diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/manpages/net.8.html samba-3.0.21b/docs/htmldocs/manpages/net.8.html --- samba-3.0.21a/docs/htmldocs/manpages/net.8.html 2005-12-29 10:21:58.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/manpages/net.8.html 2006-01-29 10:15:54.000000000 -0600 @@ -1,13 +1,13 @@ net

Name

net — Tool for administration of Samba and remote CIFS servers. -

Synopsis

net {<ads|rap|rpc>} [-h] [-w workgroup] [-W myworkgroup] [-U user] [-I ip-address] [-p port] [-n myname] [-s conffile] [-S server] [-l] [-P] [-D debuglevel]

DESCRIPTION

This tool is part of the samba(7) suite.

The samba net utility is meant to work just like the net utility +

Synopsis

net {<ads|rap|rpc>} [-h] [-w workgroup] [-W myworkgroup] [-U user] [-I ip-address] [-p port] [-n myname] [-s conffile] [-S server] [-l] [-P] [-d debuglevel] [-V]

DESCRIPTION

This tool is part of the samba(7) suite.

The samba net utility is meant to work just like the net utility available for windows and DOS. The first argument should be used to specify the protocol to use when executing a certain command. ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3) clients and RPC can be used for NT4 and Windows 2000. If this argument is omitted, net will try to determine it automatically. Not all commands are available on all protocols. -

OPTIONS

-h|--help

Print a summary of command line options. +

OPTIONS

-h|--help

Print a summary of command line options.

-w target-workgroup

Sets target workgroup or domain. You have to specify either this option or the IP address or the name of a server. @@ -24,7 +24,7 @@ Defaults to trying 445 first, then 139.

-n <primary NetBIOS name>

This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the parameter in the smb.conf file. +to setting the parameter in the smb.conf file. However, a command line setting will take precedence over settings in smb.conf.

-s <configuration file>

The file specified contains the @@ -53,19 +53,19 @@ investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

Note that specifying this parameter here will -override the parameter -in the smb.conf file.

COMMANDS

CHANGESECRETPW

This command allows the Samba machine account password to be set from an external application +override the parameter +in the smb.conf file.

COMMANDS

CHANGESECRETPW

This command allows the Samba machine account password to be set from an external application to a machine account password that has already been stored in Active Directory. DO NOT USE this command unless you know exactly what you are doing. The use of this command requires that the force flag (-f) be used also. There will be NO command prompt. Whatever information is piped into stdin, either by typing at the command line or otherwise, will be stored as the literal machine password. Do NOT use this without care and attention as it will overwrite a legitimate machine password without warning. YOU HAVE BEEN WARNED. -

TIME

The NET TIME command allows you to view the time on a remote server - or synchronise the time on the local server with the time on the remote server.

TIME

Without any options, the NET TIME command +

TIME

The NET TIME command allows you to view the time on a remote server + or synchronise the time on the local server with the time on the remote server.

TIME

Without any options, the NET TIME command displays the time on the remote server. -

TIME SYSTEM

Displays the time on the remote server in a format ready for /bin/date

TIME SET

Tries to set the date and time of the local server to that on -the remote server using /bin/date.

TIME ZONE

Displays the timezone in hours from GMT on the remote computer.

[RPC|ADS] JOIN [TYPE] [-U username[%password]] [options]

+

TIME SYSTEM

Displays the time on the remote server in a format ready for /bin/date

TIME SET

Tries to set the date and time of the local server to that on +the remote server using /bin/date.

TIME ZONE

Displays the timezone in hours from GMT on the remote computer.

[RPC|ADS] JOIN [TYPE] [-U username[%password]] [options]

Join a domain. If the account already exists on the server, and [TYPE] is MEMBER, the machine will attempt to join automatically. (Assuming that the machine has been created in server manager) @@ -73,71 +73,71 @@ be created.

[TYPE] may be PDC, BDC or MEMBER to specify the type of server joining the domain. -

[RPC] OLDJOIN [options]

Join a domain. Use the OLDJOIN option to join the domain +

[RPC] OLDJOIN [options]

Join a domain. Use the OLDJOIN option to join the domain using the old style of domain joining - you need to create a trust -account in server manager first.

[RPC|ADS] USER

[RPC|ADS] USER

List all users

[RPC|ADS] USER DELETE target

Delete specified user

[RPC|ADS] USER INFO target

List the domain groups of a the specified user.

[RPC|ADS] USER RENAME oldname newname

Rename specified user.

[RPC|ADS] USER ADD name [password] [-F user flags] [-C comment]

Add specified user.

[RPC|ADS] GROUP

[RPC|ADS] GROUP [misc options] [targets]

List user groups.

[RPC|ADS] GROUP DELETE name [misc. options]

Delete specified group.

[RPC|ADS] GROUP ADD name [-C comment]

Create specified group.

[RAP|RPC] SHARE

[RAP|RPC] SHARE [misc. options] [targets]

Enumerates all exported resources (network shares) on target server.

[RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets]

Adds a share from a server (makes the export active). Maxusers +account in server manager first.

[RPC|ADS] USER

[RPC|ADS] USER

List all users

[RPC|ADS] USER DELETE target

Delete specified user

[RPC|ADS] USER INFO target

List the domain groups of a the specified user.

[RPC|ADS] USER RENAME oldname newname

Rename specified user.

[RPC|ADS] USER ADD name [password] [-F user flags] [-C comment]

Add specified user.

[RPC|ADS] GROUP

[RPC|ADS] GROUP [misc options] [targets]

List user groups.

[RPC|ADS] GROUP DELETE name [misc. options]

Delete specified group.

[RPC|ADS] GROUP ADD name [-C comment]

Create specified group.

[RAP|RPC] SHARE

[RAP|RPC] SHARE [misc. options] [targets]

Enumerates all exported resources (network shares) on target server.

[RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets]

Adds a share from a server (makes the export active). Maxusers specifies the number of users that can be connected to the -share simultaneously.

SHARE DELETE sharenam

Delete specified share.

[RPC|RAP] FILE

[RPC|RAP] FILE

List all open files on remote server.

