuration
- encrypted, Findings and Comments
- encrypted password, Windows 200x/XP Client Interaction with Samba-3
- encrypted passwords, Questions and Answers
- End User License Agreement (see EULA)
- enumerating, Samba Configuration
- essential, Introduction
- ether-switch, Technical Issues
- Ethereal, Requirements and Notes
- ethereal, Exercises
- Etherswitch, Making Happy Users
- EULA, Dissection and Discussion
- Everyone, Share Access Controls
- Excel, Share Point Directory and File Permissions
- exclusive open, Microsoft Access
- experiment, Active Directory, Kerberos, and Security
- export, Technical Issues
- extent, Dissection and Discussion
- External Domains, Technical Issues
- extreme demand, Guidelines for Reliable Samba Operation
F
- fail, The Nature of Windows Networking Protocols
- fail-over, Identity Management Needs, Implementation
- failed join, Active Directory Domain with Samba Domain Member Server
- failure, Questions and Answers, Samba Configuration
- familiar, Technical Issues
- fatal problem, Samba Configuration
- fear, Technical Issues
- fears, Technical Issues
- Fedora, Drafting Office
- FHS, Samba System File Location
- file and print server, Questions and Answers
- file and print service, Dissection and Discussion
- file cacheing, Opportunistic Locking Controls
- file caching, Samba Configuration
- File Hierarchy System (see FHS)
- file locations, Samba System File Location
- file permissions, The LDAP Account Manager
- file server
- read-only, Dissection and Discussion
- file servers, Samba Server Implementation
- file system, Technical Issues
- access control, Samba Configuration
- Ext3, Implementation
- permissions, Samba Configuration, Configuration for Server: MASSIVE
- file system security, Questions and Answers
- filter, Share Access Controls
- financial responsibility, Introduction
- firewall, Technical Issues, Basic System Configuration, Introduction
- fix, Dissection and Discussion
- flaws, Introduction
- flexibility, Technical Issues
- FLOSS (see Free-Libre/Open Source Software)
- flush
- cache memory, Opportunistic Locking Controls
- folder redirection, Technical Issues, Configuration of Default Profile with Folder Redirection, Questions and Answers
- force group, Implementation, LDAP Server Configuration, Override Controls, Questions and Answers
- force printername, LDAP Server Configuration
- force user, Dissection and Discussion, Implementation, Override Controls, Questions and Answers
- forced settings, Override Controls
- foreign, Samba Domain with Samba Domain Member Server Using LDAP
- foreign SID, Samba Domain with Samba Domain Member Server Using LDAP
- forwarded, Routed Networks
- foundation members, Technical Issues
- Free Standards Grou (see FSG)
- Free-Libre/Open Source Software, Migrating NetWare 4.11 Server to Samba-3
- front-end, Dissection and Discussion
- FSG, Samba System File Location
- FTP
- proxy, Questions and Answers
- full control, Share Access Controls, Using MS Windows Explorer (File Manager)
- fully qualified, Check-point Controls
G
- Gentoo, Migrating NetWare 4.11 Server to Samba-3
- getent, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- getfacl, Setting Posix ACLs in UNIX/Linux
- getgrgid(), Questions and Answers
- getgrnam, Technical Issues
- getpwnam, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- getpwnam(), Questions and Answers
- GID, Implementation, Questions and Answers, Questions and Answers
- Goettingen, Questions and Answers
- government, Identity Management Needs
- GPL, Comments Regarding Software Terms of Use
- group account, Implementation, OpenLDAP Server Configuration
- group management, Implementation
- group mapping, LDAP Server Configuration
- group membership, Implementation, Samba Configuration, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
- group names, Questions and Answers
- group policies, Introduction
- Group Policy, Joining a Domain: Windows 200x/XP Professional
- Group Policy editor, The Local Group Policy
- Group Policy Objects, The Local Group Policy
- groupadd, Implementation, Implementation, Questions and Answers
- groupdel, Questions and Answers
- groupmod, Questions and Answers
- GSS-API, Windows 200x/XP Client Interaction with Samba-3
- guest account, Findings and Comments, Dissection and Discussion, Technical Issues, Questions and Answers
- guest ok, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
H
- hackers, Introduction
- hardware prices, Hardware Problems
- hardware problems, Hardware Problems
- Heimdal, Implementation, Kerberos Configuration
- Heimdal Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- helper agent, Removal of Pre-existing Conflicting RPMs
- hesoid, Samba Domain with Samba Domain Member Server Using LDAP
- hide files, LDAP Server Configuration
- hierarchy of control, Share Definition Controls
- high availability, Dissection and Discussion
- hire, Dissection and Discussion
- HKEY_CURRENT_USER, Roaming Profile Background
- HKEY_LOCAL_MACHINE, Configuration of Default Profile with Folder Redirection
- HKEY_LOCAL_USER, Questions and Answers
- host announcement, Assignment Tasks, Findings
- hostname, Basic System Configuration
- hosts, Questions and Answers
- hosts allow, Samba Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- hosts deny, Samba Configuration, Implementation
- HUB, Making Happy Users
- Hybrid, Questions and Answers
- hypothetical, Introduction
I
- Idealx
- identifiers, Technical Issues
- identity, Questions and Answers, Kerberos Exposed
- management, Technical Issues
- identity management, Technical Issues, Dissection and Discussion, Dissection and Discussion, Political Issues
- Identity Management, Dissection and Discussion, The Nature of Windows Networking Protocols, Identity Management Needs
- Identity management, UNIX/Linux Client Domain Member
- Identity resolution, Samba Domain with Samba Domain Member Server Using LDAP, Active Directory Domain with Samba Domain Member Server, UNIX/Linux Client Domain Member, Questions and Answers
- Identity resolver, Questions and Answers
- IDMAP, Samba Domain with Samba Domain Member Server Using LDAP
- idmap backend, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- IDMAP backend, Questions and Answers
- idmap gid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- idmap uid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- IMAP, Technical Issues
- import, Technical Issues
- include, Implementation
- income, Dissection and Discussion
- independent expert, Introduction
- inetd, Process Startup Configuration
- inetOrgPerson, Technical Issues
- inheritance, Setting Posix ACLs in UNIX/Linux
- initGrps.sh, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- initial credentials, Kerberos Configuration
- inoperative, Dissection and Discussion
- installation, Dissection and Discussion
- integrate, Technical Issues
- integrity, Introduction, Kerberos Exposed
- inter-operability, Dissection and Discussion, Technical Issues, Key Points Learned, Questions and Answers
- interdomain trusts, Identity Management Needs
- interfaces, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- intermittent, Hardware Problems
- Internet Explorer, Technical Issues
- Internet Information Server, Questions and Answers
- interoperability, Dissection and Discussion
- IP forwarding, Implementation, Basic System Configuration, Configuration for Server: MASSIVE
- IPC$, Findings and Comments, Implementation
- iptables, Technical Issues
- isolated, Introduction
- Italian, Questions and Answers
J
- jobs, Introduction
- joining a domain, Joining a Domain: Windows 200x/XP Professional
K
- KDC, Kerberos Configuration
- Kerberos, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Key Points Learned, Technical Issues, Implementation, Kerberos Configuration
- Heimdal, Active Directory Domain with Samba Domain Member Server
- interoperability, Kerberos Exposed
- libraries, Active Directory Domain with Samba Domain Member Server
- MIT, Active Directory Domain with Samba Domain Member Server
- unspecified fields, Kerberos Exposed
- kerberos, Kerberos Exposed
- server, Kerberos Exposed
- Kerberos ticket, Samba Configuration
- kinit, Kerberos Configuration
- Kixtart, LDAP Server Configuration
- klist, Kerberos Configuration
- krb5, Implementation
- krb5.conf, Kerberos Configuration
L
- LAM, The LDAP Account Manager
- configuration editor, The LDAP Account Manager
- configuration file, The LDAP Account Manager
- login screen, The LDAP Account Manager
- opening screen, The LDAP Account Manager
- profile, The LDAP Account Manager
- wizard, The LDAP Account Manager
- LDAP, Technical Issues, Assignment Tasks, Dissection and Discussion, Technical Issues, PAM and NSS Client Configuration, Introduction, Dissection and Discussion, Identity Management Needs, Implementation, Key Points Learned, Questions and Answers, Assignment Tasks, Technical Issues, Questions and Answers, Dissection and Discussion, LDAP Server Configuration, Technical Issues, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Technical Issues
- backend, Identity Management Needs
- database, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Alternative LDAP Database Initialization
- directory, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs
- fail-over, Implementation
- initial configuration, Alternative LDAP Database Initialization
- master, Identity Management Needs
- master/slave
- background communication, Questions and Answers
- preload, Implementation
- secure, Technical Issues
- server, Questions and Answers
- slave, Identity Management Needs
- updates, Identity Management Needs
- ldap, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP Account Manager (see LAM)
- ldap admin dn, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP backend, Technical Issues
- LDAP database, Questions and Answers
- ldap group suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap idmap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP Interchange Format (see LDIF)
- ldap machine suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap passwd sync, LDAP Server Configuration
- LDAP server, Identity Management Needs
- ldap ssl, LDAP Server Configuration, Active Directory Domain with Samba Domain Member Server
- ldap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap user suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP-transfer-LDIF.txt, Implementation
- ldap.conf, Samba Domain with Samba Domain Member Server Using LDAP
- ldapadd, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
- ldapsam, LDAP Initialization and Creation of User and Group Accounts, Dissection and Discussion, Assignment Tasks, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Integrating Additional Services
- ldapsam backend, Samba Domain with Samba Domain Member Server Using LDAP
- ldapsearch, LDAP Initialization and Creation of User and Group Accounts
- LDIF, Technical Issues, Implementation, Technical Issues, LDAP Server Configuration, Initialization of the LDAP Database
- leadership, Technical Issues
- Lightweight Directory Access Protocol (see LDAP)
- limit, Questions and Answers
- Linux desktop, Introduction
- Linux Standards Base (see LSB)
- LMB, Findings, Questions and Answers
- LMHOSTS, Routed Networks
- load distribution, For Scalability, Use SAN Based Storage on Samba Servers
- local accounts, Technical Issues
- Local Group Policy, Roaming Profile Background
- local groups, Questions and Answers
- Local Master Announcement, Findings
- Local Master Browser (see LMB)
- local users, Questions and Answers
- localhost, Basic System Configuration, Bad Hostnames
- locking, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
- Application level, Shared Data Integrity
- Client side, Shared Data Integrity
- Server side, Shared Data Integrity
- log file, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- log level, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- logging, Removal of Pre-existing Conflicting RPMs
- login, Technical Issues
- logon credentials, Questions and Answers
- logon drive, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- logon home, Samba Configuration, Implementation, LDAP Server Configuration
- logon hours, Technical Issues, Key Points Learned
- logon machines, Technical Issues
- logon path, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- logon process, Implementation
- logon scrip, Samba Configuration, Technical Issues
- logon script, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Preparation of Logon Scripts, Implementation, Technical Issues, LDAP Server Configuration
- logon server, The Nature of Windows Networking Protocols
- logon services, Implementation
- logon time, Assignment Tasks
- logon traffic, The Nature of Windows Networking Protocols
- logon.kix, LDAP Server Configuration
- loopback, Validation
- low performance, Hardware Problems
- lower-case, Technical Issues
- lpadmin, Implementation, Implementation, Implementation, Printer Configuration, Printer Configuration
- LSB, Samba System File Location
M
- machine account, Regarding LDAP Directories and Windows Computer Accounts
- machine accounts, Questions and Answers
- machine secret password, Technical Issues
- managed, Technical Issues
- management, Political Issues, Questions and Answers
- group, Technical Issues
- User, Technical Issues
- mandatory profile, Technical Issues, Configuring Profile Directories
- Mandrake, Migrating NetWare 4.11 Server to Samba-3
- map acl inherit, Samba Configuration, Implementation, Samba-3 PDC Configuration
- mapped drives, Questions and Answers
- mapping, Technical Issues, Kerberos Configuration
- Mars_NWE, Migrating NetWare 4.11 Server to Samba-3
- master, Dissection and Discussion
- material, Appendix: A Collection of Useful Tid-bits
- max log size, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- memberUID, LDAP Server Configuration
- memory requirements, Hardware Requirements
- merge, Technical Issues, Questions and Answers
- merged, Technical Issues
- meta-directory, Questions and Answers
- meta-service, Questions and Answers
- Microsoft Access, Shared Data Integrity
- Microsoft Excel, Shared Data Integrity
- Microsoft ISA, Assignment Tasks
- Microsoft Management Console (see MMC)
- Microsoft Office, Application Share Configuration, Share Point Directory and File Permissions
- Microsoft Outlook
- PST files, Questions and Answers
- migrate, Technical Issues
- migration, Implementation, Implementation, Assignment Tasks, Introduction, Questions and Answers, Migrating NetWare 4.11 Server to Samba-3
- objectives, Dissection and Discussion
- Migration speed, Questions and Answers
- mime type, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- mime types, Implementation
- missing RPC's, Technical Issues
- MIT, Implementation, Kerberos Configuration
- MIT Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- MIT KRB5, Samba Configuration
- mixed mode, Active Directory Domain with Samba Domain Member Server
- mixed-mode, Questions and Answers
- MMC, Configure Delete Cached Profiles on Logout, Technical Issues, Questions and Answers
- mobile computing, Dissection and Discussion
- mobility, Technical Issues
- modularization, Technical Issues
- modules, Questions and Answers
- MS Access
- validate, Microsoft Access
- MS Outlook
- PST file, Making Happy Users
- MS Windows Server 2003, Implementation
- MS Word, Share Point Directory and File Permissions
- MSDFS, Distribute Network Load with MSDFS
- multi-subnet, Routed Networks
- multi-user
- access, Microsoft Access
- data access, Shared Data Integrity
- multiple directories, Identity Management Needs
- multiple domain controllers, Making Happy Users
- multiple group mappings, Questions and Answers
- My Documents, Roaming Profile Background
- My Network Places, Implementation
- mysqlsam, Implementation
N
- name resolution, Assignment Tasks, Configuration of DHCP and DNS Servers, Questions and Answers
- name resolve order, Questions and Answers, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Name Service Switch, Implementation
- name service switch (see NSS)
- named, Basic System Configuration, Validation, Server Preparation All Servers
- NAT, Technical Issues
- native, Questions and Answers
- net
- ads
- getlocalsid, Samba-3 PDC Configuration
- group, NT4 Migration Using tdbsam Backend
- groupmap
- rpc
- getsid, NT4 Migration Using LDAP Backend
- join, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers
- vampire, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
- NetBIOS, Questions and Answers, The Nature of Windows Networking Protocols, Questions and Answers, Bad Hostnames, Routed Networks
- name cache, Questions and Answers
- name resolution
- delays, Making Happy Users
- Node Type, Questions and Answers
- netbios forwarding, Network Collisions
- netbios name, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, NSS Configuration, Bad Hostnames
- NetBIOS name, Kerberos Configuration
- aliases, Identity Management Needs
- NETLOGON, Using a Network Default User Profile, Windows Client Configuration
- netlogon, The Nature of Windows Networking Protocols, LDAP Server Configuration
- Netlogon, Joining a Domain: Windows 200x/XP Professional
- netmask, Implementation
- Netware, Small Office Networking
- NetWare, Migrating NetWare 4.11 Server to Samba-3, LDAP Server Configuration
- network
- administrators, Technical Issues
- analyzer, Assignment Tasks
- bandwidth, Identity Management Needs, Questions and Answers
- broadcast, Introduction
- captures, Requirements and Notes
- collisions, Network Collisions
- load, Network Collisions
- logon, Making Happy Users
- logon scripts, Dissection and Discussion
- management, Introduction
- multi-segment, Introduction
- overload, Making Happy Users
- performance, Samba Configuration
- routed, Dissection and Discussion
- secure, Introduction
- segment, Dissection and Discussion
- services, Questions and Answers
- sniffer, Requirements and Notes
- tiemouts, Network Collisions
- timeout, Making Happy Users
- trace, Assignment Tasks
- traffic
- observation, Technical Issues
- wide-area, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Network Address Translation (see NAT)
- network administrators, Technical Issues
- network attached storage (see NAS)
- network bandwidth
- utilization, Making Happy Users
- Network Default Profile, Roaming Profile Background
- network hardware
- defective, Making Happy Users
- network hygiene, Dissection and Discussion
- network Identities, Questions and Answers
- network load factors, Dissection and Discussion
- Network Neighborhood, Validation, Technical Issues
- network segment, Use and Location of BDCs
- network segments, Hardware Requirements
- network share, Assignment Tasks
- networking hardware
- defective, Making Happy Users
- networking protocols, Technical Issues
- next generation, Technical Issues
- NFS server, Samba-3 PDC Configuration
- NICs, Hardware Problems
- NIS, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Political Issues, Questions and Answers
- nis, Samba Domain with Samba Domain Member Server Using LDAP
- NIS schema, Questions and Answers
- NIS server, Questions and Answers
- NIS+, Identity Management Needs
- nisplus, Samba Domain with Samba Domain Member Server Using LDAP
- NLM, Migrating NetWare 4.11 Server to Samba-3
- nmap, Validation
- nmbd, Validation, Validation, Samba Configuration, Starting Samba
- nobody, Findings and Comments, Removal of Pre-existing Conflicting RPMs
- Novell, Migrating NetWare 4.11 Server to Samba-3, Introduction
- NSS, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, PAM and NSS Client Configuration, LDAP Server Configuration, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, UNIX/Linux Client Domain Member, Questions and Answers, NSS Configuration (see Name Service Switch)
- nss_ldap, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, OpenLDAP Server Configuration, PAM and NSS Client Configuration, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- nt acl support, Dissection and Discussion, Implementation
- NT4 registry, Dissection and Discussion
- NTLM, Technical Issues
- NTLM authentication daemon, Technical Issues
- NTLMSSP, Windows 200x/XP Client Interaction with Samba-3, Key Points Learned, Questions and Answers
- NTLMSSP_AUTH, Windows 200x/XP Client Interaction with Samba-3
- ntlm_auth, Samba Configuration, Questions and Answers
- NTP, Kerberos Configuration
- NTUSER.DAT, Roaming Profile Background, Profile Changes, Using a Network Default User Profile, Questions and Answers
- NULL connection, Validation
- NULL session, Findings and Comments
- NULL-Session, Discussion
O
- objectClass, LDAP Server Configuration
- off-site storage, Introduction
- Open Magazine, Adding UNIX/LINUX Servers and Clients
- Open Source, Dissection and Discussion
- OpenLDAP, Dissection and Discussion, Dissection and Discussion, Questions and Answers, Technical Issues, Political Issues, Introduction, Technical Issues, Key Points Learned, The LDAP Account Manager
- openldap, OpenLDAP Server Configuration
- OpenOffice, Application Share Configuration
- operating profiles, The LDAP Account Manager
- oplock break, Override Controls
- oplocks, Samba Configuration
- Oplocks
- disabled, Opportunistic Locking Controls
- opportunistic
- locking, Override Controls
- opportunistic locking, Implementation, Samba Configuration, Act! Database Sharing
- optimized, Samba Configuration
- options list, Questions and Answers
- organizational units, The LDAP Account Manager
- os level, Implementation
- Outlook
- Outlook Express, Political Issues
- over-ride, Technical Issues
- over-ride controls, Override Controls
- over-rule, Share Access Controls, Using MS Windows Explorer (File Manager)
- overheads, Override Controls
- ownership, Share Point Directory and File Permissions
P
- package, Implementation
- package names, Samba System File Location
- PADL, Technical Issues
- PADL LDAP tools, Technical Issues
- PADL Software, Samba Domain with Samba Domain Member Server Using LDAP
- PAM, PAM and NSS Client Configuration, LDAP Server Configuration, UNIX/Linux Client Domain Member
- pam password change, Samba Configuration, LDAP Server Configuration
- pam_ldap, OpenLDAP Server Configuration
- pam_ldap.so, PAM and NSS Client Configuration
- pam_unix2.so, PAM and NSS Client Configuration
- use_ldap, PAM and NSS Client Configuration
- passdb backend, Implementation, Samba Configuration, The 500-User Office, Implementation, Dissection and Discussion, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Assignment Tasks, Questions and Answers, LDAP Server Configuration, Technical Issues, Questions and Answers
- passdb.tdb, Technical Issues
- passwd, Implementation, Implementation, Samba Configuration
- passwd chat, Implementation, Samba Configuration
- password
- password caching, Implementation
- password change, Key Points Learned
- password length, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
- password server, NSS Configuration
- path, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- payroll, Introduction
- pdbedit, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, NT4 Migration Using tdbsam Backend, Questions and Answers
- PDC, Assignment Tasks, Technical Issues, Making Happy Users, Technical Issues, The Local Group Policy, The Nature of Windows Networking Protocols, Technical Issues, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
- PDC/BDC ratio, Making Happy Users
- PDF, The LDAP Account Manager
- performance, Dissection and Discussion, Questions and Answers, Performance, Reliability, and Availability, Introduction, Network Collisions
- performance degradation, Override Controls, Samba Configuration
- Perl, LDAP Server Configuration, The LDAP Account Manager
- permission, Share Point Directory and File Permissions
- permissions, Implementation, Technical Issues, Share Access Controls, Check-point Controls, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
- Permissions, Using the MMC Computer Management Interface
- permits, Technical Issues
- permitted group, Using the MMC Computer Management Interface
- PHP, The LDAP Account Manager
- PHP4, The LDAP Account Manager
- pile-driver, Share Definition Controls
- ping, Validation, NT4 Migration Using LDAP Backend
- pitfalls, The LDAP Account Manager
- plain-text, Questions and Answers
- Pluggable Authentication Modules (see PAM)
- policy, Questions and Answers, Introduction
- poor performance, Dissection and Discussion
- POP3, Technical Issues
- Posix, Dissection and Discussion, Technical Issues, Technical Issues, Questions and Answers, Questions and Answers, The LDAP Account Manager
- POSIX, Regarding LDAP Directories and Windows Computer Accounts, LDAP Server Configuration
- Posix accounts, LDAP Initialization and Creation of User and Group Accounts, Technical Issues
- Posix ACLs, Managing Windows 200x ACLs
- PosixAccount, LDAP Initialization and Creation of User and Group Accounts
- posixAccount, LDAP Server Configuration
- Postfix, LDAP Server Configuration
- Postscript, Installation of Printer Driver Auto-Download
- powers, Share Definition Controls
- practices, Introduction
- preferred master, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- preload.LDIF, NT4 Migration Using LDAP Backend
- presence and leadership, Technical Issues
- price paid, Dissection and Discussion