[RPC|RAP] FILE CLOSE fileid

Close file with specified fileid on -remote server.

[RPC|RAP] FILE INFO fileid

+share simultaneously.

SHARE DELETE sharenam

Delete specified share.

[RPC|RAP] FILE

[RPC|RAP] FILE

List all open files on remote server.

[RPC|RAP] FILE CLOSE fileid

Close file with specified fileid on +remote server.

[RPC|RAP] FILE INFO fileid

Print information on specified fileid. Currently listed are: file-id, username, locks, path, permissions. -

[RAP|RPC] FILE USER

Note

Currently NOT implemented.

SESSION

RAP SESSION

Without any other options, SESSION enumerates all active SMB/CIFS -sessions on the target server.

RAP SESSION DELETE|CLOSE CLIENT_NAME

Close the specified sessions.

RAP SESSION INFO CLIENT_NAME

Give a list with all the open files in specified session.

RAP SERVER DOMAIN

List all servers in specified domain or workgroup. Defaults -to local domain.

RAP DOMAIN

Lists all domains and workgroups visible on the -current network.

RAP PRINTQ

RAP PRINTQ LIST QUEUE_NAME

Lists the specified print queue and print jobs on the server. +

[RAP|RPC] FILE USER

Note

Currently NOT implemented.

SESSION

RAP SESSION

Without any other options, SESSION enumerates all active SMB/CIFS +sessions on the target server.

RAP SESSION DELETE|CLOSE CLIENT_NAME

Close the specified sessions.

RAP SESSION INFO CLIENT_NAME

Give a list with all the open files in specified session.

RAP SERVER DOMAIN

List all servers in specified domain or workgroup. Defaults +to local domain.

RAP DOMAIN

Lists all domains and workgroups visible on the +current network.

RAP PRINTQ

RAP PRINTQ LIST QUEUE_NAME

Lists the specified print queue and print jobs on the server. If the QUEUE_NAME is omitted, all -queues are listed.

RAP PRINTQ DELETE JOBID

Delete job with specified id.

RAP VALIDATE user [password]

+queues are listed.

RAP PRINTQ DELETE JOBID

Delete job with specified id.

RAP VALIDATE user [password]

Validate whether the specified user can log in to the remote server. If the password is not specified on the commandline, it will be prompted. -

Note

Currently NOT implemented.

RAP GROUPMEMBER

RAP GROUPMEMBER LIST GROUP

List all members of the specified group.

RAP GROUPMEMBER DELETE GROUP USER

Delete member from group.

RAP GROUPMEMBER ADD GROUP USER

Add member to group.

RAP ADMIN command

Execute the specified command on +

Note

Currently NOT implemented.

RAP GROUPMEMBER

RAP GROUPMEMBER LIST GROUP

List all members of the specified group.

RAP GROUPMEMBER DELETE GROUP USER

Delete member from group.

RAP GROUPMEMBER ADD GROUP USER

Add member to group.

RAP ADMIN command

Execute the specified command on the remote server. Only works with OS/2 servers. -

Note

Currently NOT implemented.

RAP SERVICE

RAP SERVICE START NAME [arguments...]

Start the specified service on the remote server. Not implemented yet.

Note

Currently NOT implemented.

RAP SERVICE STOP

Stop the specified service on the remote server.

Note

Currently NOT implemented.

RAP PASSWORD USER OLDPASS NEWPASS

+

Note

Currently NOT implemented.

RAP SERVICE

RAP SERVICE START NAME [arguments...]

Start the specified service on the remote server. Not implemented yet.

Note

Currently NOT implemented.

RAP SERVICE STOP

Stop the specified service on the remote server.

Note

Currently NOT implemented.

RAP PASSWORD USER OLDPASS NEWPASS

Change password of USER from OLDPASS to NEWPASS. -

LOOKUP

LOOKUP HOST HOSTNAME [TYPE]

+

LOOKUP

LOOKUP HOST HOSTNAME [TYPE]

Lookup the IP address of the given host with the specified type (netbios suffix). The type defaults to 0x20 (workstation). -

LOOKUP LDAP [DOMAIN

Give IP address of LDAP server of specified DOMAIN. Defaults to local domain.

LOOKUP KDC [REALM]

Give IP address of KDC for the specified REALM. -Defaults to local realm.

LOOKUP DC [DOMAIN]

Give IP's of Domain Controllers for specified -DOMAIN. Defaults to local domain.

LOOKUP MASTER DOMAIN

Give IP of master browser for specified DOMAIN -or workgroup. Defaults to local domain.

CACHE

Samba uses a general caching interface called 'gencache'. It +

LOOKUP LDAP [DOMAIN

Give IP address of LDAP server of specified DOMAIN. Defaults to local domain.

LOOKUP KDC [REALM]

Give IP address of KDC for the specified REALM. +Defaults to local realm.

LOOKUP DC [DOMAIN]

Give IP's of Domain Controllers for specified +DOMAIN. Defaults to local domain.

LOOKUP MASTER DOMAIN

Give IP of master browser for specified DOMAIN +or workgroup. Defaults to local domain.

CACHE

Samba uses a general caching interface called 'gencache'. It can be controlled using 'NET CACHE'.

All the timeout parameters support the suffixes:

s - Seconds
m - Minutes
h - Hours
d - Days
w - Weeks

-

CACHE ADD key data time-out

Add specified key+data to the cache with the given timeout.

CACHE DEL key

Delete key from the cache.

CACHE SET key data time-out

Update data of existing cache entry.

CACHE SEARCH PATTERN

Search for the specified pattern in the cache data.

CACHE LIST

+

CACHE ADD key data time-out

Add specified key+data to the cache with the given timeout.

CACHE DEL key

Delete key from the cache.

CACHE SET key data time-out

Update data of existing cache entry.

CACHE SEARCH PATTERN

Search for the specified pattern in the cache data.

CACHE LIST

List all current items in the cache. -

CACHE FLUSH

Remove all the current items from the cache.

GETLOCALSID [DOMAIN]

Print the SID of the specified domain, or if the parameter is -omitted, the SID of the domain the local server is in.

SETLOCALSID S-1-5-21-x-y-z

Sets domain sid for the local server to the specified SID.

GROUPMAP

Manage the mappings between Windows group SIDs and UNIX groups. +

CACHE FLUSH

Remove all the current items from the cache.

GETLOCALSID [DOMAIN]

Print the SID of the specified domain, or if the parameter is +omitted, the SID of the domain the local server is in.

SETLOCALSID S-1-5-21-x-y-z

Sets domain sid for the local server to the specified SID.

GROUPMAP

Manage the mappings between Windows group SIDs and UNIX groups. Parameters take the for "parameter=value". Common options include:

  • unixgroup - Name of the UNIX group

  • ntgroup - Name of the Windows NT group (must be resolvable to a SID

  • rid - Unsigned 32-bit integer

  • sid - Full SID in the form of "S-1-..."

  • type - Type of the group; either 'domain', 'local', - or 'builtin'

  • comment - Freeform text description of the group

GROUPMAP ADD

+ or 'builtin'

  • comment - Freeform text description of the group

    • GROUPMAP ADD

    Add a new group mapping entry: 

     net groupmap add {rid=int|sid=string} unixgroup=string \
       [type={domain|local}] [ntgroup=string] [comment=string]

    -

    GROUPMAP DELETE

    Delete a group mapping entry. If more then one group name matches, the first entry found is deleted.

    net groupmap delete {ntgroup=string|sid=SID}

    GROUPMAP MODIFY

    Update en existing group entry

    +

    GROUPMAP DELETE

    Delete a group mapping entry. If more then one group name matches, the first entry found is deleted.

    net groupmap delete {ntgroup=string|sid=SID}

    GROUPMAP MODIFY

    Update en existing group entry

     net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \
        [comment=string] [type={domain|local}]

    -

    GROUPMAP LIST

    List existing group mapping entries

    net groupmap list [verbose] [ntgroup=string] [sid=SID]

    MAXRID

    Prints out the highest RID currently in use on the local +

    GROUPMAP LIST

    List existing group mapping entries

    net groupmap list [verbose] [ntgroup=string] [sid=SID]

    MAXRID

    Prints out the highest RID currently in use on the local server (by the active 'passdb backend'). -

    RPC INFO

    Print information about the domain of the remote server, +

    RPC INFO

    Print information about the domain of the remote server, such as domain name, domain sid and number of users and groups. -

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for +

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for DOMAIN to the remote server. -

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for +

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for DOMAIN from the remote server. -

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    +

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    Establish a trust relationship to a trusting domain. Interdomain account must already be created on the remote PDC. -

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC RIGHTS

    This subcommand is used to view and manage Samba's rights assignments (also +

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC RIGHTS

    This subcommand is used to view and manage Samba's rights assignments (also referred to as privileges). There are three options current available: list, grant, and revoke. More details on Samba's privilege model and its use -can be found in the Samba-HOWTO-Collection.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    +can be found in the Samba-HOWTO-Collection.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    Reboot after shutdown.

    -f

    Force shutting down all applications. @@ -145,22 +145,22 @@ Timeout before system will be shut down. An interactive user of the system can use this time to cancel the shutdown.

    -C message

    Display the specified message on the screen to -announce the shutdown.

    SAMDUMP

    Print out sam database of remote server. You need -to run this on either a BDC.

    VAMPIRE

    Export users, aliases and groups from remote server to +announce the shutdown.

    SAMDUMP

    Print out sam database of remote server. You need +to run this on either a BDC.

    VAMPIRE

    Export users, aliases and groups from remote server to local server. Can only be run an a BDC. -

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. +

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. Prints out quite some debug info. Aimed at developers, regular -users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    +users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    Lookup info for PRINTER on SERVER. The printer name defaults to "*", the -server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The +server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The expression is a standard LDAP search expression, and the attributes are a list of LDAP fields to show in the results.

    Example: net ads search '(objectCategory=group)' sAMAccountName -

    ADS DN DN (attributes)

    +

    ADS DN DN (attributes)

    Perform a raw LDAP search on a ADS server and dump the results. The DN standard LDAP DN, and the attributes are a list of LDAP fields to show in the result. -

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba - suite.

    AUTHOR

    The original Samba software and related utilities +

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba + suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The net manpage was written by Jelmer Vernooij.

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/manpages/smb.conf.5.html samba-3.0.21b/docs/htmldocs/manpages/smb.conf.5.html --- samba-3.0.21a/docs/htmldocs/manpages/smb.conf.5.html 2005-12-29 10:22:26.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/manpages/smb.conf.5.html 2006-01-29 10:16:20.000000000 -0600 @@ -197,7 +197,7 @@ (Win95), Windows NT (WinNT), Windows 2000 (Win2K), Windows XP (WinXP), and Windows 2003 (Win2K3). Anything else will be known as - UNKNOWN.

    %I

    the IP address of the client machine.

    %i

    the local IP address to which a client connected.

    %T

    the current date and time.

    %D

    name of the domain or workgroup of the current user.

    %$(envvar)

    the value of the environment variable + UNKNOWN.

    %I

    the IP address of the client machine.

    %i

    the local IP address to which a client connected.

    %T

    the current date and time.

    %D

    name of the domain or workgroup of the current user.

    %w

    the winbind separator.

    %$(envvar)

    the value of the environment variable envar.

    The following substitutes apply only to some configuration options (only those that are used when a connection has been established): @@ -229,8 +229,8 @@

    default case = upper/lower

    controls what the default case is for new filenames (ie. files that don't currently exist in the filesystem). Default lower. IMPORTANT NOTE: This option will be used to modify the case of - all incoming client filenames, not just new filenames if the options case sensitive = yes, preserve case = No, - short preserve case = No are set. This change is needed as part of the + all incoming client filenames, not just new filenames if the options case sensitive = yes, preserve case = No, + short preserve case = No are set. This change is needed as part of the optimisations for directories containing large numbers of files.

    preserve case = yes/no

    controls whether new files (ie. files that don't currently exist in the filesystem) are created with the case @@ -276,8 +276,8 @@

  • If the service is a guest service, a connection is made as the username given in the guest account = for the service, irrespective of the supplied password. -

    • EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This a full path name to a script called by smbd(8) that - should stop a shutdown procedure issued by the shutdown script.