- primary group, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
- principals, Kerberos Exposed
- print filter, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- print queue, Charity Administration Office, Dissection and Discussion
- print spooler, Charity Administration Office
- Print Test Page, Uploading Printer Drivers to Samba Servers
- printable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- printcap name, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- printer admin, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- printer - validation, Validation, Validation
- printers
- Advanced, Uploading Printer Drivers to Samba Servers
- Default Settings, Uploading Printer Drivers to Samba Servers
- General, Uploading Printer Drivers to Samba Servers
- Properties, Uploading Printer Drivers to Samba Servers
- Security, Uploading Printer Drivers to Samba Servers
- Sharing, Uploading Printer Drivers to Samba Servers
- printing, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- privacy, Identity Management Needs
- Privilege Attribute Certificates (see PAC)
- privilege controls, Share Point Directory and File Permissions
- privileged pipe, Samba Configuration
- privileges, Identity Management Needs, Technical Issues, Share Definition Controls
- product defects, Dissection and Discussion
- profile
- default, Assignment Tasks
- mandatory, The Nature of Windows Networking Protocols
- roaming, Making Happy Users
- profile acls, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- profile path, Technical Issues
- profile share, Implementation
- profiles share, Dissection and Discussion
- programmer, Dissection and Discussion
- project maintainers, Technical Issues
- Properties, Using the MMC Computer Management Interface
- proprietary, Technical Issues
- protected, Technical Issues
- protection, Technical Issues
- protocol
- negotiation, The Nature of Windows Networking Protocols
- protocol analysis, Requirements and Notes
- protocols, Technical Issues
- proxy, Assignment Tasks, Technical Issues
- public specifications, Technical Issues
Q
- Qbasic, LDAP Server Configuration
R
- RAID, Hardware Requirements
- RAID controllers, Hardware Problems
- Raw Print Through, Installation of Printer Driver Auto-Download
- raw printing, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- Rbase, LDAP Server Configuration
- rcldap, Implementation
- read only, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- realm, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration, NSS Configuration
- recognize, Technical Issues
- record locking, Microsoft Access
- recursively, Setting Posix ACLs in UNIX/Linux
- Red Hat, Drafting Office, Migrating NetWare 4.11 Server to Samba-3
- Red Hat Fedora Linux, Samba Configuration
- Red Hat Linux, Dissection and Discussion, Accounting Office, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Samba Configuration
- redirected folders, Roaming Profile Background, The Nature of Windows Networking Protocols
- refereed standards, Technical Issues
- regedit, Implementation
- regedt32, Profile Changes, Configuration of Default Profile with Folder Redirection
- registry, Questions and Answers
- keys
- SAM, Dissection and Discussion
- SECURITY, Dissection and Discussion
- registry change, Questions and Answers
- Registry Editor, Configuration of Default Profile with Folder Redirection
- registry hacks, Questions and Answers
- registry keys, Configuration of Default Profile with Folder Redirection
- reimburse, Dissection and Discussion
- rejected, Share Access Controls
- rejoin, Questions and Answers
- reliability, Performance, Reliability, and Availability
- remote announce, Routed Networks
- remote browse sync, Routed Networks
- remote procedure call (see RPC)
- replicate, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- replicated, Dissection and Discussion
- resilient, Guidelines for Reliable Samba Operation
- resolve, Technical Issues, Bad Hostnames
- responsibility, Dissection and Discussion
- responsible, Technical Issues
- restricted export, Kerberos Exposed
- Restrictive security, Active Directory Domain with Samba Domain Member Server
- reverse DNS, Kerberos Configuration
- RID, LDAP Server Configuration
- risk, Technical Issues, Questions and Answers, Questions and Answers, Introduction
- road-map, Technical Issues
- published, Technical Issues
- roaming profile, Technical Issues, Roaming Profile Background, Configuring Profile Directories, User Needs, Questions and Answers
- roaming profiles, Technical Issues, Implementation, Roaming Profile Background
- routed network, Use and Location of BDCs
- router, Implementation
- routers, Questions and Answers, Routed Networks
- RPC, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- RPM, Dissection and Discussion
- install, Implementation
- rpm, Removal of Pre-existing Conflicting RPMs, Samba System File Location
- RPMs, Samba Configuration
- rpms, Removal of Pre-existing Conflicting RPMs
- rsync, Samba-3 PDC Configuration, LDAP Server Configuration, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- rsyncd.conf, LDAP Server Configuration
- run-time control files, Samba System File Location
S
- safe-guards, Technical Issues
- SAM, Dissection and Discussion
- samba, Removal of Pre-existing Conflicting RPMs
- starting samba, Implementation
- Samba, Samba Configuration
- Samba accounts, Technical Issues
- samba cluster, Introduction
- samba control script, Starting Samba
- Samba Domain, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Samba Domain server, Using the MMC Computer Management Interface
- Samba RPM Packages, Samba-3 PDC Configuration
- Samba Tea, Samba Configuration
- sambaGroupMapping, LDAP Server Configuration
- SambaSAMAccount, Regarding LDAP Directories and Windows Computer Accounts
- SambaSamAccount, LDAP Initialization and Creation of User and Group Accounts
- sambaSamAccount, LDAP Server Configuration
- SambaXP conference, Questions and Answers
- SAN, For Scalability, Use SAN Based Storage on Samba Servers
- scalability, Introduction
- scalable, Identity Management Needs
- schannel, Technical Issues, Key Points Learned, Questions and Answers
- schema, Questions and Answers
- scripts, The LDAP Account Manager
- secondary group, Samba Domain with Samba Domain Member Server Using LDAP
- secret, Kerberos Exposed
- secrets.tdb, Technical Issues, Samba-3 PDC Configuration, NT4 Migration Using LDAP Backend
- secure, Introduction
- secure account password, Questions and Answers
- secure connections, The LDAP Account Manager
- secure networking, Technical Issues
- secure networking protocols, Technical Issues
- security, Implementation, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Share Point Directory and File Permissions, Questions and Answers, NSS Configuration
- share mode, Dissection and Discussion
- user mode, Dissection and Discussion
- Security, Technical Issues, Using the MMC Computer Management Interface
- Security Account Manager (see SAM)
- security controls, Technical Issues
- security descriptors, Dissection and Discussion
- security fixes, Technical Issues
- security updates, Technical Issues
- SerNet, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- server string, LDAP Server Configuration, Active Directory Domain with Samba Domain Member Server
- service, Implementation
- Service Packs, Application Share Configuration
- services, Key Points Learned
- session setup, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
- Session Setup, Simple Windows Client Connection Characteristics
- set primary group script, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- setfacl, Setting Posix ACLs in UNIX/Linux
- severely degrade, Samba Configuration
- SGID, Dissection and Discussion, Share Point Directory and File Permissions, Effect of Setting File and Directory SUID/SGID Permissions Explained
- shadow-utils, Questions and Answers
- share, Questions and Answers
- Share Access Controls, Share Access Controls
- share ACLs, Questions and Answers
- share definition, Technical Issues
- Share Definition
- Controls, Share Definition Controls
- share definition controls, Share Definition Controls, Check-point Controls, Share Point Directory and File Permissions, Questions and Answers
- share level access controls, Questions and Answers
- share level ACL, Questions and Answers
- Share Permissions, Share Access Controls
- shared resource, Technical Issues, Setting Posix ACLs in UNIX/Linux
- shares, Technical Issues
- show add printer wizard, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- shutdown script, Samba Configuration, Implementation, Implementation
- SID, Windows Client Configuration, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Initialization of the LDAP Database
- side effects, Managing Windows 200x ACLs
- Sign'n'seal, Key Points Learned, Questions and Answers
- silent return, Active Directory Domain with Samba Domain Member Server
- simple, Dissection and Discussion
- Single Sign-On (see SOS)
- slapadd, NT4 Migration Using LDAP Backend
- slapcat, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- slave, Dissection and Discussion
- slow logon, Making Happy Users
- slow network, Hardware Problems
- slurpd, Implementation, Questions and Answers
- smart printing, Dissection and Discussion
- SMB passwords, Implementation
- smb ports, Samba Configuration, Questions and Answers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- SMB/CIFS, Questions and Answers
- smbclient, Validation, Validation, LDAP Initialization and Creation of User and Group Accounts, NT4 Migration Using LDAP Backend, Questions and Answers
- smbd, Validation, Implementation, Validation, Validation, Samba-3 PDC Configuration, Technical Issues, Active Directory Domain with Samba Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
- location of files, Samba System File Location
- smbfs, Dissection and Discussion
- smbldap-groupadd, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
- smbldap-groupmod, LDAP Server Configuration
- smbldap-passwd, LDAP Initialization and Creation of User and Group Accounts
- smbldap-populate, LDAP Initialization and Creation of User and Group Accounts
- smbldap-tools, LDAP Server Configuration, The LDAP Account Manager
- smbldap-useradd, LDAP Initialization and Creation of User and Group Accounts
- smbldap-useradd.pl, Implementation
- smbldap-usermod, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
- smbmnt, Dissection and Discussion
- smbmount, Dissection and Discussion
- smbpasswd, Implementation, Technical Issues, Implementation, Technical Issues, Samba Configuration, Server Preparation All Servers, Configuration for Server: MASSIVE, Samba-3 PDC Configuration, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, Questions and Answers, Integrating Additional Services
- smbumnt, Dissection and Discussion
- smbumount, Dissection and Discussion
- SMTP, Technical Issues
- snap-shot, Dissection and Discussion
- socket address, Samba Configuration
- socket options, Samba Configuration
- software, Dissection and Discussion
- solve, Dissection and Discussion
- source code, Dissection and Discussion
- SPNEGO, Windows 200x/XP Client Interaction with Samba-3
- SQL, Dissection and Discussion, Questions and Answers
- Squid, Implementation, Removal of Pre-existing Conflicting RPMs, Samba Configuration, Squid Configuration
- squid, Removal of Pre-existing Conflicting RPMs, Samba Configuration
- Squid proxy, Technical Issues
- SRVTOOLS.EXE, Implementation, Configuring Profile Directories, Questions and Answers, Questions and Answers
- SSL, The LDAP Account Manager
- starting - CUPS, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
- starting dhcpd, Implementation, Process Startup Configuration, Process Startup Configuration
- starting samba, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
- nmbd, Starting Samba
- smbd, Starting Samba
- winbindd, Starting Samba
- startup script, Starting Samba
- sticky bit, Implementation
- storage capacity, Hardware Requirements
- strategic, Technical Issues
- strategy, Questions and Answers
- straw-man, Active Directory, Kerberos, and Security
- strict sync, Samba Configuration
- strong cryptography, Kerberos Exposed
- SUID, Dissection and Discussion, Questions and Answers, Effect of Setting File and Directory SUID/SGID Permissions Explained
- Sun ONE Identity Server, Dissection and Discussion
- super daemon, Process Startup Configuration
- support, Dissection and Discussion
- survey, Adding UNIX/LINUX Servers and Clients
- SuSE, Migrating NetWare 4.11 Server to Samba-3
- SUSE Enterprise Linux Server, Charity Administration Office, Basic System Configuration, Implementation
- SUSE Linux, Dissection and Discussion, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Removal of Pre-existing Conflicting RPMs
- SWAT, Samba System File Location
- sync always, Samba Configuration
- synchronization, Kerberos Configuration, For Scalability, Use SAN Based Storage on Samba Servers
- synchronize, User Needs, LDAP Server Configuration
- synchronized, Questions and Answers
- syslog, Implementation, Samba Configuration, Implementation, OpenLDAP Server Configuration, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- system level logins, Questions and Answers
- system security, Technical Issues
T
- tattooing, Questions and Answers
- TCP/IP, Questions and Answers
- tdbdump, NT4 Migration Using LDAP Backend, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- tdbsam, Technical Issues, Implementation, The 500-User Office, Assignment Tasks, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
- template primary group, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- template shell, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- testparm, Validation, Validation, Samba-3 PDC Configuration, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- ticket, Samba Configuration
- time server, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- Tivoli Directory Server, Dissection and Discussion
- TLS, LDAP Server Configuration
- token, Technical Issues
- tool, Questions and Answers, Dissection and Discussion
- track record, Dissection and Discussion
- traffic collisions, Making Happy Users
- transaction processing, Dissection and Discussion
- transactional, Questions and Answers
- transfer, Questions and Answers
- translate, Managing Windows 200x ACLs
- traverse, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- tree, Dissection and Discussion
- Tree Connect, Simple Windows Client Connection Characteristics
- trust account, Regarding LDAP Directories and Windows Computer Accounts
- trusted computing, Introduction
- Trusted Domains, Technical Issues
- trusted domains, Questions and Answers
- trusted third-party, Kerberos Exposed
- trusting, Kerberos Exposed
- turn-around time, Technical Issues
U
- UDP
- broadcast, Routed Networks
- UID, Dissection and Discussion, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, Implementation, Questions and Answers, Questions and Answers
- un-join, Questions and Answers
- unauthorized activities, Kerberos Exposed
- UNC name, Questions and Answers
- unencrypted, The LDAP Account Manager
- Unicast, The Nature of Windows Networking Protocols
- Universal Naming Convention (see UNC name)
- UNIX, LDAP Server Configuration
- groups, Technical Issues, Implementation
- UNIX account, Questions and Answers
- UNIX accounts, Technical Issues
- unix charset, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- unix password sync, Samba Configuration
- UNIX/Linux server, Technical Issues
- unix2dos, Samba Configuration
- unknown, Technical Issues
- updates, Introduction, Technical Issues
- upgrade, LDAP Server Configuration
- uppercase, Technical Issues
- use client driver, Implementation, Implementation, Implementation, Samba Configuration, Implementation, LDAP Server Configuration
- user
- user account, Making Happy Users, OpenLDAP Server Configuration
- User and Group Controls, Technical Issues
- user credentials, Identity Management Needs, UNIX/Linux Client Domain Member
- user errors, Questions and Answers
- user identities, Implementation
- user logins, Questions and Answers
- user management, Implementation
- User Mode, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3, Implementation
- useradd, Implementation, Implementation, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- username map, Implementation, Samba Configuration, Server Preparation All Servers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- utilities, Questions and Answers
- utmp, Samba Configuration, Implementation, Implementation
V
- valid users, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Check-point Controls, Questions and Answers
- validate, NT4 Migration Using LDAP Backend, Questions and Answers, Check-point Controls
- validated, Identity Management Needs, Active Directory Domain with Samba Domain Member Server, Introduction
- validation, Validation, Validation, Questions and Answers
- vampire, Questions and Answers
- vendor, Dissection and Discussion
- veto files, Samba Configuration, Implementation, LDAP Server Configuration
- veto oplock files, Samba Configuration, Implementation
- VFS modules, Samba System File Location
- virus, Implementation
- VPN, Assignment Tasks
- vulnerabilities, Introduction
W
- wbinfo, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- weakness, Technical Issues
- web
- caching, Assignment Tasks
- proxying, Assignment Tasks
- Web
- proxy, Questions and Answers
- access, Key Points Learned
- Web browsers, Key Points Learned
- WebClient, Making Happy Users
- white-pages, Technical Issues, LDAP Server Configuration
- wide-area, User Needs, Identity Management Needs, Key Points Learned, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- wide-area network, Use and Location of BDCs, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- winbind, Implementation, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Introduction, Technical Issues, Technical Issues, Samba Configuration, NSS Configuration
- Winbind, Questions and Answers, Technical Issues, Key Points Learned
- winbind enable local accounts, Technical Issues, Questions and Answers
- winbind enum groups, NSS Configuration
- winbind enum users, NSS Configuration
- winbind separator, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- winbind trusted domains only, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers
- winbind use default domain, Check-point Controls
- winbind user default domain, NSS Configuration
- winbindd, Validation, Validation, Technical Issues, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers, Samba Configuration, Questions and Answers, Starting Samba
- winbindd_cache.tdb, Technical Issues
- winbindd_idmap.tdb, Technical Issues
- Windows, LDAP Server Configuration
- Windows 2000 ACLs, Managing Windows 200x ACLs
- Windows 2003 Serve, Introduction
- Windows 200x ACLs, Questions and Answers
- Windows accounts, Technical Issues
- Windows ACLs, Setting Posix ACLs in UNIX/Linux
- Windows Address Book, LDAP Server Configuration
- Windows ADS Domain, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Windows clients, Questions and Answers
- Windows Explorer, Validation
- Windows explorer, Questions and Answers
- Windows security identifier (see SID)
- Windows Servers, Introduction
- Windows Services for UNIX (see SUS)
- Windows XP, Assignment Tasks
- WINS, Questions and Answers, Implementation, Technical Issues, Implementation, Windows Client Configuration, Technical Issues, Windows Client Configuration, The Nature of Windows Networking Protocols, Identity Management Needs, Questions and Answers
- lookup, Questions and Answers
- name resolution, Routed Networks
- server, Making Happy Users, Routed Networks
- WINS server, The 500-User Office, Questions and Answers
- wins server, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- WINS serving, Implementation
- wins support, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- wins.dat, Identity Management Needs
- Word, Share Point Directory and File Permissions
- workgroup, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- Workgroup Announcement, Findings
- workstation, Implementation
- wrapper, Questions and Answers
- write list, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- write lock, Opportunistic Locking Controls
X
- Ximian, Migrating NetWare 4.11 Server to Samba-3
- xinetd, Process Startup Configuration
- XML, Dissection and Discussion
- xmlsam, Implementation
Y
- YaST, PAM and NSS Client Configuration
- Yellow Pages, Identity Management Needs
- yellow pages (see NIS)
Index diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/kerberos.html samba-3.0.14a/docs/htmldocs/Samba-Guide/kerberos.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/kerberos.html 2005-03-23 10:19:22.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/kerberos.html 2005-04-11 11:18:49.000000000 -0500 @@ -1,10 +1,10 @@ -Symbols
- %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
- %USERNAME%, Roaming Profile Background, Profile Changes
- %USERPROFILE%, Configuration of Default Profile with Folder Redirection
- /data/ldap, OpenLDAP Server Configuration
- /etc/cups/mime.convs, Implementation, Implementation
- /etc/cups/mime.types, Implementation, Implementation
- /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
- /etc/exports, Samba-3 PDC Configuration
- /etc/group, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, Removal of Pre-existing Conflicting RPMs
- /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
- /etc/krb5.conf, Kerberos Configuration
- /etc/ldap.conf, PAM and NSS Client Configuration, LDAP Server Configuration
- /etc/mime.convs, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- /etc/mime.types, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- /etc/named.conf, Configuration of DHCP and DNS Servers
- /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
- /etc/openldap/slapd.conf, OpenLDAP Server Configuration, Implementation
- /etc/passwd, Findings and Comments, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Questions and Answers, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
- /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
- /etc/rc.d/rc.local, Implementation
- /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation All Servers
- /etc/samba, Samba System File Location
- /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
- /etc/samba/smbusers, Server Preparation All Servers
- /etc/shadow, Technical Issues
- /etc/squid/squid.conf, Removal of Pre-existing Conflicting RPMs
- /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
- /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
- /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
- /usr/bin, Samba System File Location
- /usr/lib/samba, Samba System File Location
- /usr/local, Samba System File Location
- /usr/local/samba, Samba System File Location
- /usr/sbin, Samba System File Location
- /usr/share, Samba System File Location
- /usr/share/samba/swat, Samba System File Location
- /usr/share/swat, Samba System File Location
- /var/lib/samba, Samba System File Location
- /var/log/samba, Samba System File Location
- , Application Share Configuration, Addition of Machines to the Domain
- Domain account, Technical Issues
- liability, Dissection and Discussion
- logon, Implementation
- problem, Dissection and Discussion
- transparent inter-operability, Questions and Answers
A
- abmas-netfw.sh, Basic System Configuration
- abort shutdown script, Samba Configuration, Implementation, Implementation
- accept, Printer Configuration
- accepts liability, Dissection and Discussion
- access, Technical Issues, Check-point Controls
- access control, Kerberos Exposed, Using the MMC Computer Management Interface
- Access Control Lists (see ACLs)
- access control settings, Share Access Controls
- access controls, Technical Issues, Share Definition Controls
- accessible, Share Point Directory and File Permissions
- account, Regarding LDAP Directories and Windows Computer Accounts, Share Access Controls
- ADS Domain, Technical Issues
- account credentials, Findings and Comments
- account information, Questions and Answers
- account names, Questions and Answers
- account policies, The LDAP Account Manager
- accountable, Introduction, Dissection and Discussion
- accounts
- authoritative, Technical Issues
- Domain, Introduction, Questions and Answers
- group, Introduction, Questions and Answers, Introduction
- machine, Introduction, Questions and Answers
- manage, The LDAP Account Manager
- user, Introduction, Questions and Answers, Introduction
- ACL, Questions and Answers, Check-point Controls
- ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
- acquisitions, Introduction
- Act!, Shared Data Integrity
- ACT! database, Act! Database Sharing
- Act!Diag, Act! Database Sharing
- Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
- authentication, Squid Configuration
- domain, Samba Configuration
- join, Active Directory Domain with Samba Domain Member Server
- management tools, Technical Issues
- realm, Bad Hostnames
- Replacement, Technical Issues
- server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
- Server, Technical Issues
- tree, Samba Configuration
- AD printer publishing, Uploading Printer Drivers to Samba Servers
- ADAM, Dissection and Discussion