    If the connected user posseses the SeRemoteShutdownPrivilege, +

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This a full path name to a script called by smbd(8) that + should stop a shutdown procedure issued by the shutdown script.

    If the connected user posseses the SeRemoteShutdownPrivilege, right, this command will be run as user.

    Default: abort shutdown script =

    Example: abort shutdown script = /sbin/shutdown -c @@ -327,7 +327,7 @@ directory hierarchy in much the same was as Windows. This allows all members of a UNIX group to control the permissions on a file or directory they have group ownership on.

    - This parameter is best used with the inherit owner option and also + This parameter is best used with the inherit owner option and also on on a share containing directories with the UNIX setgid bit bit set on them, which causes new files and directories created within it to inherit the group ownership from the containing directory. @@ -412,7 +412,7 @@ with the new share.

    This parameter is only used for add file shares. To add printer shares, - see the addprinter command. + see the addprinter command.

    Default: add share command =

    Example: add share command = /usr/local/bin/addshare @@ -429,16 +429,16 @@ ON DEMAND when a user accesses the Samba server.

    In order to use this option, smbd(8) must NOT be set to - security = share and add user script + security = share and add user script must be set to a full pathname for a script that will create a UNIX user given one argument of %u, which expands into the UNIX user name to create.

    When the Windows user attempts to access the Samba server, at login (session setup in - the SMB protocol) time, smbd(8) contacts the password server + the SMB protocol) time, smbd(8) contacts the password server and attempts to authenticate the given user with the given password. If the authentication succeeds then smbd attempts to find a UNIX user in the UNIX password database to map the Windows user into. If this lookup fails, and - add user script is set then smbd will + add user script is set then smbd will call the specified script AS ROOT, expanding any %u argument to be the user name to create.

    @@ -446,8 +446,8 @@ continue on as though the UNIX user already existed. In this way, UNIX users are dynamically created to match existing Windows NT accounts.

    - See also security, password server, - delete user script. + See also security, password server, + delete user script.

    Default: add user script =

    Example: add user script = /usr/local/samba/bin/add_user %u @@ -468,7 +468,7 @@ administrative privileges on the share. This means that they will do all file operations as the super-user (root).

    You should use this option very carefully, as any user in this list will be able to do anything they like on the share, - irrespective of file permissions.

    This parameter will not work with the security = share in + irrespective of file permissions.

    This parameter will not work with the security = share in Samba 3.0. This is by design.

    Default: admin users =

    Example: admin users = jason @@ -518,7 +518,7 @@ # (to disable roundups)

    allow trusted domains (G)

    - This option only takes effect when the security option is set to + This option only takes effect when the security option is set to server,domain or ads. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running @@ -553,7 +553,7 @@

    auth methods (G)

    This option allows the administrator to chose what authentication methods smbd - will use when authenticating a user. This option defaults to sensible values based on security. + will use when authenticating a user. This option defaults to sensible values based on security. This should be considered a developer option and used only in rare circumstances. In the majority (if not all) of production servers, the default setting should be adequate.

    @@ -581,33 +581,33 @@ to limit what interfaces on a machine will serve SMB requests. It affects file service smbd(8) and name service nmbd(8) in a slightly different ways.

    For name service it causes nmbd to bind to ports 137 and 138 on the - interfaces listed in the interfaces parameter. nmbd + interfaces listed in the interfaces parameter. nmbd also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of reading broadcast messages. If this option is not set then nmbd will - service name requests on all of these sockets. If bind interfaces only is set then + service name requests on all of these sockets. If bind interfaces only is set then nmbd will check the source address of any packets coming in on the broadcast sockets and discard any that don't match the broadcast addresses of the interfaces in the - interfaces parameter list. As unicast packets are received on the other sockets it + interfaces parameter list. As unicast packets are received on the other sockets it allows nmbd to refuse to serve names to machines that send packets that - arrive through any interfaces not listed in the interfaces list. IP Source address + arrive through any interfaces not listed in the interfaces list. IP Source address spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for nmbd.

    - For file service it causes smbd(8) to bind only to the interface list given in the interfaces parameter. This restricts the networks that smbd will + For file service it causes smbd(8) to bind only to the interface list given in the interfaces parameter. This restricts the networks that smbd will serve to packets coming in those interfaces. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with non-permanent interfaces.

    - If bind interfaces only is set then unless the network address - 127.0.0.1 is added to the interfaces parameter list + If bind interfaces only is set then unless the network address + 127.0.0.1 is added to the interfaces parameter list smbpasswd(8) and swat(8) may not work as expected due to the reasons covered below.

    To change a users SMB password, the smbpasswd by default connects to the localhost - 127.0.0.1 address as an SMB client to issue the password change request. If - bind interfaces only is set then unless the network address - 127.0.0.1 is added to the interfaces parameter list then smbpasswd will fail to connect in it's default mode. smbpasswd can be forced to use the primary IP interface of the local host by using + bind interfaces only is set then unless the network address + 127.0.0.1 is added to the interfaces parameter list then smbpasswd will fail to connect in it's default mode. smbpasswd can be forced to use the primary IP interface of the local host by using its smbpasswd(8) -r remote machine parameter, with remote machine set to the IP name of the primary interface of the local host.

    @@ -647,7 +647,7 @@ set to yes. You should never need to change this.

    Default: browse list = yes -

    casesignames

    This parameter is a synonym for case sensitive.

    case sensitive (S)

    See the discussion in the section name mangling.

    Default: case sensitive = no +

    casesignames

    This parameter is a synonym for case sensitive.

    case sensitive (S)

    See the discussion in the section name mangling.