- add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- Add Printer Wizard
- add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- administrative installation, Application Share Configuration
- administrative rights, Check-point Controls
- administrator, Implementation, Samba Configuration, Server Preparation All Servers
- ADS, Technical Issues, Kerberos Configuration, Bad Hostnames
- server, Technical Issues
- ADS Domain, Technical Issues
- affordability, The Nature of Windows Networking Protocols
- alarm, Introduction
- algorithm, Technical Issues
- alternative, Dissection and Discussion
- analysis, Technical Issues
- anonymous connection, Validation, Validation
- Apache Web server, Questions and Answers
- appliance mode, Technical Issues
- application server, Technical Issues, Application Share Configuration
- application servers, The Nature of Windows Networking Protocols
- application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- APW, Uploading Printer Drivers to Samba Servers
- arp, Validation
- assessment, Introduction
- assumptions, Key Points Learned
- authconfig, PAM and NSS Client Configuration
- authenticate, LDAP Server Configuration, Samba Configuration
- authenticated, Assignment Tasks
- authenticated connection, Validation, Validation
- authentication, The Nature of Windows Networking Protocols, Dissection and Discussion, Questions and Answers, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
- plain-text, Questions and Answers
- authentication process, Implementation
- authentication protocols, Key Points Learned
- authoritative, Technical Issues
- authorized location, Kerberos Exposed
- auto-generated SID, Questions and Answers
- automatically allocate, Technical Issues
- availability, Performance, Reliability, and Availability
B
- backends, Integrating Additional Services
- background communication, Questions and Answers
- Backup, Introduction
- Backup Domain Controller (see BDC)
- bandwidth, Assignment Tasks
- requirements, User Needs
- bandwidth calculations, Hardware Requirements
- BDC, Technical Issues, Making Happy Users, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
- benefit, Questions and Answers, Dissection and Discussion
- best practices, Introduction
- bias, Questions and Answers
- binary database, Implementation
- bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- broadcast, Questions and Answers, Routed Networks
- broadcast messages, Implementation
- broadcast storms, Network Collisions
- broken, Dissection and Discussion
- broken behavior, Dissection and Discussion
- browse, Technical Issues
- browse master, Findings
- Browse Master, Questions and Answers
- browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- Browser Election Service, Questions and Answers
- browsing, Assignment Tasks, Technical Issues, Technical Issues
- budgetted, Introduction
- bug fixes, Introduction
C
- cache, Opportunistic Locking Controls
- cache directories, Removal of Pre-existing Conflicting RPMs
- caching, Samba Configuration
- case-sensitive, Kerberos Configuration
- centralized storage, Questions and Answers
- check samba + daemons, Validation, Validation
- check-point, Share Definition Controls
- Check-point Controls, Check-point Controls
- check-point controls, Check-point Controls
- chgrp, Samba Configuration
- chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
- chmod, Samba Configuration
- choice, Dissection and Discussion, Technical Issues
- chown, Removal of Pre-existing Conflicting RPMs
- CIFS, Findings
- cifsfs, Dissection and Discussion
- clean database, Questions and Answers
- Clock skew, Kerberos Configuration
- cluster, Introduction
- clustering, Introduction, For Scalability, Use SAN Based Storage on Samba Servers
- collision rates, Network Collisions
- comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- commercial, Dissection and Discussion
- commercial software, Dissection and Discussion
- Common Internet File System (see CIFS)
- comparison
- Active Directory & OpenLDAP, Dissection and Discussion
- compat, Samba Domain with Samba Domain Member Server Using LDAP
- compatible, Technical Issues
- complexities, Dissection and Discussion
- compromise, Introduction, Introduction, Technical Issues
- computer account, Samba Configuration
- Computer Management, Share Access Controls, Questions and Answers
- condemns, Technical Issues
- conferences, Technical Issues
- connection, Share Access Controls
- connectivity, Questions and Answers
- consequential risk, Technical Issues
- consultant, Drafting Office, Introduction, Dissection and Discussion
- consumer, Dissection and Discussion, Technical Issues
- contiguous directory, Implementation
- copy, LDAP Server Configuration, Questions and Answers
- corrective action, Hardware Problems
- cost, Dissection and Discussion
- Courier-IMAP, LDAP Server Configuration
- create mask, LDAP Server Configuration
- credential, Share Definition Controls
- credentials, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Technical Issues
- crippled, Dissection and Discussion
- criticism, Active Directory, Kerberos, and Security, Introduction
- Critics, Technical Issues
- Cryptographic, Technical Issues
- CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
- cupsd, Basic System Configuration
D
- daemon, Validation, Basic System Configuration, Technical Issues, Questions and Answers, Starting Samba
- daemon control, Process Startup Configuration
- data
- corruption, Making Happy Users
- integrity, Questions and Answers
- data corruption, Hardware Problems, Act! Database Sharing
- data integrity, Hardware Problems, Shared Data Integrity
- data storage, Implementation
- database, Dissection and Discussion, Questions and Answers, Dissection and Discussion
- database applications, Shared Data Integrity
- DB_CONFIG, OpenLDAP Server Configuration
- DCE, Kerberos Exposed
- DDNS (see dynamic + DNS)
- Debian, Migrating NetWare 4.11 Server to Samba-3
- default devmode, Samba Configuration, Implementation
- default installation, Samba System File Location
- default password, The LDAP Account Manager
- default profile, Assignment Tasks, Technical Issues
- Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
- defective
- cables, Hardware Problems
- hubs, Hardware Problems
- switches, Hardware Problems
- defects, Technical Issues
- defensible standards, Technical Issues
- defragmentation, Windows Client Configuration
- delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
- delete user from group script, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
- delimiter, Check-point Controls
- dependability, Technical Issues
- desired security setting, Setting Posix ACLs in UNIX/Linux
- development, Technical Issues
- DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
- client, Bad Hostnames
- relay, Technical Issues
- Relay Agent, Questions and Answers
- request, Questions and Answers
- requests, Technical Issues
- servers, Questions and Answers
- traffic, Questions and Answers
- dhcp client validation, Validation, Validation
- DHCP Server, Implementation
- DHCP server, Technical Issues
- diffusion, Technical Issues
- digital rights, Technical Issues
- digital sign'n'seal, Technical Issues
- digits, Bad Hostnames
- diligence, Technical Issues
- directory, Dissection and Discussion, Political Issues
- Computers container, LDAP Initialization and Creation of User and Group Accounts
- management, Dissection and Discussion
- People container, LDAP Initialization and Creation of User and Group Accounts
- replication, Dissection and Discussion
- schema, Dissection and Discussion
- server, Technical Issues
- synchronization, Dissection and Discussion
- directory mask, LDAP Server Configuration
- directory tree, Setting Posix ACLs in UNIX/Linux
- disable, Introduction
- disable spoolss, Implementation, Implementation
- disaster recovery, Introduction
- disk image, Assignment Tasks
- disruptive, Dissection and Discussion
- distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
- distributed domain, Identity Management Needs
- DMB, Questions and Answers
- DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, LDAP Server Configuration, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
- configuration, Questions and Answers
- Dynamic, Questions and Answers
- dynamic, Joining a Domain: Windows 200x/XP Professional
- lookup, Questions and Answers, Kerberos Configuration
- name lookup, Bad Hostnames
- SRV records, Kerberos Configuration
- suffix, Joining a Domain: Windows 200x/XP Professional
- DNS server, Implementation, Configuration of DHCP and DNS Servers
- document the settings, Samba Configuration
- documentation, Dissection and Discussion, Technical Issues
- documented, Samba Configuration
- Domain, Technical Issues, Questions and Answers
- group, Questions and Answers
- groups, Technical Issues
- user, Questions and Answers
- domain
- Active Directory, Technical Issues
- joining, Appendix: A Collection of Useful Tid-bits
- trusted, Questions and Answers
- Domain accounts, Technical Issues
- Domain Administrator, Share Access Controls
- Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
- Domain Controllers, Technical Issues, Questions and Answers
- Domain Groups
- well-known, Initialization of the LDAP Database
- Domain join, Samba Domain with Samba Domain Member Server Using LDAP
- domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- Domain logons, Questions and Answers
- domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
- Domain Master Browser (see DMB)
- Domain Member, Use and Location of BDCs
- authoritative
- local accounts, Technical Issues
- client, Implementation
- desktop, Introduction
- server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
- servers, Technical Issues, Questions and Answers, Check-point Controls
- workstations, Implementation
- Domain Member server, Technical Issues, Questions and Answers
- Domain Member servers, Questions and Answers
- domain members, Questions and Answers
- domain name space, Identity Management Needs
- domain replication, Questions and Answers
- Domain SID, Technical Issues, NT4 Migration Using LDAP Backend, Questions and Answers
- domain tree, Identity Management Needs
- Domain User Manager, Configuring Profile Directories
- Domain users, Technical Issues
- dos2unix, Samba Configuration
- drive letters, LDAP Server Configuration
- drive mapping, Technical Issues
- dumb printing, Installation of Printer Driver Auto-Download
- dump, Technical Issues, Questions and Answers
- duplicate accounts, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- dynamic DNS, Technical Issues
E
- e-Directory, Dissection and Discussion
- economically sustainable, Dissection and Discussion
- eDirectory, Dissection and Discussion
- education, Identity Management Needs
- election, Findings
- employment, Introduction, Dissection and Discussion
- enable, Printer Configuration
- enable privileges, Samba-3 PDC Configuration, Samba-3 BDC Configuration
- encrypt passwords, Questions and Answers, NSS Configuration
- encrypted, Findings and Comments
- encrypted password, Windows 200x/XP Client Interaction with Samba-3
- encrypted passwords, Questions and Answers
- End User License Agreement (see EULA)
- enumerating, Samba Configuration
- essential, Introduction
- ether-switch, Technical Issues
- Ethereal, Requirements and Notes
- ethereal, Exercises
- Etherswitch, Making Happy Users
- EULA, Dissection and Discussion
- Everyone, Share Access Controls
- Excel, Share Point Directory and File Permissions
- exclusive open, Microsoft Access
- experiment, Active Directory, Kerberos, and Security
- export, Technical Issues
- extent, Dissection and Discussion
- External Domains, Technical Issues
- extreme demand, Guidelines for Reliable Samba Operation
F
- fail, The Nature of Windows Networking Protocols
- fail-over, Identity Management Needs, Implementation
- failed join, Active Directory Domain with Samba Domain Member Server
- failure, Questions and Answers, Samba Configuration
- familiar, Technical Issues
- fatal problem, Samba Configuration
- fear, Technical Issues
- fears, Technical Issues
- Fedora, Drafting Office
- FHS, Samba System File Location
- file and print server, Questions and Answers
- file and print service, Dissection and Discussion
- file cacheing, Opportunistic Locking Controls
- file caching, Samba Configuration
- File Hierarchy System (see FHS)
- file locations, Samba System File Location
- file permissions, The LDAP Account Manager
- file server
- read-only, Dissection and Discussion
- file servers, Samba Server Implementation
- file system, Technical Issues
- access control, Samba Configuration
- Ext3, Implementation
- permissions, Samba Configuration, Configuration for Server: MASSIVE
- file system security, Questions and Answers
- filter, Share Access Controls
- financial responsibility, Introduction
- firewall, Technical Issues, Basic System Configuration, Introduction
- fix, Dissection and Discussion
- flaws, Introduction
- flexibility, Technical Issues
- FLOSS (see Free-Libre/Open Source Software)
- flush
- cache memory, Opportunistic Locking Controls
- folder redirection, Technical Issues, Configuration of Default Profile with Folder Redirection, Questions and Answers
- force group, Implementation, LDAP Server Configuration, Override Controls, Questions and Answers
- force printername, LDAP Server Configuration
- force user, Dissection and Discussion, Implementation, Override Controls, Questions and Answers
- forced settings, Override Controls
- foreign, Samba Domain with Samba Domain Member Server Using LDAP
- foreign SID, Samba Domain with Samba Domain Member Server Using LDAP
- forwarded, Routed Networks
- foundation members, Technical Issues
- Free Standards Grou (see FSG)
- Free-Libre/Open Source Software, Migrating NetWare 4.11 Server to Samba-3
- front-end, Dissection and Discussion
- FSG, Samba System File Location
- FTP
- proxy, Questions and Answers
- full control, Share Access Controls, Using MS Windows Explorer (File Manager)
- fully qualified, Check-point Controls
G
- Gentoo, Migrating NetWare 4.11 Server to Samba-3
- getent, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- getfacl, Setting Posix ACLs in UNIX/Linux
- getgrgid(), Questions and Answers
- getgrnam, Technical Issues
- getpwnam, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- getpwnam(), Questions and Answers
- GID, Implementation, Questions and Answers, Questions and Answers
- Goettingen, Questions and Answers
- government, Identity Management Needs
- GPL, Comments Regarding Software Terms of Use
- group account, Implementation, OpenLDAP Server Configuration
- group management, Implementation
- group mapping, LDAP Server Configuration
- group membership, Implementation, Samba Configuration, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
- group names, Questions and Answers
- group policies, Introduction
- Group Policy, Joining a Domain: Windows 200x/XP Professional
- Group Policy editor, The Local Group Policy
- Group Policy Objects, The Local Group Policy
- groupadd, Implementation, Implementation, Questions and Answers
- groupdel, Questions and Answers
- groupmod, Questions and Answers
- GSS-API, Windows 200x/XP Client Interaction with Samba-3
- guest account, Findings and Comments, Dissection and Discussion, Technical Issues, Questions and Answers
- guest ok, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
H
- hackers, Introduction
- hardware prices, Hardware Problems
- hardware problems, Hardware Problems
- Heimdal, Implementation, Kerberos Configuration
- Heimdal Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- helper agent, Removal of Pre-existing Conflicting RPMs
- hesoid, Samba Domain with Samba Domain Member Server Using LDAP
- hide files, LDAP Server Configuration
- hierarchy of control, Share Definition Controls
- high availability, Dissection and Discussion
- hire, Dissection and Discussion
- HKEY_CURRENT_USER, Roaming Profile Background
- HKEY_LOCAL_MACHINE, Configuration of Default Profile with Folder Redirection
- HKEY_LOCAL_USER, Questions and Answers
- host announcement, Assignment Tasks, Findings
- hostname, Basic System Configuration
- hosts, Questions and Answers
- hosts allow, Samba Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- hosts deny, Samba Configuration, Implementation
- HUB, Making Happy Users
- Hybrid, Questions and Answers
- hypothetical, Introduction
I
- Idealx
- identifiers, Technical Issues
- identity, Questions and Answers, Kerberos Exposed
- management, Technical Issues
- identity management, Technical Issues, Dissection and Discussion, Dissection and Discussion, Political Issues
- Identity Management, Dissection and Discussion, The Nature of Windows Networking Protocols, Identity Management Needs
- Identity management, UNIX/Linux Client Domain Member
- Identity resolution, Samba Domain with Samba Domain Member Server Using LDAP, Active Directory Domain with Samba Domain Member Server, UNIX/Linux Client Domain Member, Questions and Answers
- Identity resolver, Questions and Answers
- IDMAP, Samba Domain with Samba Domain Member Server Using LDAP
- idmap backend, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- IDMAP backend, Questions and Answers
- idmap gid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- idmap uid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- IMAP, Technical Issues
- import, Technical Issues
- include, Implementation
- income, Dissection and Discussion
- independent expert, Introduction
- inetd, Process Startup Configuration
- inetOrgPerson, Technical Issues
- inheritance, Setting Posix ACLs in UNIX/Linux
- initGrps.sh, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- initial credentials, Kerberos Configuration
- inoperative, Dissection and Discussion
- installation, Dissection and Discussion
- integrate, Technical Issues
- integrity, Introduction, Kerberos Exposed
- inter-operability, Dissection and Discussion, Technical Issues, Key Points Learned, Questions and Answers
- interdomain trusts, Identity Management Needs
- interfaces, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- intermittent, Hardware Problems
- Internet Explorer, Technical Issues
- Internet Information Server, Questions and Answers
- interoperability, Dissection and Discussion
- IP forwarding, Implementation, Basic System Configuration, Configuration for Server: MASSIVE
- IPC$, Findings and Comments, Implementation
- iptables, Technical Issues
- isolated, Introduction
- Italian, Questions and Answers
J
- jobs, Introduction
- joining a domain, Joining a Domain: Windows 200x/XP Professional
K
- KDC, Kerberos Configuration
- Kerberos, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Key Points Learned, Technical Issues, Implementation, Kerberos Configuration
- Heimdal, Active Directory Domain with Samba Domain Member Server
- interoperability, Kerberos Exposed
- libraries, Active Directory Domain with Samba Domain Member Server
- MIT, Active Directory Domain with Samba Domain Member Server
- unspecified fields, Kerberos Exposed
- kerberos, Kerberos Exposed
- server, Kerberos Exposed
- Kerberos ticket, Samba Configuration
- kinit, Kerberos Configuration
- Kixtart, LDAP Server Configuration
- klist, Kerberos Configuration
- krb5, Implementation
- krb5.conf, Kerberos Configuration
L
- LAM, The LDAP Account Manager
- configuration editor, The LDAP Account Manager
- configuration file, The LDAP Account Manager
- login screen, The LDAP Account Manager
- opening screen, The LDAP Account Manager
- profile, The LDAP Account Manager
- wizard, The LDAP Account Manager
- LDAP, Technical Issues, Assignment Tasks, Dissection and Discussion, Technical Issues, PAM and NSS Client Configuration, Introduction, Dissection and Discussion, Identity Management Needs, Implementation, Key Points Learned, Questions and Answers, Assignment Tasks, Technical Issues, Questions and Answers, Dissection and Discussion, LDAP Server Configuration, Technical Issues, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Technical Issues
- backend, Identity Management Needs
- database, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Alternative LDAP Database Initialization
- directory, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs
- fail-over, Implementation
- initial configuration, Alternative LDAP Database Initialization
- master, Identity Management Needs
- master/slave
- background communication, Questions and Answers
- preload, Implementation
- secure, Technical Issues
- server, Questions and Answers
- slave, Identity Management Needs
- updates, Identity Management Needs
- ldap, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP Account Manager (see LAM)
- ldap admin dn, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP backend, Technical Issues
- LDAP database, Questions and Answers
- ldap group suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap idmap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP Interchange Format (see LDIF)
- ldap machine suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap passwd sync, LDAP Server Configuration
- LDAP server, Identity Management Needs
- ldap ssl, LDAP Server Configuration, Active Directory Domain with Samba Domain Member Server
- ldap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- ldap user suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- LDAP-transfer-LDIF.txt, Implementation
- ldap.conf, Samba Domain with Samba Domain Member Server Using LDAP
- ldapadd, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
- ldapsam, LDAP Initialization and Creation of User and Group Accounts, Dissection and Discussion, Assignment Tasks, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Integrating Additional Services
- ldapsam backend, Samba Domain with Samba Domain Member Server Using LDAP
- ldapsearch, LDAP Initialization and Creation of User and Group Accounts
- LDIF, Technical Issues, Implementation, Technical Issues, LDAP Server Configuration, Initialization of the LDAP Database
- leadership, Technical Issues
- Lightweight Directory Access Protocol (see LDAP)
- limit, Questions and Answers
- Linux desktop, Introduction
- Linux Standards Base (see LSB)
- LMB, Findings, Questions and Answers
- LMHOSTS, Routed Networks
- load distribution, For Scalability, Use SAN Based Storage on Samba Servers
- local accounts, Technical Issues
- Local Group Policy, Roaming Profile Background
- local groups, Questions and Answers
- Local Master Announcement, Findings
- Local Master Browser (see LMB)
- local users, Questions and Answers
- localhost, Basic System Configuration, Bad Hostnames
- locking, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
- Application level, Shared Data Integrity
- Client side, Shared Data Integrity
- Server side, Shared Data Integrity
- log file, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- log level, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- logging, Removal of Pre-existing Conflicting RPMs
- login, Technical Issues
- logon credentials, Questions and Answers
- logon drive, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- logon home, Samba Configuration, Implementation, LDAP Server Configuration
- logon hours, Technical Issues, Key Points Learned
- logon machines, Technical Issues
- logon path, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- logon process, Implementation
- logon scrip, Samba Configuration, Technical Issues
- logon script, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Preparation of Logon Scripts, Implementation, Technical Issues, LDAP Server Configuration
- logon server, The Nature of Windows Networking Protocols
- logon services, Implementation
- logon time, Assignment Tasks
- logon traffic, The Nature of Windows Networking Protocols
- logon.kix, LDAP Server Configuration
- loopback, Validation
- low performance, Hardware Problems
- lower-case, Technical Issues
- lpadmin, Implementation, Implementation, Implementation, Printer Configuration, Printer Configuration
- LSB, Samba System File Location
M
- machine account, Regarding LDAP Directories and Windows Computer Accounts
- machine accounts, Questions and Answers
- machine secret password, Technical Issues
- managed, Technical Issues
- management, Political Issues, Questions and Answers
- group, Technical Issues
- User, Technical Issues
- mandatory profile, Technical Issues, Configuring Profile Directories
- Mandrake, Migrating NetWare 4.11 Server to Samba-3
- map acl inherit, Samba Configuration, Implementation, Samba-3 PDC Configuration
- mapped drives, Questions and Answers
- mapping, Technical Issues, Kerberos Configuration
- Mars_NWE, Migrating NetWare 4.11 Server to Samba-3
- master, Dissection and Discussion
- material, Appendix: A Collection of Useful Tid-bits
- max log size, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- memberUID, LDAP Server Configuration
- memory requirements, Hardware Requirements
- merge, Technical Issues, Questions and Answers
- merged, Technical Issues
- meta-directory, Questions and Answers
- meta-service, Questions and Answers
- Microsoft Access, Shared Data Integrity
- Microsoft Excel, Shared Data Integrity
- Microsoft ISA, Assignment Tasks
- Microsoft Management Console (see MMC)
- Microsoft Office, Application Share Configuration, Share Point Directory and File Permissions
- Microsoft Outlook
- PST files, Questions and Answers
- migrate, Technical Issues
- migration, Implementation, Implementation, Assignment Tasks, Introduction, Questions and Answers, Migrating NetWare 4.11 Server to Samba-3
- objectives, Dissection and Discussion
- Migration speed, Questions and Answers
- mime type, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- mime types, Implementation
- missing RPC's, Technical Issues
- MIT, Implementation, Kerberos Configuration
- MIT Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- MIT KRB5, Samba Configuration
- mixed mode, Active Directory Domain with Samba Domain Member Server
- mixed-mode, Questions and Answers
- MMC, Configure Delete Cached Profiles on Logout, Technical Issues, Questions and Answers
- mobile computing, Dissection and Discussion
- mobility, Technical Issues
- modularization, Technical Issues
- modules, Questions and Answers
- MS Access
- validate, Microsoft Access
- MS Outlook
- PST file, Making Happy Users
- MS Windows Server 2003, Implementation
- MS Word, Share Point Directory and File Permissions
- MSDFS, Distribute Network Load with MSDFS
- multi-subnet, Routed Networks
- multi-user
- access, Microsoft Access
- data access, Shared Data Integrity
- multiple directories, Identity Management Needs
- multiple domain controllers, Making Happy Users
- multiple group mappings, Questions and Answers
- My Documents, Roaming Profile Background
- My Network Places, Implementation
- mysqlsam, Implementation
N
- name resolution, Assignment Tasks, Configuration of DHCP and DNS Servers, Questions and Answers
- name resolve order, Questions and Answers, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Name Service Switch, Implementation
- name service switch (see NSS)
- named, Basic System Configuration, Validation, Server Preparation All Servers
- NAT, Technical Issues
- native, Questions and Answers
- net
- ads
- getlocalsid, Samba-3 PDC Configuration
- group, NT4 Migration Using tdbsam Backend
- groupmap
- rpc
- getsid, NT4 Migration Using LDAP Backend
- join, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers
- vampire, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
- NetBIOS, Questions and Answers, The Nature of Windows Networking Protocols, Questions and Answers, Bad Hostnames, Routed Networks
- name cache, Questions and Answers
- name resolution
- delays, Making Happy Users
- Node Type, Questions and Answers
- netbios forwarding, Network Collisions
- netbios name, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, NSS Configuration, Bad Hostnames
- NetBIOS name, Kerberos Configuration
- aliases, Identity Management Needs
- NETLOGON, Using a Network Default User Profile, Windows Client Configuration
- netlogon, The Nature of Windows Networking Protocols, LDAP Server Configuration
- Netlogon, Joining a Domain: Windows 200x/XP Professional
- netmask, Implementation
- Netware, Small Office Networking
- NetWare, Migrating NetWare 4.11 Server to Samba-3, LDAP Server Configuration
- network
- administrators, Technical Issues
- analyzer, Assignment Tasks
- bandwidth, Identity Management Needs, Questions and Answers
- broadcast, Introduction
- captures, Requirements and Notes
- collisions, Network Collisions
- load, Network Collisions
- logon, Making Happy Users
- logon scripts, Dissection and Discussion
- management, Introduction
- multi-segment, Introduction
- overload, Making Happy Users
- performance, Samba Configuration
- routed, Dissection and Discussion
- secure, Introduction
- segment, Dissection and Discussion
- services, Questions and Answers
- sniffer, Requirements and Notes
- tiemouts, Network Collisions
- timeout, Making Happy Users
- trace, Assignment Tasks
- traffic
- observation, Technical Issues
- wide-area, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Network Address Translation (see NAT)
- network administrators, Technical Issues
- network attached storage (see NAS)
- network bandwidth
- utilization, Making Happy Users
- Network Default Profile, Roaming Profile Background
- network hardware
- defective, Making Happy Users
- network hygiene, Dissection and Discussion
- network Identities, Questions and Answers
- network load factors, Dissection and Discussion
- Network Neighborhood, Validation, Technical Issues
- network segment, Use and Location of BDCs
- network segments, Hardware Requirements
- network share, Assignment Tasks
- networking hardware
- defective, Making Happy Users
- networking protocols, Technical Issues
- next generation, Technical Issues
- NFS server, Samba-3 PDC Configuration
- NICs, Hardware Problems
- NIS, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Political Issues, Questions and Answers
- nis, Samba Domain with Samba Domain Member Server Using LDAP
- NIS schema, Questions and Answers
- NIS server, Questions and Answers
- NIS+, Identity Management Needs
- nisplus, Samba Domain with Samba Domain Member Server Using LDAP
- NLM, Migrating NetWare 4.11 Server to Samba-3
- nmap, Validation
- nmbd, Validation, Validation, Samba Configuration, Starting Samba
- nobody, Findings and Comments, Removal of Pre-existing Conflicting RPMs
- Novell, Migrating NetWare 4.11 Server to Samba-3, Introduction
- NSS, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, PAM and NSS Client Configuration, LDAP Server Configuration, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, UNIX/Linux Client Domain Member, Questions and Answers, NSS Configuration (see Name Service Switch)
- nss_ldap, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, OpenLDAP Server Configuration, PAM and NSS Client Configuration, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
- nt acl support, Dissection and Discussion, Implementation
- NT4 registry, Dissection and Discussion
- NTLM, Technical Issues
- NTLM authentication daemon, Technical Issues
- NTLMSSP, Windows 200x/XP Client Interaction with Samba-3, Key Points Learned, Questions and Answers
- NTLMSSP_AUTH, Windows 200x/XP Client Interaction with Samba-3
- ntlm_auth, Samba Configuration, Questions and Answers
- NTP, Kerberos Configuration
- NTUSER.DAT, Roaming Profile Background, Profile Changes, Using a Network Default User Profile, Questions and Answers
- NULL connection, Validation
- NULL session, Findings and Comments
- NULL-Session, Discussion
O
- objectClass, LDAP Server Configuration
- off-site storage, Introduction
- Open Magazine, Adding Domain Member Servers and Clients
- Open Source, Dissection and Discussion
- OpenLDAP, Dissection and Discussion, Dissection and Discussion, Questions and Answers, Technical Issues, Political Issues, Introduction, Technical Issues, Key Points Learned, The LDAP Account Manager
- openldap, OpenLDAP Server Configuration
- OpenOffice, Application Share Configuration
- operating profiles, The LDAP Account Manager
- oplock break, Override Controls
- oplocks, Samba Configuration
- Oplocks
- disabled, Opportunistic Locking Controls
- opportunistic
- locking, Override Controls
- opportunistic locking, Implementation, Samba Configuration, Act! Database Sharing
- optimized, Samba Configuration
- options list, Questions and Answers
- organizational units, The LDAP Account Manager
- os level, Implementation
- Outlook
- Outlook Express, Political Issues
- over-ride, Technical Issues
- over-ride controls, Override Controls
- over-rule, Share Access Controls, Using MS Windows Explorer (File Manager)
- overheads, Override Controls
- ownership, Share Point Directory and File Permissions
P
- package, Implementation
- package names, Samba System File Location
- PADL, Technical Issues
- PADL LDAP tools, Technical Issues
- PADL Software, Samba Domain with Samba Domain Member Server Using LDAP
- PAM, PAM and NSS Client Configuration, LDAP Server Configuration, UNIX/Linux Client Domain Member
- pam password change, Samba Configuration, LDAP Server Configuration
- pam_ldap, OpenLDAP Server Configuration
- pam_ldap.so, PAM and NSS Client Configuration
- pam_unix2.so, PAM and NSS Client Configuration
- use_ldap, PAM and NSS Client Configuration
- passdb backend, Implementation, Samba Configuration, The 500-User Office, Implementation, Dissection and Discussion, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Assignment Tasks, Questions and Answers, LDAP Server Configuration, Technical Issues, Questions and Answers
- passdb.tdb, Technical Issues
- passwd, Implementation, Implementation, Samba Configuration
- passwd chat, Implementation, Samba Configuration
- password
- password caching, Implementation
- password change, Key Points Learned
- password length, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
- password server, NSS Configuration
- path, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- payroll, Introduction
- pdbedit, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, NT4 Migration Using tdbsam Backend, Questions and Answers
- PDC, Assignment Tasks, Technical Issues, Making Happy Users, Technical Issues, The Local Group Policy, The Nature of Windows Networking Protocols, Technical Issues, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
- PDC/BDC ratio, Making Happy Users
- PDF, The LDAP Account Manager
- performance, Dissection and Discussion, Questions and Answers, Performance, Reliability, and Availability, Introduction, Network Collisions
- performance degradation, Override Controls, Samba Configuration
- Perl, LDAP Server Configuration, The LDAP Account Manager
- permission, Share Point Directory and File Permissions
- permissions, Implementation, Technical Issues, Share Access Controls, Check-point Controls, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
- Permissions, Using the MMC Computer Management Interface
- permits, Technical Issues
- permitted group, Using the MMC Computer Management Interface
- PHP, The LDAP Account Manager
- PHP4, The LDAP Account Manager
- pile-driver, Share Definition Controls
- ping, Validation, NT4 Migration Using LDAP Backend
- pitfalls, The LDAP Account Manager
- plain-text, Questions and Answers
- Pluggable Authentication Modules (see PAM)
- policy, Questions and Answers, Introduction
- poor performance, Dissection and Discussion
- POP3, Technical Issues
- Posix, Dissection and Discussion, Technical Issues, Technical Issues, Questions and Answers, Questions and Answers, The LDAP Account Manager
- POSIX, Regarding LDAP Directories and Windows Computer Accounts, LDAP Server Configuration
- Posix accounts, LDAP Initialization and Creation of User and Group Accounts, Technical Issues
- Posix ACLs, Managing Windows 200x ACLs
- PosixAccount, LDAP Initialization and Creation of User and Group Accounts
- posixAccount, LDAP Server Configuration
- Postfix, LDAP Server Configuration
- Postscript, Installation of Printer Driver Auto-Download
- powers, Share Definition Controls
- practices, Introduction
- preferred master, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
- preload.LDIF, NT4 Migration Using LDAP Backend
- presence and leadership, Technical Issues
- price paid, Dissection and Discussion
- primary group, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
- principals, Kerberos Exposed
- print filter, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- print queue, Charity Administration Office, Dissection and Discussion
- print spooler, Charity Administration Office
- Print Test Page, Uploading Printer Drivers to Samba Servers
- printable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- printcap name, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- printer admin, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- printer + validation, Validation, Validation
- printers
- Advanced, Uploading Printer Drivers to Samba Servers
- Default Settings, Uploading Printer Drivers to Samba Servers
- General, Uploading Printer Drivers to Samba Servers
- Properties, Uploading Printer Drivers to Samba Servers
- Security, Uploading Printer Drivers to Samba Servers
- Sharing, Uploading Printer Drivers to Samba Servers
- printing, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- privacy, Identity Management Needs
- Privilege Attribute Certificates (see PAC)
- privilege controls, Share Point Directory and File Permissions
- privileged pipe, Samba Configuration
- privileges, Identity Management Needs, Technical Issues, Share Definition Controls
- product defects, Dissection and Discussion
- profile
- default, Assignment Tasks
- mandatory, The Nature of Windows Networking Protocols
- roaming, Making Happy Users
- profile acls, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- profile path, Technical Issues
- profile share, Implementation
- profiles share, Dissection and Discussion
- programmer, Dissection and Discussion
- project maintainers, Technical Issues
- Properties, Using the MMC Computer Management Interface
- proprietary, Technical Issues
- protected, Technical Issues
- protection, Technical Issues
- protocol
- negotiation, The Nature of Windows Networking Protocols
- protocol analysis, Requirements and Notes
- protocols, Technical Issues
- proxy, Assignment Tasks, Technical Issues
- public specifications, Technical Issues
Q
- Qbasic, LDAP Server Configuration
R
- RAID, Hardware Requirements
- RAID controllers, Hardware Problems
- Raw Print Through, Installation of Printer Driver Auto-Download
- raw printing, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
- Rbase, LDAP Server Configuration
- rcldap, Implementation
- read only, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- realm, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration, NSS Configuration
- recognize, Technical Issues
- record locking, Microsoft Access
- recursively, Setting Posix ACLs in UNIX/Linux
- Red Hat, Drafting Office, Migrating NetWare 4.11 Server to Samba-3
- Red Hat Fedora Linux, Samba Configuration
- Red Hat Linux, Dissection and Discussion, Accounting Office, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Samba Configuration
- redirected folders, Roaming Profile Background, The Nature of Windows Networking Protocols
- refereed standards, Technical Issues
- regedit, Implementation
- regedt32, Profile Changes, Configuration of Default Profile with Folder Redirection
- registry, Questions and Answers
- keys
- SAM, Dissection and Discussion
- SECURITY, Dissection and Discussion
- registry change, Questions and Answers
- Registry Editor, Configuration of Default Profile with Folder Redirection
- registry hacks, Questions and Answers
- registry keys, Configuration of Default Profile with Folder Redirection
- reimburse, Dissection and Discussion
- rejected, Share Access Controls
- rejoin, Questions and Answers
- reliability, Performance, Reliability, and Availability
- remote announce, Routed Networks
- remote browse sync, Routed Networks
- remote procedure call (see RPC)
- replicate, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- replicated, Dissection and Discussion
- resilient, Guidelines for Reliable Samba Operation
- resolve, Technical Issues, Bad Hostnames
- responsibility, Dissection and Discussion
- responsible, Technical Issues
- restricted export, Kerberos Exposed
- Restrictive security, Active Directory Domain with Samba Domain Member Server
- reverse DNS, Kerberos Configuration
- RID, LDAP Server Configuration
- risk, Technical Issues, Questions and Answers, Questions and Answers, Introduction
- road-map, Technical Issues
- published, Technical Issues
- roaming profile, Technical Issues, Roaming Profile Background, Configuring Profile Directories, User Needs, Questions and Answers
- roaming profiles, Technical Issues, Implementation, Roaming Profile Background
- routed network, Use and Location of BDCs
- router, Implementation
- routers, Questions and Answers, Routed Networks
- RPC, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
- RPM, Dissection and Discussion
- install, Implementation
- rpm, Removal of Pre-existing Conflicting RPMs, Samba System File Location
- RPMs, Samba Configuration
- rpms, Removal of Pre-existing Conflicting RPMs
- rsync, Samba-3 PDC Configuration, LDAP Server Configuration, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- rsyncd.conf, LDAP Server Configuration
- run-time control files, Samba System File Location
S
- safe-guards, Technical Issues
- SAM, Dissection and Discussion
- samba, Removal of Pre-existing Conflicting RPMs
- starting samba, Implementation
- Samba, Samba Configuration
- Samba accounts, Technical Issues
- samba cluster, Introduction
- samba control script, Starting Samba
- Samba Domain, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Samba Domain server, Using the MMC Computer Management Interface
- Samba RPM Packages, Samba-3 PDC Configuration
- Samba Tea, Samba Configuration
- sambaGroupMapping, LDAP Server Configuration
- SambaSAMAccount, Regarding LDAP Directories and Windows Computer Accounts
- SambaSamAccount, LDAP Initialization and Creation of User and Group Accounts
- sambaSamAccount, LDAP Server Configuration
- SambaXP conference, Questions and Answers
- SAN, For Scalability, Use SAN Based Storage on Samba Servers
- scalability, Introduction
- scalable, Identity Management Needs
- schannel, Technical Issues, Key Points Learned, Questions and Answers
- schema, Questions and Answers
- scripts, The LDAP Account Manager
- secondary group, Samba Domain with Samba Domain Member Server Using LDAP
- secret, Kerberos Exposed
- secrets.tdb, Technical Issues, Samba-3 PDC Configuration, NT4 Migration Using LDAP Backend
- secure, Introduction
- secure account password, Questions and Answers
- secure connections, The LDAP Account Manager
- secure networking, Technical Issues
- secure networking protocols, Technical Issues
- security, Implementation, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Share Point Directory and File Permissions, Questions and Answers, NSS Configuration
- share mode, Dissection and Discussion
- user mode, Dissection and Discussion
- Security, Technical Issues, Using the MMC Computer Management Interface
- Security Account Manager (see SAM)
- security controls, Technical Issues
- security descriptors, Dissection and Discussion
- security fixes, Technical Issues
- security updates, Technical Issues
- SerNet, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- server string, LDAP Server Configuration, Active Directory Domain with Samba Domain Member Server
- service, Implementation
- Service Packs, Application Share Configuration
- services, Key Points Learned
- session setup, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
- Session Setup, Simple Windows Client Connection Characteristics
- set primary group script, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- setfacl, Setting Posix ACLs in UNIX/Linux
- severely degrade, Samba Configuration
- SGID, Dissection and Discussion, Share Point Directory and File Permissions, Effect of Setting File and Directory SUID/SGID Permissions Explained
- shadow-utils, Questions and Answers
- share, Questions and Answers
- Share Access Controls, Share Access Controls
- share ACLs, Questions and Answers
- share definition, Technical Issues
- Share Definition
- Controls, Share Definition Controls
- share definition controls, Share Definition Controls, Check-point Controls, Share Point Directory and File Permissions, Questions and Answers
- share level access controls, Questions and Answers
- share level ACL, Questions and Answers
- Share Permissions, Share Access Controls
- shared resource, Technical Issues, Setting Posix ACLs in UNIX/Linux
- shares, Technical Issues
- show add printer wizard, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
- shutdown script, Samba Configuration, Implementation, Implementation
- SID, Windows Client Configuration, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Initialization of the LDAP Database
- side effects, Managing Windows 200x ACLs
- Sign'n'seal, Key Points Learned, Questions and Answers
- silent return, Active Directory Domain with Samba Domain Member Server
- simple, Dissection and Discussion
- Single Sign-On (see SOS)
- slapadd, NT4 Migration Using LDAP Backend
- slapcat, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP
- slave, Dissection and Discussion
- slow logon, Making Happy Users
- slow network, Hardware Problems
- slurpd, Implementation, Questions and Answers
- smart printing, Dissection and Discussion
- SMB passwords, Implementation
- smb ports, Samba Configuration, Questions and Answers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- SMB/CIFS, Questions and Answers
- smbclient, Validation, Validation, LDAP Initialization and Creation of User and Group Accounts, NT4 Migration Using LDAP Backend, Questions and Answers
- smbd, Validation, Implementation, Validation, Validation, Samba-3 PDC Configuration, Technical Issues, Active Directory Domain with Samba Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
- location of files, Samba System File Location
- smbfs, Dissection and Discussion
- smbldap-groupadd, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
- smbldap-groupmod, LDAP Server Configuration
- smbldap-passwd, LDAP Initialization and Creation of User and Group Accounts
- smbldap-populate, LDAP Initialization and Creation of User and Group Accounts
- smbldap-tools, LDAP Server Configuration, The LDAP Account Manager
- smbldap-useradd, LDAP Initialization and Creation of User and Group Accounts, Implementation
- smbldap-usermod, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
- smbmnt, Dissection and Discussion
- smbmount, Dissection and Discussion
- smbpasswd, Implementation, Technical Issues, Implementation, Technical Issues, Samba Configuration, Server Preparation All Servers, Configuration for Server: MASSIVE, Samba-3 PDC Configuration, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, Questions and Answers, Integrating Additional Services
- smbumnt, Dissection and Discussion
- smbumount, Dissection and Discussion
- SMTP, Technical Issues
- snap-shot, Dissection and Discussion
- socket address, Samba Configuration
- socket options, Samba Configuration
- software, Dissection and Discussion
- solve, Dissection and Discussion
- source code, Dissection and Discussion
- SPNEGO, Windows 200x/XP Client Interaction with Samba-3
- SQL, Dissection and Discussion, Questions and Answers
- Squid, Implementation, Removal of Pre-existing Conflicting RPMs, Samba Configuration, Squid Configuration
- squid, Removal of Pre-existing Conflicting RPMs, Samba Configuration
- Squid proxy, Technical Issues
- SRVTOOLS.EXE, Implementation, Configuring Profile Directories, Questions and Answers, Questions and Answers
- SSL, The LDAP Account Manager
- starting + CUPS, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
- starting dhcpd, Implementation, Process Startup Configuration, Process Startup Configuration
- starting samba, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
- nmbd, Starting Samba
- smbd, Starting Samba
- winbindd, Starting Samba
- startup script, Starting Samba
- sticky bit, Implementation
- storage capacity, Hardware Requirements
- strategic, Technical Issues
- strategy, Questions and Answers
- straw-man, Active Directory, Kerberos, and Security
- strict sync, Samba Configuration
- strong cryptography, Kerberos Exposed
- SUID, Dissection and Discussion, Questions and Answers, Effect of Setting File and Directory SUID/SGID Permissions Explained
- Sun ONE Identity Server, Dissection and Discussion
- super daemon, Process Startup Configuration
- support, Dissection and Discussion
- survey, Adding Domain Member Servers and Clients
- SuSE, Migrating NetWare 4.11 Server to Samba-3
- SUSE Enterprise Linux Server, Charity Administration Office, Basic System Configuration, Implementation
- SUSE Linux, Dissection and Discussion, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Removal of Pre-existing Conflicting RPMs
- SWAT, Samba System File Location
- sync always, Samba Configuration
- synchronization, Kerberos Configuration, For Scalability, Use SAN Based Storage on Samba Servers
- synchronize, User Needs, LDAP Server Configuration
- synchronized, Questions and Answers
- syslog, Implementation, Samba Configuration, Implementation, OpenLDAP Server Configuration, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- system level logins, Questions and Answers
- system security, Technical Issues
T
- tattooing, Questions and Answers
- TCP/IP, Questions and Answers
- tdbdump, NT4 Migration Using LDAP Backend, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- tdbsam, Technical Issues, Implementation, The 500-User Office, Assignment Tasks, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
- template primary group, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- template shell, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- testparm, Validation, Validation, Samba-3 PDC Configuration, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- ticket, Samba Configuration
- time server, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- Tivoli Directory Server, Dissection and Discussion
- TLS, LDAP Server Configuration
- token, Technical Issues
- tool, Questions and Answers, Dissection and Discussion
- track record, Dissection and Discussion
- traffic collisions, Making Happy Users
- transaction processing, Dissection and Discussion
- transactional, Questions and Answers
- transfer, Questions and Answers
- translate, Managing Windows 200x ACLs