    Default: case sensitive = no

    change notify timeout (G)

    This SMB allows a client to tell a server to "watch" a particular directory for any changes and only reply to @@ -724,9 +724,9 @@

    client schannel (G)

    This controls whether the client offers or even demands the use of the netlogon schannel. - client schannel = no does not offer the schannel, - client schannel = auto offers the schannel but does not - enforce it, and client schannel = yes denies access + client schannel = no does not offer the schannel, + client schannel = auto offers the schannel but does not + enforce it, and client schannel = yes denies access if the server is not able to speak netlogon schannel.

    Default: client schannel = auto @@ -750,7 +750,7 @@ when a client does a queries the server, either via the network neighborhood or via net view to list what shares are available.

    If you want to set the string that is displayed next to the - machine name then see the server string parameter.

    Default: comment = + machine name then see the server string parameter.

    Default: comment = # No comment

    Example: comment = Fred's Files @@ -785,13 +785,13 @@ write and execute bits from the UNIX modes.

    Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the - force create mode parameter which is set to 000 by default. + force create mode parameter which is set to 000 by default.

    - This parameter does not affect directory masks. See the parameter directory mask + This parameter does not affect directory masks. See the parameter directory mask for details.

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the - administrator wishes to enforce a mask on access control lists also, they need to set the security mask. + administrator wishes to enforce a mask on access control lists also, they need to set the security mask.

    Default: create mask = 0744

    Example: create mask = 0775 @@ -803,13 +803,13 @@ These values correspond to those used on Windows servers.

    For example, shares containing roaming profiles can have offline caching disabled using - csc policy = disable. + csc policy = disable.

    Default: csc policy = manual

    Example: csc policy = programs

    cups options (S)

    - This parameter is only applicable if printing is + This parameter is only applicable if printing is set to cups. Its value is a free form string of options passed directly to the cups library.

    @@ -828,7 +828,7 @@

    Example: cups options = "raw,media=a4,job-sheets=secret,secret"

    cups server (G)

    - This parameter is only applicable if printing is set to cups. + This parameter is only applicable if printing is set to cups.

    If set, this option overrides the ServerName option in the CUPS client.conf. This is necessary if you have virtual samba servers that connect to different CUPS daemons. @@ -852,7 +852,7 @@ Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this boolean parameter adds microsecond resolution to the timestamp message header when turned on.

    - Note that the parameter debug timestamp must be on for this to have an effect. + Note that the parameter debug timestamp must be on for this to have an effect.

    Default: debug hires timestamp = no

    debug pid (G)

    @@ -860,12 +860,12 @@ message. This boolean parameter is adds the process-id to the timestamp message headers in the logfile when turned on.

    - Note that the parameter debug timestamp must be on for this to have an effect. + Note that the parameter debug timestamp must be on for this to have an effect.

    Default: debug pid = no

    timestamp logs

    This parameter is a synonym for debug timestamp.

    debug timestamp (G)

    Samba debug log messages are timestamped by default. If you are running at a high - debug level these timestamps can be distracting. This + debug level these timestamps can be distracting. This boolean parameter allows timestamping to be turned off.

    Default: debug timestamp = yes @@ -873,13 +873,13 @@ Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the current euid, egid, uid and gid to the timestamp message headers in the log file if turned on.

    - Note that the parameter debug timestamp must be on for this to have an effect. + Note that the parameter debug timestamp must be on for this to have an effect.

    Default: debug uid = no -

    default case (S)

    See the section on name mangling - . Also note the short preserve case parameter.

    Default: default case = lower +

    default case (S)

    See the section on name mangling + . Also note the short preserve case parameter.

    Default: default case = lower -

    default devmode (S)

    This parameter is only applicable to printable services. +

    default devmode (S)

    This parameter is only applicable to printable services. When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba server has a Device Mode which defines things such as paper size and orientation and duplex settings. The device mode can only correctly be @@ -908,7 +908,7 @@ given in the parameter value (see example below).

    There is no default value for this parameter. If this parameter is not given, attempting to connect to a nonexistent service results in an error.

    - Typically the default service would be a guest ok, read-only service.

    Also note that the apparent service name will be changed to equal + Typically the default service would be a guest ok, read-only service.

    Also note that the apparent service name will be changed to equal that of the requested service, this is very useful as it allows you to use macros like %S to make a wildcard service.

    Note also that any "_" characters in the name of the service used in the default service will get mapped to a "/". This allows for @@ -940,12 +940,12 @@ possible to delete printer at run time by issuing the DeletePrinter() RPC call.

    For a Samba host this means that the printer must be physically deleted from underlying printing system. The - deleteprinter command defines a script to be run which + deleteprinter command defines a script to be run which will perform the necessary operations for removing the printer from the print system and from smb.conf. -

    The deleteprinter command is - automatically called with only one parameter: printer name. -

    Once the deleteprinter command has +

    The deleteprinter command is + automatically called with only one parameter: printer name. +

    Once the deleteprinter command has been executed, smbd will reparse the smb.conf to associated printer no longer exists. If the sharename is still valid, then smbd @@ -975,7 +975,7 @@ the existing service.

    This parameter is only used to remove file shares. To delete printer shares, - see the deleteprinter command. + see the deleteprinter command.

    Default: delete share command =

    Example: delete share command = /usr/local/bin/delshare @@ -1000,7 +1000,7 @@

    delete veto files (S)

    This option is used when Samba is attempting to delete a directory that contains one or more vetoed directories - (see the veto files + (see the veto files option). If this option is set to no (the default) then if a vetoed directory contains any non-vetoed files or directories then the directory delete will fail. This is usually what you want.

    If this option is set to yes, then Samba @@ -1008,7 +1008,7 @@ the vetoed directory. This can be useful for integration with file serving systems such as NetAtalk which create meta-files within directories you might normally veto DOS/Windows users from seeing - (e.g. .AppleDouble)

    Setting delete veto files = yes allows these + (e.g. .AppleDouble)

    Setting delete veto files = yes allows these directories to be transparently deleted when the parent directory is deleted (so long as the user has permissions to do so).