- traverse, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- tree, Dissection and Discussion
- Tree Connect, Simple Windows Client Connection Characteristics
- trust account, Regarding LDAP Directories and Windows Computer Accounts
- trusted computing, Introduction
- Trusted Domains, Technical Issues
- trusted domains, Questions and Answers
- trusted third-party, Kerberos Exposed
- trusting, Kerberos Exposed
- turn-around time, Technical Issues
U
- UDP
- broadcast, Routed Networks
- UID, Dissection and Discussion, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, Implementation, Questions and Answers, Questions and Answers
- un-join, Questions and Answers
- unauthorized activities, Kerberos Exposed
- UNC name, Questions and Answers
- unencrypted, The LDAP Account Manager
- Unicast, The Nature of Windows Networking Protocols
- Universal Naming Convention (see UNC name)
- UNIX, LDAP Server Configuration
- groups, Technical Issues, Implementation
- UNIX account, Questions and Answers
- UNIX accounts, Technical Issues
- unix charset, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- unix password sync, Samba Configuration
- UNIX/Linux server, Technical Issues
- unix2dos, Samba Configuration
- unknown, Technical Issues
- updates, Introduction, Technical Issues
- upgrade, LDAP Server Configuration
- uppercase, Technical Issues
- use client driver, Implementation, Implementation, Implementation, Samba Configuration, Implementation, LDAP Server Configuration
- user
- user account, Making Happy Users, OpenLDAP Server Configuration
- User and Group Controls, Technical Issues
- user credentials, Identity Management Needs, UNIX/Linux Client Domain Member
- user errors, Questions and Answers
- user identities, Implementation
- user logins, Questions and Answers
- user management, Implementation
- User Mode, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3, Implementation
- useradd, Implementation, Implementation, Implementation, Samba Configuration, Configuration for Server: MASSIVE
- username map, Implementation, Samba Configuration, Server Preparation All Servers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- utilities, Questions and Answers
- utmp, Samba Configuration, Implementation, Implementation
V
- valid users, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Check-point Controls, Questions and Answers
- validate, NT4 Migration Using LDAP Backend, Questions and Answers, Check-point Controls
- validated, Identity Management Needs, Active Directory Domain with Samba Domain Member Server, Introduction
- validation, Validation, Validation, Questions and Answers
- vampire, Questions and Answers
- vendor, Dissection and Discussion
- veto files, Samba Configuration, Implementation, LDAP Server Configuration
- veto oplock files, Samba Configuration, Implementation
- VFS modules, Samba System File Location
- virus, Implementation
- VPN, Assignment Tasks
- vulnerabilities, Introduction
W
- wbinfo, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Samba Configuration
- weakness, Technical Issues
- web
- caching, Assignment Tasks
- proxying, Assignment Tasks
- Web
- proxy, Questions and Answers
- access, Key Points Learned
- Web browsers, Key Points Learned
- WebClient, Making Happy Users
- white-pages, Technical Issues, LDAP Server Configuration
- wide-area, User Needs, Identity Management Needs, Key Points Learned, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- wide-area network, Use and Location of BDCs, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
- winbind, Implementation, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Introduction, Technical Issues, Technical Issues, Samba Configuration, NSS Configuration
- Winbind, Questions and Answers, Technical Issues, Key Points Learned
- winbind enable local accounts, Technical Issues, Questions and Answers
- winbind enum groups, NSS Configuration
- winbind enum users, NSS Configuration
- winbind separator, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- winbind trusted domains only, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers
- winbind use default domain, Check-point Controls
- winbind user default domain, NSS Configuration
- winbindd, Validation, Validation, Technical Issues, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers, Samba Configuration, Questions and Answers, Starting Samba
- winbindd_cache.tdb, Technical Issues
- winbindd_idmap.tdb, Technical Issues
- Windows, LDAP Server Configuration
- Windows 2000 ACLs, Managing Windows 200x ACLs
- Windows 2003 Serve, Introduction
- Windows 200x ACLs, Questions and Answers
- Windows accounts, Technical Issues
- Windows ACLs, Setting Posix ACLs in UNIX/Linux
- Windows Address Book, LDAP Server Configuration
- Windows ADS Domain, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- Windows clients, Questions and Answers
- Windows Explorer, Validation
- Windows explorer, Questions and Answers
- Windows security identifier (see SID)
- Windows Servers, Introduction
- Windows Services for UNIX (see SUS)
- Windows XP, Assignment Tasks
- WINS, Questions and Answers, Implementation, Technical Issues, Implementation, Windows Client Configuration, Technical Issues, Windows Client Configuration, The Nature of Windows Networking Protocols, Identity Management Needs, Questions and Answers
- lookup, Questions and Answers
- name resolution, Routed Networks
- server, Making Happy Users, Routed Networks
- WINS server, The 500-User Office, Questions and Answers
- wins server, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
- WINS serving, Implementation
- wins support, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
- wins.dat, Identity Management Needs
- Word, Share Point Directory and File Permissions
- workgroup, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
- Workgroup Announcement, Findings
- workstation, Implementation
- wrapper, Questions and Answers
- write list, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
- write lock, Opportunistic Locking Controls
X
- Ximian, Migrating NetWare 4.11 Server to Samba-3
- xinetd, Process Startup Configuration
- XML, Dissection and Discussion
- xmlsam, Implementation
Y
- YaST, PAM and NSS Client Configuration
- Yellow Pages, Identity Management Needs
- yellow pages (see NIS)
Chapter 11. Active Directory, Kerberos, and Security Table of Contents
Chapter 11. Active Directory, Kerberos, and Security Table of Contents
By this point in the book, you have been exposed to many Samba-3 features and capabilities. More importantly, if you have implemented the examples given, you are well on your way to becoming a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to practice, you likely have thought of improvements and scenarios with which you can experiment. You are rather well plugged in to the many flexible ways Samba can be used. -
This is a book about Samba-3. Understandably, its intent is to present it in a positive light. The casual observer might conclude that this book is one-eyed about Samba. It is what would you expect? This chapter exposes some criticisms that have been raised concerning @@ -13,13 +13,13 @@ Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of criticism develops with respect to Abmas. -
This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled out of thin air. They were drawn from comments made by Samba users and from criticism during discussions with Windows network administrators. The tone of the objections reflects as closely as possible that of the original. The case presented is a straw-man example that is designed to permit each objection to be answered as it might occur in real life. -
Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took note of the spectacular projection of Abmas onto the global business stage. Abmas is building an interesting portfolio of companies that includes accounting services, financial advice, investment @@ -28,42 +28,42 @@ interesting business growth and development plan. Abmas Video Rentals has been recently acquired. During the time that the acquisition was closing, the Video Rentals business upgraded their Windows NT4-based network to Windows 2003 Server and Active Directory. -
Bob Jordan has been accepting of the fact that Abmas Video Rentals will use Microsoft Active Directory. The IT team led by Stan Soroka is committed to Samba-3 and to maintaining a uniform technology platform. Stan Soroka's team voiced their disapproval over the decision to permit this business to continue to operate with a solution that is viewed by Christine and her group as “an island of broken technologies.” This comment was made by one of Christine's staff as they were installing a new Samba-3 server at the new business. -
Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer should make such a comment. He felt that he had to prepare in case he might be criticized for his decision to use Active Directory. He decided he would defend his decision by hiring the services - of an outside security systems consultant to report[12] on his unit's operations + of an outside security systems consultant to report[12] on his unit's operations and to investigate the role of Samba at his site. Here are key extracts from this hypothetical report: -
... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. ... we took additional steps to validate the integrity of the installation and operation of Active Directory and are pleased that your staff are following sound practices.
... -
User and Group accounts, and respective privileges, have been well thought out. File system shares are appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and effective off-site storage practices are considered to exceed industry norms. -
Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain a secure network. -
The recently installed Linux file and application server uses a tool called winbind that is indiscriminate about security. All user accounts in Active Directory can be used to access data stored on the Linux system. We are alarmed that secure information is accessible to staff who should not even be aware that it exists. We share the concerns of your network management staff who have gone to great lengths to set fine-grained controls that limit information access to those who need access. It seems incongruous to us that Samba winbind should be permitted to be used as it voids this fine work. -
Graham Judd [head of network administration] has locked down the security of all systems and is following the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network is isolated from the outside world, the [product name removed] firewall is under current contract @@ -72,7 +72,7 @@ detail and for following Microsoft recommended best practices.
... -
In respect of the use of Samba, we offer the following comments: Samba is in use in nearly half of all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft ... what worries us regarding Samba is the need to disable essential Windows security features such as @@ -80,14 +80,14 @@ mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that Samba is not at the full capabilites of Microsoft Windows NT4 server. Microsoft has moved well beyond that with trusted computing initiatives that the Samba developers do not participate in. -
One wonders about the integrity of an open source program that is developed by a team of hackers who cannot be held accountable for the flaws in their code. The sheer number of updates and bug fixes they have released should ring alarm bells in any business. -
Another factor that should be considered is that buying Microsoft products and services helps to provide employment in the IT industry. Samba and Open Source software place those jobs at risk. -
This is also a challenge to rise above the trouble spot. Bob calls Stan's team together for a simple discussion, but it gets further out of hand. When he returns to his office, he finds the following email in his in-box: @@ -100,23 +100,23 @@ I also wish to advise that two of the recent recruits want to implement Kerberos authentication across all systems. I concur with the desire to improve security. One of the new guys who is championing the move to Kerberos was responsible for the comment that caused the embarrassment. -
I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, I would like to hire the services of a well-known Samba consultant to set the record straight. -
I intend to use this report to answer the criticism raised and would like to establish a policy that we will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce use of any centrally proposed standards, but make all non-compliance the financial responsibility of the out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. -
--Stan --Stan
Samba-3 is a tool. No one pounding your door to use Samba. That is a choice that you are free to make or reject. It is likely that your decision to use Samba can benefit your company more than anyone else. The Samba Team obviously believes that the Samba software is a worthy choice. @@ -124,18 +124,18 @@ someone to help manage your Samba installation, you can create income and employment. Alternately, money saved by not spending in the IT area can be spent elsewhere in the business. All money saved or spent creates employment. -
In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted purely to provide file and print service interoperability on platforms that otherwise cannot provide access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. -
It would be foolish to adopt a technology that might put any data or users at risk. Security affects everyone. The Samba Team are fully cognizant of the responsibility they have to their users. The Samba documentation clearly reveals the fact that full responsibility is accepted to fix anything that is broken. -
There is a mistaken perception in the IT industry that commercial software providers are fully accountable for the defects in products. Open Source software comes with no warranty, so it is often assumed that its use confers a higher degree of risk. Everyone should read commercial software @@ -143,34 +143,34 @@ extent of liability that is accepted. Doing so soon dispels the popular notion that commercial software vendors are willingly accountable for product defects. In many cases, the commercial vendor accepts liability only to reimburse the price paid for the software. -
The real issues that a consumer (like you) needs answered is what is the way of escape from technical problems and how long will it take? The average problem turnaround time in the Open Source community is approximately 48 hours. What does the EULA offer? What is the track record in the commercial software industry? What happens when your commercial vendor decides to cease providing support? -
Open Source software at least puts you in possession of the source code. This means that when all else fails, you can hire a programmer to solve/fix the problem. -
+
Each issue is now discussed and, where appropriate, example implementation steps are provided. -
- Winbind and Security
- Winbind and Security
Windows network administrators may be dismayed to find that winbind exposes all Domain users so that they may use their Domain account credentials to log onto a UNIX/Linux system. The fact that all users in the Domain can see the UNIX/Linux server in their Network Neighborhood and can browse the shares on the server seems to excite them further. -
winbind provides for the UNIX/Linux Domain Member server or client, the same as one would obtain by adding a Microsoft Windows server or client to the Domain. The real objection is the fact that Samba is not MS Windows and, therefore, requires handling a little differently from the familiar Windows systems. One must recognize fear of the unknown. -
Windows network administrators need to recognize that winbind does not, and cannot, override account controls set using the Active Directory management tools. The control is the same. Have no fear. -
Where Samba and the ADS Domain account information obtained through the use of winbind permits access, by browsing or by the drive mapping to a share, to data that should be better protected. This can only happen when security @@ -178,14 +178,14 @@ on:
Shares themselves (i.e., the logical share itself)
The share definition in smb.conf
The shared directories and files using UNIX permissions
Using Windows 2000 ACLs if the file system is Posix enabled
Examples of each are given in ???. -
- User and Group Controls
- User and Group Controls
User and group management facilities as known in the Windows ADS environment may be used to provide equivalent access control constraints or to provide equivalent permissions and privileges on Samba servers. Samba offers greater flexibility in the use of user and group controls because it has additional layers of control compared to Windows 200x/XP. For example, access controls on a Samba server may be set within the share definition in a manner for which Windows has no equivalent. -
In any serious analysis of system security, it is important to examine the safeguards that remain when all other protective measures fail. An administrator may inadvertently set excessive permissions on the file system of a shared resource, or he may set excessive @@ -193,35 +193,35 @@ the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is possible to guard against that by enforcing controls on the share definition itself. You see a practical example of this a little later in this chapter. -
The report that is critical of Samba really ought to have exercised greater due diligence, as the real weakness is on the side of a Microsoft Windows environment. -
- Security Overall
- Security Overall
Samba has been designed in such a manner that weaknesses inherent in the design of Microsoft Windows networking ought not to expose the underlying UNIX/Linux file system in any way. All software has potential defects, and Samba is no exception. What matters more is how defects that are discovered get dealt with. -
The Samba Team totally agrees with the necessity to observe and fully implement every security facility to provide a level of protection and security that is necessary and that the end user (or network administrator) needs. Never would the Samba Team recommend a compromise to system security, nor would deliberate defoliation of security be publicly condoned; yet this is the practice by many Windows network administrators just to make happy users who have no notion of consequential risk. -
The report condemns Samba for releasing updates and security fixes, yet Microsoft on-line updates need to be applied almost weekly. The answer to the criticism made lies in the fact that Samba development is continuing, documentation is improving, user needs are being increasingly met or exceeded, and security updates are issued with a short turnaround time. -
The release of Samba-4 is expected around late 2004 to early 2005 and involves a near complete rewrite to permit extensive modularization and to prepare Samba for new functionality planned for addition during the next generation series. The Samba Team is responsible and can be depended upon; the history to date would suggest a high degree of dependability as well as on charter development consistent with published road-map projections. -
Not well published is the fact that Microsoft was a foundation member of the Common Internet File System (CIFS) initiative, together with the participation of the network attached storage (NAS) industry. Unfortunately, for the past few years, @@ -230,7 +230,7 @@ space. The Samba Team has maintained consistent presence and leadership at all CIFS conferences and at the interoperability laboratories run concurrently with them. -
- Cryptographic Controls (schannel, sign'n'seal)
- Cryptographic Controls (schannel, sign'n'seal)
The report correctly mentions the fact that Samba did not support the most recent schannel and digital sign'n'seal features of Microsoft Windows NT/200x/XPPro products. This is one of the key features @@ -238,7 +238,7 @@ seldom a reflection of current practice, and in many respects reports are like a pathology report they reflect accurately (at best) status at a snap-shot in time. Meanwhile, the world moves on. -
It should be pointed out that had clear public specifications for the protocols been published, it would have been much easier to implement this and would have taken less time to do. The sole mechanism used to find an algorithm that is compatible @@ -246,7 +246,7 @@ and trial-and-error implementation of potential techniques. The real value of public and defensible standards is obvious to all, and would have enabled more secure networking for everyone. -
Critics of Samba often ignore fundamental problems that may plague (or may have plagued) the users of Microsoft's products also. Those who are first to criticize Samba for not rushing into release of digital sign'n'seal support @@ -254,10 +254,10 @@ acknowledged and for which a fix was provided. In fact, Tangent Systems - appears even today[13] to not be sure that the problem has been resolved. + appears even today[13] to not be sure that the problem has been resolved. So it is evident that some delay in release of new functionality may have fortuitous consequences. -
One final comment is warranted. If companies want more secure networking protocols, the most effective method by which this can be achieved is by users seeking and working together to help define open and publicly refereed standards. The @@ -273,7 +273,7 @@ of them that uses RPCs that are not supported by any of these component technologies and yet by which they are made to interoperate in ways that the components do not support. -
In order to make the popular request for Samba to be an Active Directory Server a reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls that are not presently supported. The Samba Team has not been able to gain critical @@ -281,31 +281,31 @@ challenge of developing and integrating the necessary technologies. Therefore, if the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality into the Samba project, this dream request can not become a reality. -
At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the Samba development roadmap. If it is not on the published roadmap, it cannot be delivered anytime soon. Ergo, ADS server support is not a current goal for Samba development. The Samba Team is most committed to permitting Samba to be a full ADS Domain member that is increasingly capable of being managed using Microsoft Windows MMC tools. -
Kerberos is a network authentication protocol that provides secure authentication for client-server applications by using secret-key cryptography. Firewalls are an insufficient barrier mechanism in todays networking world as at best they only restrict incoming network traffic but can not prevent network traffic that comes from authorized locations from performing unauthorized activities. -
Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business. -
Kerberos is a trusted third-party service. That means that there is a third party (the kerberos server) that is trusted by all the entities on the network (users and services, usually called principals). All principals share a secret password (or key) with the kerberos server and this enables principals to verify that the messages from the kerberos server are authentic. Thus trusting the kerberos server, users and services can authenticate each other. -
Kerberos was until recently a technology that was restricted from being exported from the United States. For many years that hindered global adoption of more secure networking technologies both within the USA as well as outside it. A free an unencumbered implementation of MIT Kerberos has been produced in Europe @@ -313,7 +313,7 @@ In recent times the USA government has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a significant surge forward in the development of Kerberos enabled applications and in the general deployment and use of Kerberos across the spectrum of the information technology industry. -
A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation of it. For example, a 2002 new report by IDG states: @@ -322,14 +322,14 @@ great lengths to disclose interfaces and protocols that allow third-party software products to interact with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's use of the Kerberos authentication specification, not everyone agrees. -
Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version 5 specification that Windows clients use for proprietary purposes and still achieve interoperability with the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so that software developers could add their own authorization information, he said. -
It so happens that Microsoft Windows clients depend on and expect the contents of the unspecified fields in the Kerberos 5 communications data stream for their Windows interoperability, in particular when Samba is being expected to emulate a Windows Server 200x Domain Controller. But the interoperability @@ -340,7 +340,7 @@
Microsoft makes the following comment in a reference in a technet article: -
The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership. @@ -350,10 +350,10 @@ Windows NT access control information.