    Default: delete veto files = no @@ -1020,7 +1020,7 @@

    This is a new parameter introduced in Samba version 3.0.21. It specifies in seconds the time that smbd will cache the output of a disk free query. If set to zero (the default) no caching is done. This allows a heavily - loaded server to prevent rapid spawning of dfree command scripts increasing the load. + loaded server to prevent rapid spawning of dfree command scripts increasing the load.

    By default this parameter is zero, meaning no caching will be done.

    No default

    Example: dfree cache time = dfree cache time = 60 @@ -1036,7 +1036,7 @@ function.

    In Samba version 3.0.21 this parameter has been changed to be a per-share parameter, and in addition the - parameter dfree cache time was added to allow the output of this script to be cached + parameter dfree cache time was added to allow the output of this script to be cached for systems under heavy load.

    The external program will be passed a single parameter indicating a directory in the filesystem being queried. @@ -1074,10 +1074,10 @@ created.

    The default value of this parameter removes the 'group' and 'other' write bits from the UNIX mode, allowing only the user who owns the directory to modify it.

    Following this Samba will bit-wise 'OR' the UNIX mode - created from this parameter with the value of the force directory mode parameter. + created from this parameter with the value of the force directory mode parameter. This parameter is set to 000 by default (i.e. no extra mode bits are added).

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce - a mask on access control lists also, they need to set the directory security mask.

    Default: directory mask = 0755 + a mask on access control lists also, they need to set the directory security mask.

    Default: directory mask = 0755

    Example: directory mask = 0775 @@ -1086,7 +1086,7 @@ permission on a directory using the native NT security dialog box.

    This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not - in this mask from being modified. Make sure not to mix up this parameter with force directory security mode, which works similar like this one but uses logical OR instead of AND. + in this mask from being modified. Make sure not to mix up this parameter with force directory security mode, which works similar like this one but uses logical OR instead of AND. Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change.

    If not set explicitly this parameter is set to 0777 meaning a user is allowed to modify all the user/group/world @@ -1118,7 +1118,7 @@

    display charset (G)

    Specifies the charset that samba will use to print messages to stdout and stderr and SWAT will use. - Should generally be the same as the unix charset. + Should generally be the same as the unix charset.

    Default: display charset = ASCII

    Example: display charset = UTF8 @@ -1135,7 +1135,7 @@

    domain logons (G)

    If set to yes, the Samba server will provide the netlogon service for Windows 9X network logons for the - workgroup it is in. + workgroup it is in. This will also cause the Samba server to act as a domain controller for NT4 style domain services. For more details on setting up this feature see the Domain Control chapter of the @@ -1146,25 +1146,25 @@ Tell smbd(8) to enable WAN-wide browse list collation. Setting this option causes nmbd to claim a special domain specific NetBIOS name that identifies it as a domain master browser for its given - workgroup. Local master browsers in the same workgroup on + workgroup. Local master browsers in the same workgroup on broadcast-isolated subnets will give this nmbd their local browse lists, and then ask smbd(8) for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet.

    - Note that Windows NT Primary Domain Controllers expect to be able to claim this workgroup specific special NetBIOS name that identifies them as domain master browsers for that - workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting + Note that Windows NT Primary Domain Controllers expect to be able to claim this workgroup specific special NetBIOS name that identifies them as domain master browsers for that + workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting to do this). This means that if this parameter is set and nmbd claims the - special name for a workgroup before a Windows NT PDC is able to do so then cross + special name for a workgroup before a Windows NT PDC is able to do so then cross subnet browsing will behave strangely and may fail.

    - If domain logons = yes, then the default behavior is to enable the - domain master parameter. If domain logons is not enabled (the - default setting), then neither will domain master be enabled by default. + If domain logons = yes, then the default behavior is to enable the + domain master parameter. If domain logons is not enabled (the + default setting), then neither will domain master be enabled by default.

    - When domain logons = Yes the default setting for this parameter is - Yes, with the result that Samba will be a PDC. If domain master = No, + When domain logons = Yes the default setting for this parameter is + Yes, with the result that Samba will be a PDC. If domain master = No, Samba will function as a BDC. In general, this parameter should be set to 'No' only on a BDC.

    Default: domain master = auto @@ -1278,7 +1278,7 @@

    In order for encrypted passwords to work correctly smbd(8) must either have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up - and maintain this file), or set the security = [server|domain|ads] parameter which + and maintain this file), or set the security = [server|domain|ads] parameter which causes smbd to authenticate against another server.

    Default: encrypt passwords = yes @@ -1354,7 +1354,7 @@ cache file data. With some oplock types the client may even cache file open/close operations. This can give enormous performance benefits.

    When you set fake oplocks = yes, smbd(8) will - always grant oplock requests no matter how many clients are using the file.

    It is generally much better to use the real oplocks support rather + always grant oplock requests no matter how many clients are using the file.

    It is generally much better to use the real oplocks support rather than this parameter.

    If you enable this option on all read-only shares or shares that you know will only be accessed from one client at a time such as physically read-only media like CDROMs, you will see @@ -1404,7 +1404,7 @@ the UNIX permission on a directory using the native NT security dialog box.

    This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this - mask that the user may have modified to be on. Make sure not to mix up this parameter with directory security mask, which works in a similar manner to this one, but uses a logical AND instead + mask that the user may have modified to be on. Make sure not to mix up this parameter with directory security mask, which works in a similar manner to this one, but uses a logical AND instead of an OR.

    Essentially, this mask may be treated as a set of bits that, when modifying security on a directory, @@ -1438,7 +1438,7 @@ that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share. All other users will retain their ordinary primary group.

    - If the force user parameter is also set the group specified in + If the force user parameter is also set the group specified in force group will override the primary group set in force user.

    Default: force group = @@ -1472,7 +1472,7 @@ the UNIX permission on a file using the native NT security dialog box.

    This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this - mask that the user may have modified to be on. Make sure not to mix up this parameter with security mask, which works similar like this one but uses logical AND instead of OR. + mask that the user may have modified to be on. Make sure not to mix up this parameter with security mask, which works similar like this one but uses logical AND instead of OR.

    Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file, the user has always set to be on. @@ -1540,10 +1540,10 @@

    getwd cache (G)

    This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially - when the wide smbconfoptions parameter is set to no.