The following procedures outline the implementation of the security measures discussed so far. -
Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as Windows XP Pro) attempts to make a connection to the Samba server. -
Procedure 11.1. Create/Edit/Delete Share ACLs
Procedure 11.1. Create/Edit/Delete Share ACLs
From a Windows 200x/XP Professional workstation, log onto the Domain using the Domain Administrator account (on Samba Domains, this is usually the account called root).
@@ -362,16 +362,16 @@
In the left panel, ->->->->. In the lower panel, click on the name of the server you wish to - administer. Click ->->. + administer. Click ->->. In the left panel, the entry should now reflect the change made. For example, if the server you are administering is called FRODO, the Computer Management entry should now say: .
In the left panel, click ->->. -
In the right panel, double-click on the share on which you wish to set/edit ACLs. This will bring up the Properties panel. Click the tab. -
You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -380,20 +380,20 @@
When you are done with editing, close all panels by clicking through the buttons. -
Share-definition-based access controls can be used like a check-point or like a pile-driver. Just as a check-point can be used to require someone who wants to get through to meet certain requirements, so it is possible to require the user (or group the user belongs to) to meet specified credential-related objectives. It can be likened to a pile-driver by overriding default controls, in that having met the credential-related objectives, the user can be granted powers and privileges that would not normally be available under default settings. -
It must be emphasized that the controls here discussed can act as a filter, or give rights of passage, that act as a super-structure over normal directory and file access controls. However, share level ACLs act at a higher level than to share definition controls because the user must filter through the share level controls to get to the share definition controls. The proper hierarchy of controls implemented by Samba and Windows networking consists of: -
Share Level ACLs
Share Definition Controls
Directory and File Permissions
Directory and File Posix ACLs
Share Level ACLs
Share Definition Controls
Directory and File Permissions
Directory and File Posix ACLs
Consider the following extract from a smb.conf file defining the share called Apps:
[Apps] @@ -404,19 +404,19 @@
This definition permits only those who are members of the group called Employees to access the share. -
Note
Note
On Domain Member servers and clients, even when the winbind use default domain has been specified, the use of Domain accounts in security controls requires fully qualified Domain specification, - for example, valid users = @"MEGANET\Northern Engineers". + for example, valid users = @"MEGANET\Northern Engineers". Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a delimiter. -
If there is an ACL on the share itself to permit read/write access for all Employees as well as read/write for the group Doctors, both groups are permitted through to the share. However, at the moment an attempt is made to set up a connection to the share, a member of the group Doctors, who is not also a member of the group Employees, would immediately fail to validate. -
Consider another example. In this case, you want to permit all members of the group Employees to access the Apps share, except the user patrickj. This can be easily achieved by setting a share level ACL permitting only Employees to access the share, @@ -429,7 +429,7 @@ read only = Yes invalid users = patrickj
- + Let us assume that you want to permit the user gbshaw, to manage any file in the UNIX/Linux file system directory /data/apps, but you do not want to grant any write permissions beyond that directory tree. Here is one way this can be done: @@ -441,7 +441,7 @@ invalid users = patrickj admin users = gbshaw
- + Now we have a set of controls that permits only Employees who are also members of the group Doctors, excluding the user patrickj, to have read-only privilege, but the user gbshaw is granted administrative rights. @@ -463,11 +463,11 @@ admin users = gbshaw write list = peters
- + This is a particularly complex example at this point, but it begins to demonstrate the possibilities. You should refer to the on-line manual page for the smb.conf file for more information regarding the check-point controls that Samba implements. -
Override controls implemented by Samba permit actions like the adoption of a different identity during file system operations, the forced overwriting of normal file and directory permissions, and so on. You should refer to the on-line manual page for the smb.conf file for more information regarding @@ -485,14 +485,14 @@ force user = billc force group = Mentors
- + That is all there is to it. Well, it is almost that simple. The downside of this method is that users are logged onto the Windows client as themselves, and then immediately before accessing the file, Samba makes system calls to change the effective user and group to the forced settings specified, completes the file transaction, and then reverts to the actually logged on identity. This imposes significant overhead on Samba. The alternative way that effectively the same result can be achieved (but with lower system CPU overheads) is described next. -
The use of the force user, or the force group, may also have a severe impact on system (and in particular Windows client) performance. If opportunistic locking is enabled on the share (the default), it causes an oplock break to be @@ -502,7 +502,7 @@ waiting for the file system transaction (read or write) to complete. The result can be a profound apparent performance degradation as the client continually attempts to reconnect to overcome the effect of the lost oplock break, or time-out. -
Samba has been designed and implemented so that it respects as far as is feasible the security and user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing with respect to file system access that violates file system permission settings, unless it is @@ -510,7 +510,7 @@ UNIX file system controls, this chapter does not document simple information that can be obtained from a basic UNIX training guide. Instead, one common example of a typical problem is used to demonstrate the most effective solution referred to in the immediately preceding paragraph. -
One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence:
@@ -530,7 +530,7 @@ There have been many postings over the years that report the same basic problem. Frequently Samba users want to know when this “bug” will be fixed. The fact is, this is not a bug in Samba at all. Here is the real sequence of what happens in the case mentioned above. -
When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned by the user who creates the file (billc) and has the permissions that follow that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing @@ -548,7 +548,7 @@ The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these simple steps to create a share in which all files will consistently be owned by the same user and the same group: -
Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership
+
Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership
Change your share definition so that it matches this pattern:
[finance] @@ -556,18 +556,18 @@ browseable = Yes read only = No-
Set consistent user and group permissions recursively down the directory tree as shown here:
root# chown -R janetp.users /usr/data/finance
-
Set the files and directory permissions to be read/write for owner and group, and not accessible to others (everyone) using the following command:
root# chmod ug+rwx,o-rwx /usr/data/finance
-
Set the SGID (super-group) bit on all directories from the top down. This means all files can be created with the permissions of the group set on the directory. It means all users who are members of the group finance can read and write all files in @@ -577,11 +577,11 @@ root# find /usr/data/finance -type d -exec chmod ug+s {}\;
-
Make sure all users that must have read/write access to the directory have finance group membership as their primary group, for example, the group they belong to in /etc/passwd. -
Samba must translate Windows 2000 ACLs to UNIX Posix ACLs. This has some interesting side effects because of the fact that there is not a 1:1 equivalence between them. The as-close-as-possible ACLs match means that some transactions are not possible from MS Windows clients. One of these is to reset the ownership @@ -589,7 +589,7 @@
There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. -
+
From a Windows 200x/XP Professional workstation, log onto the Domain using the Domain Administrator account (on Samba Domains, this is usually the account called root).
@@ -604,14 +604,14 @@ the Computer Management entry should now say: .
In the left panel, click ->->. -
In the right panel, double-click on the share on which you wish to set/edit ACLs. This brings up the Properties panel. Click the tab. It is best to edit ACLs using the Advanced editing features. Click the button. This opens a panel that has four tabs. Only the functionality under the Permissions tab can be utilized with respect to a Samba Domain server. -
You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -620,7 +620,7 @@
When you are done with editing, close all panels by clicking through the buttons until the last panel closes. -
The following alternative method may be used from a Windows workstation. In this example we work with a Domain called MEGANET, a server called MASSIVE, and a share called Apps. The underlying UNIX/Linux share point for this share is @@ -628,7 +628,7 @@
Click ->->->->->->->->->->->. This opens a panel that has four tabs. Only the functionality under the Permissions tab can be utilized in respect to a Samba Domain server. -
You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -637,7 +637,7 @@
When you are done with editing, close all panels by clicking through the buttons until the last panel closes. -
Yet another alternative method for setting desired security settings on the shared resource files and directories can be achieved by logging into UNIX/Linux and setting Posix ACLs directly using command-line tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9 @@ -660,7 +660,7 @@ group::rwx other::r-x
-
You want to add permission for AppsMgrs to enable them to manage the applications (apps) share. It is important to set the ACL recursively so that the AppsMgrs have this capability throughout the directory tree that is @@ -683,26 +683,26 @@ other::r-x
This confirms that the change of Posix ACL permissions has been effective. -
It is highly recommend that you should read the on-line manual page for the setfacl and getfacl commands. This provides information regarding how to set/read the default ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent of setting inheritance properties. -
The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. Looking back, this chapter could be broken into two, but it's too late now. It has been done. The highlights covered are: -
Winbind honors and does not override account controls set in Active Directory. This means that password change, logon hours, and so on, are (or soon will be) enforced by Samba Winbind. At this time, an out-of-hours login is denied and password change is enforced. At this time, if logon hours expire, the user is not forcibly logged off. That may be implemented at some later date. -
Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential problems acknowledged by Microsoft as having been fixed, but reported by some as still possibly an open issue. -
The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft Active Directory. The possibility to do this is not planned in the current Samba-3 roadmap. Samba-3 does aim to provide further improvements in interoperability so that @@ -711,83 +711,83 @@ This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of the four key methodologies was reviewed with specific reference to example deployment techniques. -
+
- Sign'n'sealregistry hacks Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? -
- +
- Does Samba-3 support Active Directory? -
- mixed-mode +
- mixed-mode When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was necessary with Samba-2? -
- share level access controls +
- share level access controls Is it safe to set share level access controls in Samba? -
- share ACLs +
- share ACLs Is it mandatory to set share ACLs to get a secure Samba-3 server? -
- valid users +
- valid users The valid users did not work on the [homes]. Has this functionality been restored yet? -
- force userforce groupbias +
- force userforce groupbias Is the bias against use of the force user and force group really warranted? -
- +
- The example given for file and directory access control forces all files to be owned by one particular user. I do not like that. Is there any way I can see who created the file? -
- Computer Management +
- Computer Management In the book, The Official Samba-3 HOWTO and Reference Guide, you recommended use of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? -
- valid usersActive DirectoryDomain Member server +
- valid usersActive DirectoryDomain Member server I tried to set valid users = @Engineers, but it does not work. My Samba server is an Active Directory Domain Member server. Has this been fixed now? -
Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? -
No. Samba-3 fully supports Sign'n'seal as well as schannel operation. The registry change should not be applied when Samba-3 is used as a Domain Controller. -
+
Does Samba-3 support Active Directory? -
Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not provide Active Directory services. It cannot be used to replace a Microsoft Active Directory server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, and it can function as an Active Directory Domain Member server. -
When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was necessary with Samba-2? -
No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, as Samba-3 can join a native Windows 2003 Server ADS Domain. -
Yes. Share level access controls have been supported since early versions of Samba-2. This is very mature technology. Not enough sites make use of this powerful capability, neither on Windows server or with Samba servers. -
Is it mandatory to set share ACLs to get a secure Samba-3 server? -
No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides means of securing shares through share definition controls in the smb.conf file. The additional support for share level ACLs is like frosting on the cake. It adds to security, but is not essential to it. -
The valid users did not work on the [homes]. Has this functionality been restored yet? -
Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard on the [homes] meta-service. The correct way to specify this is: - valid users = %S. -
Is the bias against use of the force user and force group really warranted? -
There is no bias. There is a determination to recommend the right tool for the task at hand. After all, it is better than putting users through performance problems, isn't it? -
+
The example given for file and directory access control forces all files to be owned by one particular user. I do not like that. Is there any way I can see who created the file? -
Sure. You do not have to set the SUID bit on the directory. Simply execute the following command to permit file ownership to be retained by the user who created it:
@@ -795,20 +795,20 @@
Note that this required no more than removing the u argument so that the SUID bit is not set for the owner. -
In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? -
Either tool can be used with equal effect. There is no benefit of one over the other, except that the MMC utility is present on all Windows 200x/XP systems and does not require additional software to be downloaded and installed. Note that if you want to manage user and group accounts in your Samba controlled Domain, the only tool that permits that is the NT4 Domain User Manager which is provided as part of the SRVTOOLS.EXE utility. -
I tried to set valid users = @Engineers, but it does not work. My Samba server is an Active Directory Domain Member server. Has this been fixed now?
The use of this parameter has always required the full specification of the Domain account, for example, valid users = @"MEGANET2\Domain Admins". -
+diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/migration.html samba-3.0.14a/docs/htmldocs/Samba-Guide/migration.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/migration.html 2005-03-23 10:19:19.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/migration.html 2005-04-11 11:18:47.000000000 -0500 @@ -1,4 +1,4 @@ -Chapter 8. Migrating NT4 Domain to Samba-3 Table of Contents
+
Chapter 8. Migrating NT4 Domain to Samba-3 Table of Contents
Ever since Microsoft announced that they are discontinuing support for Windows NT4, Samba users started to ask for detailed instructions for how to migrate from NT4 to Samba-3. This chapter provides background information that should @@ -6,18 +6,18 @@
One wonders how many NT4 systems will be left in service by the time you read this book though. -
Network administrators who want to migrate off a Windows NT4 environment know one thing with certainty. They feel that NT4 has been abandoned and they want to update. The desire to get off NT4 and to not adopt Windows 200x and Active Directory is driven by a mixture of concerns over complexity, cost, fear of failure, and much more. -
The migration from NT4 to Samba-3 can involve a number of factors, including: migration of data to another server, migration of network environment controls such as group policies, and finally migration of the users, groups, and machine accounts. -
It should be pointed out now that it is possible to migrate some systems from Windows NT4 Domain environments to a Samba-3 Domain Environment. This is certainly not possible in every case. It is possible to just migrate the Domain accounts @@ -25,7 +25,7 @@ an exception than the rule. Most systems require some tweaking and adjusting following migration before an environment that is acceptable for immediate use is obtained. -
You are about to migrate an MS Windows NT4 Domain accounts database to a Samba-3 server. The Samba-3 server is using a passdb backend based on LDAP. The @@ -34,24 +34,24 @@
Your objective is to document the process of migrating user and group accounts from several NT4 Domains into a single Samba-3 LDAP backend database. -
The migration process takes a snap-shot of information that is stored in the Windows NT4 registry based accounts database. That information resides in the Security Account Manager (SAM) portion of the NT4 Registry under keys called SAM and SECURITY. -
Warning
Warning
The Windows NT4 registry keys called SAM and SECURITY are protected so that you cannot view the contents. If you change the security setting to reveal the contents under these hive keys, your Windows NT4 Domain is crippled. Do not do this unless you are willing to render your domain controller inoperative. -
Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, that may not be a good idea from an administration perspective. Since you are going through a certain amount of disruptive activity anyhow, why not take this as an opportunity to review the structure of the network, how Windows clients are controlled and how they interact with the network environment. -
MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed have done little to keep the NT4 server environment up-to-date with more recent Windows releases, particularly Windows XP Professional. The migration provides opportunity to revise and update @@ -62,7 +62,7 @@ as a good time to update desktop systems also. In all, the extra effort should constitute no real disruption to users, rather with due diligence and care should make their network experience a much happier one. -
Migration of an NT4 Domain user and group database to Samba-3 involves a certain strategic element. Many sites have asked for instructions regarding merging of multiple different NT4 Domains into one Samba-3 LDAP database. It would appear that this is viewed as a significant @@ -74,7 +74,7 @@
Prepare the target Samba-3 server. This involves configuring Samba-3 for migration to either a tdbsam or an ldapsam backend. -
Clean up the source NT4 PDC. Delete all accounts that need not be migrated. Delete all files that should not be migrated. Where possible, change NT Group names so there are no spaces or uppercase characters. This is important if @@ -82,27 +82,27 @@ names.
Step through the migration process. -
Upgrade the Samba-3 server from a BDC to a PDC, and validate all account information. -
If you are wanting to merge multiple NT4 Domain account databases into one Samba Domain, you must now dump the contents of the first migration and edit it as appropriate. Now clean out (remove) the tdbsam backend file (passdb.tdb), or the LDAP database files. You must start each migration with a new database into which you merge your NT4 domains. -
At this point, you are ready to perform the second migration following the same steps as for the first. In other words, dump the database, edit it, and then you may merge the dump for the first and second migrations. -
You must be careful. If you choose to migrate to an LDAP backend, your dump file now contains the full account information, including the Domain SID. The Domain SID for each of the two NT4 Domains will be different. You must choose one, and change the Domain portion of the account SIDs so that all are the same. -
If you choose to use a tdbsam (passdb.tdb) backend file, your best choice is to use pdbedit to export the contents of the tdbsam file into an smbpasswd data file. This automatically strips out all Domain specific information, @@ -112,7 +112,7 @@ file must have an account in /etc/passwd. The resulting smbpasswd file may be exported/imported into either a tdbsam (passdb.tdb), or else into an LDAP backend. -
The merging of multiple Windows NT4 style Domains into a single LDAP-backend-based Samba-3 Domain may be seen by those who had power over them as a loss of prestige or a loss of power. The imposition of a single Domain may even be seen as a threat. So in migrating and @@ -122,12 +122,12 @@ The best advice that can be given to those who set out to merge NT4 Domains into one single Samba-3 Domain is to promote (sell) the action as one that reduces costs and delivers greater network interoperability and manageability. -
You can present here the steps and example output for two NT4 to Samba-3 Domain migrations. The first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the scripts you specify in the smb.conf file for the add user script collection of parameters are used to effect the addition of accounts into the passdb backend. -
+
In this instance, you migrate an NT4 PDC to an LDAP backend. The accounts you are about to migrate are shown in ???. In this example you make use of the smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. @@ -155,17 +155,17 @@ Install and configure the Samba-3 server precisely as shown in Chapter 6 for the server called MASSIVE. The Domain name MEGANET must match that of the NT4 Domain from which you are about to migrate. Do not execute any Samba - executables. -
+ executables at this time, the appropriate time to do so is indicated below. +
Edit the smb.conf file to temporarily change the parameter - domain master = No so + domain master = No so the Samba server functions as a BDC for the purpose of migration. Also, temporarily (only during domain account migration) comment out the lines that specify deletion scripts (delete user script, etc.). -
Create a file called preload.LDIF as shown in ???. Edit the contents so that the domain name and SID are correct for the site being installed. -
Preload the LDAP database so it is ready to receive the information from the NT4 PDC. This pre-loads the LDAP directory with the top-level information, as well as the top level containers for user, group, computer, and domain account data. Execute the @@ -173,16 +173,14 @@
root# slapadd -v -l preload.LDIF added: "dc=abmas,dc=biz" (00000001) -added: "cn=Manager,dc=abmas,dc=biz" (00000002) -added: "ou=People,dc=abmas,dc=biz" (00000003) -added: "ou=Computers,dc=abmas,dc=biz" (00000004) -added: "ou=Groups,dc=abmas,dc=biz" (00000005) -added: "ou=Idmap,dc=abmas,dc=biz" (00000006) -added: "sambaDomainName=MEGANET,dc=abmas,dc=biz" (00000007) +added: "ou=People,dc=abmas,dc=biz" (00000002) +added: "ou=Groups,dc=abmas,dc=biz" (00000003) +added: "ou=Idmap,dc=abmas,dc=biz" (00000004) +added: "sambaDomainName=MEGANET,dc=abmas,dc=biz" (00000005)
Start the LDAP server. -
Verify that the NT4 PDC can be reached:
root# ping nt4s @@ -196,7 +194,7 @@ rtt min/avg/max/mdev = 0.518/3.773/10.223/4.560 ms
It can. Great. -
Validate that the resources on the NT4 PDC can be listed:
root# smbclient -L nt4s -UAdministrator%not24get @@ -216,7 +214,7 @@ MEGANET NT4SThis looks good. -
At this point, it is necessary to fetch the Domain SID from the NT4 PDC and apply that to the Samba-3 BDC (soon to be PDC):
@@ -225,7 +223,7 @@ Domain MEGANET in secrets.tdbDone. -
At this point, you can validate that the information is correct in the secrets.tdb file, as shown here:
@@ -242,14 +240,14 @@ }
This has returned the information expected. -
We are ready to join the NT4 Domain as a BDC by executing the following:
root# net rpc join -S NT4S -W MEGANET -U Administrator%not24get Joined domain MEGANET.