    Default: getwd cache = yes + when the wide smbconfoptions parameter is set to no.

    Default: getwd cache = yes

    guest account (G)

    This is a username which will be used for access - to services which are specified as guest ok (see below). Whatever privileges this + to services which are specified as guest ok (see below). Whatever privileges this user has will be available to any client connecting to the guest service. This user must exist in the password file, but does not require a valid login. The user account "ftp" is often a good choice @@ -1562,14 +1562,14 @@

    public

    This parameter is a synonym for guest ok.

    guest ok (S)

    If this parameter is yes for a service, then no password is required to connect to the service. - Privileges will be those of the guest account.

    This paramater nullifies the benifits of setting - restrict anonymous = 2 -

    See the section below on security for more information about this option. + Privileges will be those of the guest account.

    This paramater nullifies the benifits of setting + restrict anonymous = 2 +

    See the section below on security for more information about this option.

    Default: guest ok = no

    only guest

    This parameter is a synonym for guest only.

    guest only (S)

    If this parameter is yes for a service, then only guest connections to the service are permitted. - This parameter will have no effect if guest ok is not set for the service.

    See the section below on security for more information about this option. + This parameter will have no effect if guest ok is not set for the service.

    See the section below on security for more information about this option.

    Default: guest only = no

    hide dot files (S)

    This is a boolean parameter that controls whether @@ -1611,7 +1611,7 @@

    Default: hide unwriteable files = no

    homedir map (G)

    - If nis homedir is yes, and smbd(8) is also acting as a Win95/98 logon server + If nis homedir is yes, and smbd(8) is also acting as a Win95/98 logon server then this parameter specifies the NIS (or YP) map from which the server for the user's home directory should be extracted. At present, only the Sun auto.home map format is understood. The form of the map is: 

    @@ -1629,7 +1629,7 @@
 	If set to yes, Samba will act as a Dfs server, and allow Dfs-aware clients to browse
 	Dfs trees hosted on the server.
 	
    
-	See also the msdfs root share  level  parameter.  For more  information  on
+	See also the msdfs root share  level  parameter.  For more  information  on
 	setting  up a Dfs tree on Samba, refer to the MSFDS chapter in the book Samba3-HOWTO.
 	
    Default: host msdfs = no
 
@@ -1641,7 +1641,7 @@
 
 
    Example: hostname lookups = yes
 
-
    allow hosts

    This parameter is a synonym for hosts allow.

    hosts allow (S)

    A synonym for this parameter is allow hosts.

    This parameter is a comma, space, or tab delimited +

    allow hosts

    This parameter is a synonym for hosts allow.

    hosts allow (S)

    A synonym for this parameter is allow hosts.

    This parameter is a comma, space, or tab delimited set of hosts which are permitted to access a service.

    If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting.

    You can specify the hosts by name or IP number. For @@ -1651,7 +1651,7 @@ page hosts_access(5). Note that this man page may not be present on your system, so a brief description will be given here also.

    Note that the localhost address 127.0.0.1 will always - be allowed access unless specifically denied by a hosts deny option.

    You can also specify hosts by network/netmask pairs and + be allowed access unless specifically denied by a hosts deny option.

    You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but @@ -1668,7 +1668,7 @@ list takes precedence.

    In the event that it is necessary to deny all by default, use the keyword ALL (or the netmask 0.0.0.0/0) and then explicitly specify - to the hosts allow = hosts allow parameter those hosts + to the hosts allow = hosts allow parameter those hosts that should be permitted access.

    Default: hosts deny = # none (i.e., no hosts specifically excluded) @@ -1678,7 +1678,7 @@

    hosts equiv (G)

    If this global parameter is a non-null string, it specifies the name of a file to read for the names of hosts and users who will be allowed access without specifying a password. -

    This is not be confused with hosts allow which is about hosts +

    This is not be confused with hosts allow which is about hosts access to services and is more useful for guest services. hosts equiv may be useful for NT clients which will not supply passwords to Samba.

    Note

    The use of hosts equiv @@ -1759,12 +1759,12 @@ roaming profile directory are actually owner by the user.

    Default: inherit owner = no

    inherit permissions (S)

    - The permissions on new files and directories are normally governed by create mask, - directory mask, force create mode and force directory mode but the boolean inherit permissions parameter overrides this. + The permissions on new files and directories are normally governed by create mask, + directory mask, force create mode and force directory mode but the boolean inherit permissions parameter overrides this.

    New directories inherit the mode of the parent directory, including bits such as setgid.

    New files inherit their read/write bits from the parent directory. Their execute bits continue to be - determined by map archive, map hidden and map system as usual. + determined by map archive, map hidden and map system as usual.

    Note that the setuid bit is never set via inheritance (the code explicitly prohibits this).

    This can be particularly useful on large systems with many users, perhaps several thousand, to allow a single [homes] @@ -1815,7 +1815,7 @@

    Example: invalid users = root fred admin @wheel

    iprint server (G)

    - This parameter is only applicable if printing is set to iprint. + This parameter is only applicable if printing is set to iprint.

    If set, this option overrides the ServerName option in the CUPS client.conf. This is necessary if you have virtual samba servers that connect to different CUPS daemons. @@ -1828,7 +1828,7 @@ packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.

    Keepalives should, in general, not be needed if the socket - has the SO_KEEPALIVE attribute set on it by default. (see socket options). + has the SO_KEEPALIVE attribute set on it by default. (see socket options). Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600 @@ -1840,7 +1840,7 @@ change notification to user programs, using the F_NOTIFY fcntl.

    Default: kernel change notify = yes -

    kernel oplocks (G)

    For UNIXes that support kernel based oplocks +

    kernel oplocks (G)

    For UNIXes that support kernel based oplocks (currently only IRIX and the Linux 2.4 kernel), this parameter allows the use of them to be turned on or off.

    Kernel oplocks support allows Samba oplocks to be broken whenever a local UNIX process or NFS operation @@ -1877,13 +1877,13 @@ tested as some other Samba code paths.