Done. -
The Samba-3 BDC is now ready to receive the NT4 PDC accounts database, as shown here:
root# net rpc vampire -S NT4S @@ -279,9 +277,9 @@ Fetching BUILTIN database SAM_DELTA_DOMAIN_INFO not handled
-
Edit the smb.conf file to reset the parameter - domain master = Yes so that + domain master = Yes so that the Samba server functions as a PDC for the purpose of migration.
In this example, you have chosen to change the Domain name of the NT4 server from DRUGPREP to MEGANET prior to the use of the vampire (migration) tool. This migration process makes use of Linux system tools @@ -324,19 +322,19 @@
Prepare a Samba-3 server precisely per the instructions shown in Chapter 5. Set the workgroup name to MEGANET. -
Edit the smb.conf file to temporarily change the parameter - domain master = No so + domain master = No so the Samba server functions as a BDC for the purpose of migration.
Start Samba as you have done previously. -
Join the NT4 Domain as a BDC, as shown here:
root# net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get Joined domain MEGANET.
-
You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
root# net rpc vampire -S oldnt4pdc -U Administrator%not24get @@ -376,7 +374,7 @@ Fetching BUILTIN database SAM_DELTA_DOMAIN_INFO not handled
-
At this point, we can validate our migration. Let's look at the accounts in the form as they would be seen in a smbpasswd file. This achieves that:
@@ -408,7 +406,7 @@ maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C: CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270:-
An expanded view of a user account entry shows more of what was obtained from the NT4 PDC:
@@ -434,7 +432,7 @@ Password can change: 0 Password must change: Mon, 18 Jan 2038 20:14:07 GMT
-
And this command lists the long names of the groups that have been imported (vampired) from the NT4 PDC:
@@ -451,11 +449,11 @@ Users Ordinary users
Everything looks well and in order. -
Edit the smb.conf file to reset the parameter - domain master = Yes so + domain master = Yes so the Samba server functions as a PDC for the purpose of migration. -
+
- clean database Why must I start each migration with a clean database? -
- Domain SID +
- Domain SID Is it possible to set my Domain SID to anything I like? -
- /etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain +
- /etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain When using a tdbsam passdb backend, why must I have all Domain user and group accounts in /etc/passwd and /etc/group? -
- validateconnectivitymigration +
- validateconnectivitymigration Why did you validate connectivity before attempting migration? -
- +
- How would you merge 10 tdbsam-based domains into an LDAP database? -
- machine accountsaccountsmachine +
- machine accountsaccountsmachine I want to change my Domain name after I migrate all accounts from an NT4 Domain to a Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? -
- multiple group mappings +
- multiple group mappings After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? -
- +
- How can I reset group membership after loading the account information into the LDAP database? -
- group names +
- group names What are the limits or constraints that apply to group names? -
- vampire +
- vampire My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 LDAP backend system using the vampire process? -
This is a recommendation that permits the data from each NT4 Domain to be kept separate until you are ready to merge them. Also, if you do not do this, you may find errors due to users or groups from multiple Domains having the same name, but different SIDs. It is better to permit each migration to complete without undue errors and then to handle the merging of vampired data under proper supervision. -
Yes, so long as the SID you create has the same structure as an auto-generated SID. The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why would you really want to create your own SID? I cannot think of a good reason. You may want to set the SID to one that is already in use somewhere on your network, but that is a little different from straight out creating your own Domain SID. -
When using a tdbsam passdb backend, why must I have all Domain user and group accounts in /etc/passwd and /etc/group? -
Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba does not fabricate the UNIX IDs from thin air, but rather requires them to be located in a suitable place. @@ -527,15 +525,15 @@ migration to the LDAP database, the accounts may be removed from the UNIX database files. In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in LDAP, require UIDs/GIDs. -
Why did you validate connectivity before attempting migration?
Access validation before attempting to migrate NT4 Domain accounts helps to pin-point potential problems that may otherwise affect or impede account migration. I am always mindful of the 4P's of migration Planning Prevents Poor Performance. -
+
How would you merge 10 tdbsam-based domains into an LDAP database? -
If you have 10 tdbsam Samba Domains, there is considerable risk that there are a number of accounts that have the same UNIX identifier (UID/GID). This means that you almost certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd @@ -545,17 +543,17 @@ tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that you have migrated before handing over access to a user. After all, too many users with a bad migration experience may threaten your career. -
I want to change my Domain name after I migrate all accounts from an NT4 Domain to a Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? -
I would recommend not. The machine accounts should still work, but there are registry entries on each Windows NT4 and upward client that have a tattoo of the old domain name. If you un-join the domain and then rejoin the newly renamed Samba-3 Domain, you can be certain to avoid this tattooing effect. -
After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? -
Samba-3 currently does not implement multiple group membership internally. If you use the Windows NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group membership is stored in the Posix groups area. If you use either tdbsam or smbpasswd backend, @@ -564,14 +562,14 @@ file to which you migrated the NT4 Domain data, do not forget to edit the UNIX /etc/passwd and /etc/group information also. That is where the multiple group information is most closely at your fingertips. -
+
How can I reset group membership after loading the account information into the LDAP database? -
You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The installation file is called SRVTOOLS.EXE. -
What are the limits or constraints that apply to group names? -
A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows groups can contain upper- and lower-case characters, as well as spaces. @@ -583,7 +581,7 @@ of the Posix standards, and likewise do not permit upper-case or space characters in group or user account names. You have to experiment with your system to find what its peculiarities are. -
My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 LDAP backend system using the vampire process?
@@ -592,7 +590,7 @@ you would not be able to migrate 323,000 accounts because this number can not fit into a 16-bit unsigned integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. Please check this carefully before you attempt to effect a migration using the vampire process. -
Migration speed depends much on the processor speed, the network speed, disk I/O capability, and LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory, that was mirroring LDAP to a second identical system over 1 gigabit ethernet, I was able to migrate around 180 user accounts diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/nw4migration.html samba-3.0.14a/docs/htmldocs/Samba-Guide/nw4migration.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/nw4migration.html 2005-03-23 10:19:20.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/nw4migration.html 2005-04-11 11:18:47.000000000 -0500 @@ -1,9 +1,9 @@ -
Chapter 9. Migrating NetWare 4.11 Server to Samba-3 Table of Contents
Chapter 9. Migrating NetWare 4.11 Server to Samba-3 Table of Contents
+ + + + + Novell is a company any seasoned IT manager has to admire. Since the acquisition of the SuSE Linux company, the acquisition on Ximian, and other moves that are friendly to the FLOSS (Free-Libre/Open Source Software) movement, Novell are emerging out of @@ -13,24 +13,24 @@ Linux. At the same time older NetWare servers are still being migrated to Samba servers. It will be interesting to see what will become of NetWare over time.
- - - - + + + + Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian, Gentoo, Mandrake, SUSE (Novell) the information in this chapter should be read with appropriate cognizance that file locations may vary a little; even so the information in this chapter should provide something of value.
- + This chapter was contributed by Misty Stanley-Jones, a UNIX administrator of many years who surfaced on the Samba mailing list with a barrage of questions, and who regularly now helps other administrators to solve thorny Samba migration questions.
- - - - + + + + One wonders how many NetWare servers remain in active service. Many are being migrated to Samba on Linux. Red Hat Linux, SUSE Linux 9.x and SUSE Linux Enterprise Server 9 are ideal target platforms to which a NetWare server may be migrated. The migration method @@ -45,8 +45,8 @@
This chapter tells its own story, so ride along, ... maybe the information here presented will help to smooth over a similar migration challenge in your favorite networking environment. -
+ Misty Stanley-Jones was recruited by Abmas Inc. to administer a network that had not received much attention for some years and was much in need of a make-over. As a brand-new sysadmin to this company, she inherited a very old Novell file server, @@ -60,13 +60,13 @@ Users storing information on their local hard drives, causing backup integrity problems.
- + At one point disk space had filled up to 100% causing the payroll database to become corrupt. This caused the accounting department to be down for over a week and necessitated deployment of another file server. The replacement server was created with very poor security and design considerations from a discarded desktop PC. -
The new system has operated for six months without problems. Over the past months much attention has been focused on cleaning up desktops and user profiles. -
+ + + + A decision to use LDAP was made even though I know nothing about LDAP except that I had been reading the book “LDAP System Administration”, by Gerald Carter. LDAP seemed to provide some of the functionality of Novell's e-Directory Services and would provide centralized authentication and identity management.
- - - + + + Building the LDAP database took a while, and a lot of trial and error. Following the guidance I obtained from Jerry Carter's book “LDAP System Administration”, I installed OpenLDAP (from RPM; later I compiled a more current version from source) and built my initial LDAP tree. -
+ + + + + + + + + The first challenge was to create a company white-pages, followed by manually entering everything from the printed company directory. This used only the inetOrgPerson objectclass from the OpenLDAP schemas. The next step was to write a shell script which @@ -131,15 +131,15 @@ Given that a decision had been made to use Courier-IMAP the schema “courier.schema” from the Courier-IMAP source tarball is ncessary to resolve Courier-specific LDAP directory needs. -
+
The following software must be installed on the SUSE Linux Enterprise Server to perform this migration:
openldap2
openldap2-client
openldap2-devel (only for Samba compilation)
nss_ldap
smbldap-tools Version 0.8.7
perl-ldap
samba-3.0.12 or later
samba-client-3.0.12 or later
samba-winbind-3.0.12 or later
Each software application must be carefully configured in preparation for migration. The configuration files used at Abmas are provided as a guide and should be modified to meet needs at your site. -
+
The /etc/openldap/slapd.conf file Misty used is shown in ???.
Example 9.1. OpenLDAP Control File slapd.conf Part A
#/usr/local/etc/openldap/slapd.conf @@ -271,7 +271,7 @@ access to attrs=namingcontexts by anonymous read
- + The /etc/ldap.conf file used is listed in ???.
Example 9.4. NSS LDAP Control File /etc/ldap.conf
# /etc/ldap.conf @@ -326,13 +326,13 @@ # possibilities to store hosts, services, ethers, and lots of other things.
- - + + In my setup, users authenticate via PAM and NSS using LDAP-based accounts. This works out of the box with the configuration files in this chapter. It enables you to have no local accounts for users (it is highly advisable to have a local account for the root user). Traps for the unwary include: -
+
If your LDAP database goes down, nobody can authenticate except for root.
If fail-over is configured incorrectly weird behavior can occur. For example, @@ -342,297 +342,297 @@ of this document and steps for implementing it are well-documented.
The following services authenticate using LDAP: -
UNIX login/ssh
Postfix (SMTP)
Courier-IMAP/IMAPS/POP3/POP3S
UNIX login/ssh
Postfix (SMTP)
Courier-IMAP/IMAPS/POP3/POP3S
+ + Company-wide White-Pages can be searched using a LDAP client such as the one in the Windows Address Book.
- - + + Having gained a solid understanding of LDAP, and a relatively workable LDAP tree thus far, it was time to configure Samba. I compiled the latest stable SAMBA and also installed the latest smbldap-tools from Idealx.
The Samba smb.conf file was configured as shown in ???. -
Example 9.5. Samba Configuration File smb.conf Part A
# Global parameters [global] + Example 9.5. Samba Configuration File smb.conf Part A
# Global parameters [global] - workgroup = MEGANET2 + workgroup = MEGANET2 - netbios name = MASSIVE + netbios name = MASSIVE - server string = Corp File Server + server string = Corp File Server - passdb backend = ldapsam:ldap://localhost + passdb backend = ldapsam:ldap://localhost - pam password change = Yes + pam password change = Yes - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 1 + log level = 1 - log file = /data/samba/log/%m.log + log file = /data/samba/log/%m.log - name resolve order = wins host bcast + name resolve order = wins host bcast - time server = Yes + time server = Yes - printcap name = cups + printcap name = cups - show add printer wizard = No + show add printer wizard = No - add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" + add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" - add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" + add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" - add user to group script /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g" + add user to group script /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g" - delete user from group script /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g" + delete user from group script /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g" - set primary group script /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u" + set primary group script /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u" - add machine script = /usr/local/sbin/smbldap-useradd -w "%m" + add machine script = /usr/local/sbin/smbldap-useradd -w "%m" - logon script = logon.bat + logon script = logon.bat - logon path = \\%L\profiles\%U\%a + logon path = \\%L\profiles\%U\%a - logon drive = H: + logon drive = H: - logon home = \\%L\%U + logon home = \\%L\%U - domain logons = Yes + domain logons = Yes - wins support = Yes + wins support = Yes - ldap admin dn = cn=Manager,dc=abmas,dc=biz + ldap admin dn = cn=Manager,dc=abmas,dc=biz - ldap group suffix = ou=Groups + ldap group suffix = ou=Groups - ldap idmap suffix = ou=People + ldap idmap suffix = ou=People - ldap machine suffix = ou=People + ldap machine suffix = ou=People - ldap passwd sync = Yes + ldap passwd sync = Yes - ldap suffix = ou=MEGANET2,dc=abmas,dc=biz + ldap suffix = ou=MEGANET2,dc=abmas,dc=biz - ldap ssl = no + ldap ssl = no - ldap user suffix = ou=People + ldap user suffix = ou=People - admin users = root, "@Domain Admins" + admin users = root, "@Domain Admins" - printer admin = "@Domain Admins" + printer admin = "@Domain Admins" - force printername = Yes Example 9.6. Samba Configuration File smb.conf Part B
[netlogon] - comment = Network logon service + comment = Network logon service - path = /data/samba/netlogon + path = /data/samba/netlogon - write list = "@Domain Admins" + write list = "@Domain Admins" - guest ok = Yes [profiles] + guest ok = Yes [profiles] - comment = Roaming Profile Share + comment = Roaming Profile Share - path = /data/samba/profiles/ + path = /data/samba/profiles/ - read only = No + read only = No - profile acls = Yes + profile acls = Yes - veto files = desktop.ini + veto files = desktop.ini - browseable = No [homes] + browseable = No [homes] - comment = Home Directories + comment = Home Directories - valid users = %S + valid users = %S - read only = No + read only = No - create mask = 0770 + create mask = 0770 - veto files = desktop.ini + veto files = desktop.ini - hide files = desktop.ini + hide files = desktop.ini - browseable = No [software] + browseable = No [software] - comment = Software for %a computers + comment = Software for %a computers - path = /data/samba/shares/software/%a + path = /data/samba/shares/software/%a - guest ok = Yes [public] + guest ok = Yes [public] - comment = Public Files + comment = Public Files - path = /data/samba/shares/public + path = /data/samba/shares/public - read only = No + read only = No - guest ok = Yes [PDF] + guest ok = Yes [PDF] - comment = Location of documents printed to PDFCreator printer + comment = Location of documents printed to PDFCreator printer - path = /data/samba/shares/pdf + path = /data/samba/shares/pdf - guest ok = Yes Example 9.7. Samba Configuration File smb.conf Part C
[EVERYTHING] - comment = All shares + comment = All shares - path = /data/samba + path = /data/samba - valid users = "@Domain Admins" + valid users = "@Domain Admins" - read only = No [CDROM] + read only = No [CDROM] - comment = CD-ROM on MASSIVE + comment = CD-ROM on MASSIVE - path = /mnt + path = /mnt - guest ok = Yes [print$] + guest ok = Yes [print$] - comment = Printer Drivers Share + comment = Printer Drivers Share - path = /data/samba/drivers + path = /data/samba/drivers - write list = root + write list = root - browseable = No [printers] + browseable = No [printers] - comment = All Printers + comment = All Printers - path = /data/samba/spool + path = /data/samba/spool - create mask = 0644 + create mask = 0644 - printable = Yes + printable = Yes - browseable = No [acct_hp8500] + browseable = No [acct_hp8500] - comment = "Accounting Color Laser Printer" + comment = "Accounting Color Laser Printer" - path = /data/samba/spool/private + path = /data/samba/spool/private - valid users = @acct, @acct_admin, @hr, "@Domain Admins",\ @Receptionist, dwayne, terri, danae, jerry + valid users = @acct, @acct_admin, @hr, "@Domain Admins",\ @Receptionist, dwayne, terri, danae, jerry - create mask = 0644 + create mask = 0644 - printable = Yes + printable = Yes - copy = printers [plotter] + copy = printers [plotter] - comment = Engineering Plotter + comment = Engineering Plotter - path = /data/samba/spool + path = /data/samba/spool - create mask = 0644 + create mask = 0644 - printable = Yes + printable = Yes - use client driver = Yes + use client driver = Yes - copy = printers Example 9.8. Samba Configuration File smb.conf Part D
[APPS] - path = /data/samba/shares/Apps + path = /data/samba/shares/Apps - force group = "Domain Users" + force group = "Domain Users" - read only = No [ACCT] + read only = No [ACCT] - path = /data/samba/shares/Accounting + path = /data/samba/shares/Accounting - valid users = @acct, "@Domain Admins" + valid users = @acct, "@Domain Admins" - force group = acct + force group = acct - read only = No + read only = No - create mask = 0660 + create mask = 0660 - directory mask = 0770 [ACCT_ADMIN] + directory mask = 0770 [ACCT_ADMIN] - path = /data/samba/shares/Acct_Admin + path = /data/samba/shares/Acct_Admin - valid users = @â€acct_admin†+ valid users = @â€acct_admin†- force group = acct_admin [HR_PR] + force group = acct_admin [HR_PR] - path = /data/samba/shares/HR_PR + path = /data/samba/shares/HR_PR - valid users = @hr, @acct_admin + valid users = @hr, @acct_admin - force group = hr [ENGR] + force group = hr [ENGR] - path = /data/samba/shares/Engr + path = /data/samba/shares/Engr - valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri + valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri - force group = engr + force group = engr - read only = No + read only = No - create mask = 0770 [DATA] + create mask = 0770 [DATA] - path = /data/samba/shares/DATA + path = /data/samba/shares/DATA - valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri + valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri - force group = engr + force group = engr - read only = No + read only = No - create mask = 0770 + create mask = 0770 - copy = engr Example 9.9. Samba Configuration File smb.conf Part E
[X] - path = /data/samba/shares/X + path = /data/samba/shares/X - valid users = @engr, @acct + valid users = @engr, @acct - force group = engr + force group = engr - read only = No + read only = No - create mask = 0770 + create mask = 0770 - copy = engr [NETWORK] + copy = engr [NETWORK] - path = /data/samba/shares/network + path = /data/samba/shares/network - valid users = "@Domain Users" + valid users = "@Domain Users" - read only = No + read only = No - create mask = 0770 + create mask = 0770 - guest ok = Yes [UTILS] + guest ok = Yes [UTILS] - path = /data/samba/shares/Utils + path = /data/samba/shares/Utils - write list = "@Domain Admins" [SYS] + write list = "@Domain Admins" [SYS] - path = /data/samba/shares/SYS + path = /data/samba/shares/SYS - valid users = chad + valid users = chad - read only = No + read only = No browseable = No - - - + + + Most of these shares are only used by one company group, but they are required because of some ancient Qbasic and Rbase applications were that written expecting their own drive letters.
- - - + + + Note: During the process of building the new server, I kept data files up-to-date with the Novell server via use of rsync. On a separate system (my workstation in fact) which could be rebooted whenever necessary, I set up a mount point to the @@ -833,7 +833,7 @@ with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd"
- + NOTE: I chose not to take advantage of the TLS capability of this. Eventually I may go back and tweak it. Also I chose not to take advantage of the master/slave configuration as I heard horror stories that it was @@ -907,11 +907,11 @@ ...
+ + + + - - - - With the LDAP directory now intialized it is time to create the Windows and POSIX (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups. The easiest way to do this is to use smbldap-groupadd command. @@ -919,34 +919,34 @@ unique GID, and an automatically-determined RID. I learned the hard way not to try to do this by hand.
- - - + + + After I had my group mappings in place, I added users to the groups (the users don't really have to exist yet). I used the smbldap-groupmod command to accomplish this. It can also be done manually by adding memberUID attributes to the group entries in LDAP.
- - - + + + The most monumental task of all was adding the sambaSamAccount information to each already-existent posixAccount entry. I did it one at a time as I moved people onto the new server, by issuing the command:
root# smbldap-usermod -a -P username
- - - + + + I completed that step for every user after asking the person what their current NetWare password was. The wiser way to have done it would probably be to dump the entire database to an LDIF file. This can be done by executing:
root# slapcat > somefile.ldif
- - + + Then update the LDIF file created by using a Perl script to parse and add the appropriate attributes and objectClasses to each entry, followed by re-importing the entire database into the LDAP directory. @@ -1027,7 +1027,7 @@ sambaAcctFlags: [W ]
- + So now I can log in with a test user from the machine w2kengrspare. It's all fine and good, but that user is in no groups yet so has pretty boring access. We can fix that by writing the login script! To write the login script, I used @@ -1036,7 +1036,7 @@ easier to learn and more powerful than the standard netlogon scripts I have seen. I also did not have to do a logon script per user or per group.
- + I downloaded Kixtart and put the following files in my [netlogon] share:
KIX32.EXE @@ -1048,7 +1048,7 @@ We can get around the need.- + I then wrote the logon.kix file that is shown in ???. I chose to keep it all in one file, but it can be split up and linked via include directives. @@ -1230,7 +1230,7 @@ have three such machines and one is going away in the very near future, so it was easier to do it by hand.
- + At this point I was able to add the users. This is the part that really falls into “upgrade. I moved the users over one group at a time, starting with the people who used the least amount of resources on the network. With each group @@ -1339,4 +1339,4 @@
In short, my users are much happier now that the new server is running, that is what is important to me. -
+ diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.13/docs/htmldocs/Samba-Guide/unixclients.html samba-3.0.14a/docs/htmldocs/Samba-Guide/unixclients.html --- samba-3.0.13/docs/htmldocs/Samba-Guide/unixclients.html 2005-03-23 10:19:21.000000000 -0600 +++ samba-3.0.14a/docs/htmldocs/Samba-Guide/unixclients.html 2005-04-11 11:18:48.000000000 -0500 @@ -1,4 +1,4 @@ -Chapter 10. Adding UNIX/LINUX Servers and Clients Chapter 10. Adding Domain Member Servers and Clients The most frequently discussed Samba subjects over the past two years have focused around Domain Control and printing. It is well known that Samba is a file and print server. A recent survey conducted by Open Magazine found that of all respondents: 97% use Samba for file and print services, and 68% use Samba for Domain Control. See the @@ -11,17 +11,17 @@ exciting aspects of Samba deployment. This chapter directs your attention to provide important information on the addition of Samba servers into your present Windows network whatever the controlling technology may be. So let's get back to Abmas and our good friends Bob Jordan and company. -
Bob Jordan looks back over the achievements of the past year or two. Daily events are rather straightforward with not too many distractions or problems. Bob, your team is doing well, but a number of employees are asking for Linux desktop systems. Your network has grown and demands additional Domain Member servers. Let's get on with this; Christine and Stan are ready to go. -
Stan Soroka is firmly in control of the Department of the Future, while Christine is enjoying a stable and predictable network environment. It is time to add more servers and to add Linux desktops. It is time to meet the demands of future growth and endure trial by fire. Go on, walk the steps with Stan and Company. -
You must now add UNIX/Linux Domain Member servers to your network. You have a friend who has a Windows 2003 Active Directory Domain network who wants to add a Samba/Linux server and has asked Christine to help him out. Your real objective is to help Christine to see more of the way the Microsoft world lives and use @@ -31,7 +31,7 @@ these systems to make sure that Abmas is not building islands of technology. You ask Christine to do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make the right decision, don't you? -
Recent Samba mailing list activity is witness to how many sites are using winbind. Some have no trouble at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning an inability to achieve identical user and group IDs between Windows and UNIX environments. @@ -39,18 +39,18 @@ You provide step-by-step implementations of the various tools that can be used for identity resolution. You also provide working examples of solutions for integrated authentication for both UNIX/Linux and Windows environments. -
+
One of the great challenges we face when people ask us, “What is the best way to solve this problem?” is to get beyond the facts so we can not only clearly comprehend the immediate technical problem, but also understand how needs may change. -
There are a few facts we should note when dealing with the question of how best to integrate UNIX/Linux clients and servers into a Windows networking environment: -
A Domain Controller (PDC or BDC) is always authoritative for all accounts in its Domain. This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs to the same values that the PDC resolved them to. -
A Domain Member can be authoritative for local accounts, but is never authoritative for Domain accounts. If a user is accessing a Domain Member server and that user's account is not known locally, the Domain Member server must resolve the identity of that user @@ -60,24 +60,24 @@ Samba, when running on a Domain Member server, can resolve user identities from a number of sources: -
By executing a system getpwnam() or getgrnam() call. On systems that support it, this utilizes the name service switch (NSS) facility to resolve names according to the configuration of the /etc/nsswitch.conf file. NSS can be configured to use LDAP, winbind, NIS, or local files. -
Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). This requires the use of the PADL nss_ldap tool (or equivalent). -
Directly by querying winbindd. The winbindd contact a Domain Controller to attempt to resolve the identity of the user or group. It receives the Windows networking security identifier (SID) for that appropriate account and then allocates a local UID or GID from the range of available IDs and creates an entry in its winbindd_idmap.tdb and winbindd_cache.tdb files. -
If the parameter - idmap backend = ldap:ldap://myserver.domain + idmap backend = ldap:ldap://myserver.domain was specified and the LDAP server has been configured with a container in which it may store the IDMAP entries, all Domain Members may share a common mapping.
@@ -89,30 +89,30 @@ Which of the above resolver methods is chosen is determined by the way that Samba is configured in the smb.conf file. Some of the configuration options are rather less than obvious to the casual user. -
If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable of being resolved using) the name service switch (NSS) facility, it is imperative to use the - winbind enable local accounts = Yes + winbind enable local accounts = Yes in the smb.conf file. This parameter specifically applies only to Domain Controllers, not to Domain Member servers. -
For many administrators, it should be plain that the use of an LDAP-based repository for all network accounts (both for Posix accounts as well as for Samba accounts) provides the most elegant and controllable facility. You eventually appreciate the decision to use LDAP. -
If your network account information resides in an LDAP repository, you should use it ahead of any alternative method. This means that if it is humanly possible to use the nss_ldap tools to resolve UNIX account UIDs/GIDs via LDAP, this is the preferred solution, as it provides a more readily controllable method for asserting the exact same user and group identifiers throughout the network. -
In the situation where UNIX accounts are held on the Domain Member server itself, the only effective way to use them involves the smb.conf entry - winbind trusted domains only = Yes. This forces + winbind trusted domains only = Yes. This forces Samba (smbd) to perform a getpwnam() system call that can then be controlled via /etc/nsswitch.conf file settings. The use of this parameter disables the use of Samba with Trusted Domains (i.e., External Domains). -
Winbind can be used to create an appliance mode Domain Member server. In this capacity, winbindd is configured to automatically allocate UIDs/GIDs from numeric ranges set in the smb.conf file. The allocation is made for all accounts that connect to that Domain Member server, whether within its own Domain or from @@ -120,12 +120,12 @@ This means that it is almost certain that a given user who accesses two Domain Member servers does not have the same UID/GID on both servers however, this is transparent to the Windows network user. This data is stored in the winbindd_idmap.tdb and winbindd_cache.tdb files. -
The use of an LDAP backend for the Winbind IDMAP facility permits Windows Domain security identifiers (SIDs) mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all Domain Member servers so configured. This solves one of the major headaches for network administrators who need to copy files between/across network file servers. -
One of the most fierce conflicts recently being waged is one of resistance to the adoption of LDAP, in particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP is different and requires a new approach to the need for a better identity management solution. The more @@ -136,30 +136,30 @@ heterogenous by design. This is fundamental it isn't religious or political. This also doesn't say that you can't use Windows Active Directory in a heterogenous environment it can be done, it just requires commercial integration products it's just not what Active Directory was designed for. -
A number of long-term UNIX devotees have recently commented in various communications that the Samba Team is the first application group to almost force network administrators to use LDAP. It should be pointed out that we resisted this as long as we could. It is not out of laziness or out of malice that LDAP has finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total organizational directory needs. -
The Domain Member server and the Domain Member client are at the center of focus in this chapter. Configuration of Samba-3 Domain Controller has been covered in earlier chapters, so if your interest is in Domain Controller configuration, you will not find that here. You will find good oil that helps you to add Domain Member servers and clients. -
In practice, Domain Member servers and Domain Member workstations are very different entities, but in terms of technology they share similar core infrastructure. A technologist would argue that servers and workstations are identical. Many users would argue otherwise, given that in a well-disciplined environment a workstation (client) is a device from which a user creates documents and files that are located on servers. A workstation is frequently viewed as a disposable (easy to replace) item, but a server is viewed as a core component of the business. -
One can look at this another way. If a workstation breaks down, one user is affected, but if a server breaks down, hundreds of users may not be able to work. The services that a workstation must provide are document and file production oriented; a server provides information storage and is distribution oriented. -
Why is this important? For starters, we must identify what components of the operating system and its environment must be configured. Also, it is necessary to recognize where the interdependencies between the various services to be used are. @@ -170,7 +170,7 @@
So, while here we demonstrate how to implement the technology. It is done within a context of what type of service need must be fulfilled. -
In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using an LDAP ldapsam backend. In this example, we are adding to the LDAP backend database (directory) containers for use by the IDMAP facility. This makes it possible to have globally consistent @@ -179,24 +179,24 @@ this operational context) is to permit mapping of foreign SIDs (those not originating from our own Domain). Foreign SIDs can come from any external Domain or from Windows clients that do not belong to a Domain. -
If your installation is accessed only from clients that are members of your own domain, then it is not necessary to run winbindd as long as all users can be resolved locally via the getpwnam() system call. On NSS-enabled systems, this condition is met by having: -
Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs via multiple methods. The methods typically include: files, compat, db, ldap, nis, nisplus, hesoid. When correctly installed, Samba adds to this list the winbindd facility. The ldap facility is frequently the nss_ldap tool provided by PADL Software. -
The diagram in ??? demonstrates the relationship of samba and system components that are involved in the Identity resolution process where Samba is used as a Domain Member server within a Samba Domain Control network. -
In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam to obtain authentication and user identity information. The IDMAP information is stored in the LDAP backend so that it can be shared by all Domain Member servers so that every user will have a @@ -207,10 +207,10 @@ The instructions given here apply to the Samba environment as shown in Chapters 6 and 7. If your network does not have an LDAP slave server (i.e., Chapter 6 configuration), you must change the target LDAP server from lapdc to massive. -
Procedure 10.1. Configuration of LDAP-Based Identity Resolution
+
Procedure 10.1. Configuration of LDAP-Based Identity Resolution
Create the smb.conf file as shown in ???. Locate this file in the directory /etc/samba. -
Configure the file that will be used by nss_ldap to locate and communicate with the LDAP server. This file is called ldap.conf. If your implementation of nss_ldap is consistent with @@ -227,7 +227,7 @@
Configure the name service switch (NSS) control file so it matches the one shown in ???. -
Before proceeding to configure Samba, validate the operation of the NSS Identity resolution via LDAP by executing:
@@ -262,14 +262,14 @@ PIOps:x:1002: sammy:x:4321:
- + This shows that all is working as it should. Notice that in the LDAP database the users primary and secondary group memberships are identical. It is not necessary to add secondary group memberships (in the group database) if the user is already a member via primary group membership in the password database. When using winbind, it is in fact undesirable to do this as it results in doubling up of group memberships and may break winbind under certain conditions. -
The LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -278,7 +278,7 @@ dn: ou=Idmap,dc=abmas,dc=biz ou: idmap
- + If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see ???). You can add the required entries using the following command:
@@ -286,7 +286,7 @@ -w not24get < /etc/openldap/idmap.LDIF
Samba automatically populates this LDAP directory container when it needs to. -
The system is ready to join the Domain. Execute the following:
root# net rpc join -U root%not24et @@ -294,7 +294,7 @@
This indicates that the Domain join succeeded.
- + Just joining the Domain is not quite enough, you must now provide a privilidged set of credentials through which winbindd can interact with the ADS Domain servers. Execute the following to implant the necessary credentials: @@ -305,79 +305,79 @@
You may now start Samba in the usual manner and your Samba Domain Member server is ready for use. Just add shares as required. -
Example 10.1. Samba Domain Member in Samba Domain Control Context smb.conf File
# Global parameters [global] + Example 10.1. Samba Domain Member in Samba Domain Control Context smb.conf File
# Global parameters [global] - unix charset = LOCALE + unix charset = LOCALE - workgroup = MEGANET2 + workgroup = MEGANET2 - security = DOMAIN + security = DOMAIN - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 10 + log level = 10 - syslog = 0 + syslog = 0 - log file = /var/log/samba/%m + log file = /var/log/samba/%m - max log size = 50 + max log size = 50 - smb ports = 139 445 + smb ports = 139 445 - name resolve order = wins bcast hosts + name resolve order = wins bcast hosts - printcap name = CUPS + printcap name = CUPS - wins server = 192.168.2.1 + wins server = 192.168.2.1 - ldap suffix = dc=abmas,dc=biz + ldap suffix = dc=abmas,dc=biz - ldap machine suffix = ou=People + ldap machine suffix = ou=People - ldap user suffix = ou=People + ldap user suffix = ou=People - ldap group suffix = ou=Groups + ldap group suffix = ou=Groups - ldap idmap suffix = ou=Idmap + ldap idmap suffix = ou=Idmap - ldap admin dn = cn=Manager,dc=abmas,dc=biz + ldap admin dn = cn=Manager,dc=abmas,dc=biz - idmap backend = ldap:ldap://lapdc.abmas.biz + idmap backend = ldap:ldap://lapdc.abmas.biz - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 + idmap gid = 10000-20000 - winbind trusted domains only = Yes + winbind trusted domains only = Yes - printer admin = root + printer admin = root - printing = cups [homes] + printing = cups [homes] - comment = Home Directories + comment = Home Directories - valid users = %S + valid users = %S - read only = No + read only = No - browseable = No [printers] + browseable = No [printers] - comment = SMB Print Spool + comment = SMB Print Spool - path = /var/spool/samba + path = /var/spool/samba - guest ok = Yes + guest ok = Yes - printable = Yes + printable = Yes - browseable = No [print$] + browseable = No [print$] - comment = Printer Drivers + comment = Printer Drivers - path = /var/lib/samba/drivers + path = /var/lib/samba/drivers - admin users = root, Administrator + admin users = root, Administrator write list = root Example 10.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
dn: ou=Idmap,dc=abmas,dc=biz @@ -424,37 +424,37 @@ There are mitigating circumstances forcing a decision not to use LDAP.
The Samba Domain Member server must be part of a Windows NT4 Domain. -
Later in the chapter, you can see how to configure a Samba Domain Member server for a Windows ADS Domain. Right now your objective is to configure a Samba server that can be a member of a Windows NT4 style Domain and/or does not use LDAP. -
Note
Note
If you use winbind for Identity resolution, do make sure that there are no duplicate accounts. -
For example, do not have more than one account that has UID=0 in the password database. If there is an account called root in the /etc/passwd database, it is okay to have an account called root in the LDAP ldapsam or in the tdbsam. But if there are two accounts in the passdb backend that have the same UID, winbind will break. This means that the Administrator account must be called root. -
Winbind will break if there is an account in /etc/passwd that has the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. -
The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. The winbind information is locally cached in the winbindd_cache.tdb winbindd_idmap.tdb files. This provides considerable performance benefits compared with the LDAP solution, particularly where the LDAP lookups must traverse wide-area network links. You may examine the contents of these files using the tool tdbdump, though you may have to build this from the Samba source code if it has not been supplied as part of a binary package distribution that you may be using. -
Procedure 10.2. Configuration of Winbind-Based Identity Resolution
+
Procedure 10.2. Configuration of Winbind-Based Identity Resolution
Using your favorite text editor, create the smb.conf file so it has the contents shown in ???. -
Edit the /etc/nsswitch.conf so it has the entries shown in ???. -
The system is ready to join the Domain. Execute the following:
net rpc join -U root%not24et @@ -462,7 +462,7 @@
This indicates that the Domain join succeed. -
Validate operation of winbind using the wbinfo tool as follows:
@@ -488,7 +488,7 @@ MEGANET2+PIOps
This shows that Domain groups have been correctly obtained also. -
The next step verifies that NSS is able to obtain this information correctly from winbind also.
@@ -529,71 +529,71 @@
The Samba member server of a Windows NT4 Domain is ready for use. -
Example 10.5. Samba Domain Member Server smb.conf File for NT4 Domain
# Global parameters [global] + Example 10.5. Samba Domain Member Server smb.conf File for NT4 Domain
# Global parameters [global] - unix charset = LOCALE + unix charset = LOCALE - workgroup = MEGANET2 + workgroup = MEGANET2 - security = DOMAIN + security = DOMAIN - username map = /etc/samba/smbusers + username map = /etc/samba/smbusers - log level = 1 + log level = 1 - syslog = 0 + syslog = 0 - log file = /var/log/samba/%m + log file = /var/log/samba/%m - max log size = 0 + max log size = 0 - smb ports = 139 445 + smb ports = 139 445 - name resolve order = wins bcast hosts + name resolve order = wins bcast hosts - printcap name = CUPS + printcap name = CUPS - wins server = 192.168.2.1 + wins server = 192.168.2.1 - idmap uid = 10000-20000 + idmap uid = 10000-20000 - idmap gid = 10000-20000 + idmap gid = 10000-20000 - template primary group = "Domain Users" + template primary group = "Domain Users" - template shell = /bin/bash + template shell = /bin/bash - winbind separator = + + winbind separator = + - printer admin = root + printer admin = root - hosts allow = 192.168.2., 192.168.3., 127. + hosts allow = 192.168.2., 192.168.3., 127. - printing = cups [homes] + printing = cups [homes] - comment = Home Directories + comment = Home Directories - valid users = %S + valid users = %S - read only = No + read only = No - browseable = No [printers] + browseable = No [printers] - comment = SMB Print Spool + comment = SMB Print Spool - path = /var/spool/samba + path = /var/spool/samba - guest ok = Yes + guest ok = Yes - printable = Yes + printable = Yes - browseable = No [print$] + browseable = No [print$] - comment = Printer Drivers + comment = Printer Drivers - path = /var/lib/samba/drivers + path = /var/lib/samba/drivers - admin users = root, Administrator + admin users = root, Administrator write list = root Example 10.6. Name Service Switch Control File: /etc/nsswitch.conf
# /etc/nsswitch.conf @@ -615,14 +615,14 @@ bootparams: files automount: files aliases: files -
One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory Domain using Kerberos protocols. This makes it possible to operate an entire Windows network without the need to run NetBIOS over TCP/IP and permits more secure networking in general. An exhaustively complete discussion of the protocols is not possible in this book; perhaps a later book may explore the intricacies of the NetBIOS-less operation that Samba-3 can participate in. For now, we simply focus on how a Samba-3 server can be made a Domain Member server. -
The diagram in ??? demonstrates how Samba-3 interfaces with Microsoft Active Directory components. It should be noted that if Microsoft Windows Services for UNIX has been installed and correctly configured, it is possible to use client LDAP @@ -646,7 +646,7 @@ name of the server is W2K3S. In ADS realm terms, the Domain Controller is known as w2k3s.london.abmas.biz. In NetBIOS nomenclature, the Domain Name is LONDON and the server name is W2K3S. -
Before you try to use Samba-3, you want to know for certain that your executables have support for Kerberos and for LDAP. Execute the following to identify whether or not this build is perhaps suitable for use: @@ -712,7 +712,7 @@
This does look promising; smbd has been built with Kerberos and LDAP support. You are relieved to know that it is safe to progress. -
The next step is to identify which version of the Kerberos libraries have been used. In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is essential that it has been linked with either MIT Kerberos version 1.3.1 or later, @@ -740,7 +740,7 @@ in ???.
Edit or create the NSS control file so it has the contents shown in ???. -
Delete the file /etc/samba/secrets.tdb, if it exists. Of course, you do keep a backup, don't you?
@@ -750,7 +750,7 @@
root# rm /var/lib/samba/*tdb
-
Validate your smb.conf file using testparm (as you have done previously). Correct all errors reported before proceeding. The command you execute is: @@ -759,7 +759,7 @@
Now that you are satisfied that your Samba server is ready to join the Windows ADS Domain, let's move on. -
This is a good time to double-check everything and then execute the following command when everything you have done has checked out okay:
@@ -769,14 +769,14 @@
You have successfully made your Samba-3 server a member of the ADS Domain using Kerberos protocols. -
In the event that you receive no output messages, a silent return means that the Domain join failed. You should use ethereal to identify what may be failing. Common causes of a failed join include: -
Restrictive security settings on the Windows 200x ADS Domain controller preventing needed communications protocols. You can check this by searching the Windows Server 200x Event Viewer. @@ -787,12 +787,12 @@ Kerberos (or Heimdal) in use is not up to date enough to support the necessary functionality.
- + In any case, never execute the net rpc join command in an attempt to join the Samba server to the Domain, unless you wish not to use the Kerberos security protocols. Use of the older RPC-based Domain join facility requires that Windows Server 200x ADS has been configured appropriately for mixed mode operation. -
If the tdbdump is installed on your system (not essential), you can look inside the /etc/samba/secrets.tdb file. If you wish to do this, execute: @@ -822,7 +822,7 @@
It is now time to start Samba in the usual way (as has been done many time before in this book). -
This is a good time to verify that everything is working. First, check that winbind is able to obtain the list of users and groups from the ADS Domain Controller. Execute the following: @@ -848,7 +848,7 @@ LONDON+