    Default: large readwrite = yes

    ldap admin dn (G)

    - The ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact - the ldap server when retreiving user account information. The ldap admin dn is used + The ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact + the ldap server when retreiving user account information. The ldap admin dn is used in conjunction with the admin dn password stored in the private/secrets.tdb file. See the smbpasswd(8) man page for more information on how to accomplish this.

    - The ldap admin dn requires a fully specified DN. The ldap suffix is not appended to the ldap admin dn. + The ldap admin dn requires a fully specified DN. The ldap suffix is not appended to the ldap admin dn.

    No default

    ldap delete dn (G)

    This parameter specifies whether a delete operation in the ldapsam deletes the complete entry or only the attributes specific to Samba. @@ -1891,23 +1891,23 @@

    ldap group suffix (G)

    This parameters specifies the suffix that is used for groups when these are added to the LDAP directory. - If this parameter is unset, the value of ldap suffix will be used instead. The suffix string is pre-pended to the - ldap suffix string so use a partial DN.

    Default: ldap group suffix = + If this parameter is unset, the value of ldap suffix will be used instead. The suffix string is pre-pended to the + ldap suffix string so use a partial DN.

    Default: ldap group suffix =

    Example: ldap group suffix = ou=Groups

    ldap idmap suffix (G)

    This parameters specifies the suffix that is used when storing idmap mappings. If this parameter - is unset, the value of ldap suffix will be used instead. The suffix - string is pre-pended to the ldap suffix string so use a partial DN. + is unset, the value of ldap suffix will be used instead. The suffix + string is pre-pended to the ldap suffix string so use a partial DN.

    Default: ldap idmap suffix =

    Example: ldap idmap suffix = ou=Idmap

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree. If this parameter is unset, the value of - ldap suffix will be used instead. The suffix string is pre-pended to the - ldap suffix string so use a partial DN. + ldap suffix will be used instead. The suffix string is pre-pended to the + ldap suffix string so use a partial DN.

    Default: ldap machine suffix =

    Example: ldap machine suffix = ou=Computers @@ -1917,7 +1917,7 @@ and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password change via SAMBA.

    - The ldap passwd sync can be set to one of three values: + The ldap passwd sync can be set to one of three values:

    ldap suffix (G)

    Specifies the base for all ldap suffixes and for storing the sambaDomain object.

    - The ldap suffix will be appended to the values specified for the ldap user suffix, - ldap group suffix, ldap machine suffix, and the - ldap idmap suffix. Each of these should be given only a DN relative to the - ldap suffix. + The ldap suffix will be appended to the values specified for the ldap user suffix, + ldap group suffix, ldap machine suffix, and the + ldap idmap suffix. Each of these should be given only a DN relative to the + ldap suffix.

    Default: ldap suffix =

    Example: ldap suffix = dc=samba,dc=org @@ -2002,8 +2002,8 @@

    ldap user suffix (G)

    This parameter specifies where users are added to the tree. If this parameter is unset, - the value of ldap suffix will be used instead. The suffix - string is pre-pended to the ldap suffix string so use a partial DN. + the value of ldap suffix will be used instead. The suffix + string is pre-pended to the ldap suffix string so use a partial DN.

    Default: ldap user suffix =

    Example: ldap user suffix = ou=people @@ -2022,9 +2022,9 @@ or waited for) and told to break their oplocks to "none" and delete any read-ahead caches.

    It is recommended that this parameter be turned on to speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    - Currently, if kernel oplocks are supported then + Currently, if kernel oplocks are supported then level2 oplocks are not granted (even if this parameter is set to - yes). Note also, the oplocks + yes). Note also, the oplocks parameter must be set to yes on this share in order for this parameter to have any effect.

    Default: level2 oplocks = yes @@ -2036,27 +2036,27 @@ If set to no Samba will never produce these broadcasts. If set to yes Samba will produce Lanman announce broadcasts at a frequency set by the parameter - lm interval. If set to auto + lm interval. If set to auto Samba will not send Lanman announce broadcasts by default but will listen for them. If it hears such a broadcast on the wire it will then start sending them at a frequency set by the parameter - lm interval.

    Default: lm announce = auto + lm interval.

    Default: lm announce = auto

    Example: lm announce = yes

    lm interval (G)

    If Samba is set to produce Lanman announce broadcasts needed by OS/2 clients (see the - lm announce parameter) then this + lm announce parameter) then this parameter defines the frequency in seconds with which they will be made. If this is set to zero then no Lanman announcements will be - made despite the setting of the lm announce + made despite the setting of the lm announce parameter.

    Default: lm interval = 60

    Example: lm interval = 120

    load printers (G)

    A boolean variable that controls whether all printers in the printcap will be loaded for browsing by default. - See the printers section for + See the printers section for more details.

    Default: load printers = yes

    local master (G)

    This option allows nmbd(8) to try and become a local master browser @@ -2071,7 +2071,7 @@

    lock dir

    This parameter is a synonym for lock directory.

    lock directory (G)

    This option specifies the directory where lock files will be placed. The lock files are used to implement the - max connections option. + max connections option.

    Default: lock directory = ${prefix}/var/locks

    Example: lock directory = /var/run/samba/locks @@ -2098,7 +2098,7 @@

    lock spin time (G)

    The time in microseconds that smbd should pause before attempting to gain a failed lock. See - lock spin count for more details.

    Default: lock spin time = 10 + lock spin count for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name of the Samba log file (also known as the debug file). @@ -2117,7 +2117,7 @@

    logon drive (G)

    This parameter specifies the local path to which the home directory will be - connected (see logon home) and is only used by NT + connected (see logon home) and is only used by NT Workstations.

    Note that this option is only useful if Samba is set up as a logon server. @@ -2144,12 +2144,12 @@ in a NetUserGetInfo request. Win9X clients truncate the info to \\server\share when a user does net use /home but use the whole string when dealing with profiles.

    - Note that in prior versions of Samba, the logon path was returned rather than + Note that in prior versions of Samba, the logon path was returned rather than logon home. This broke net use /home but allowed profiles outside the home directory. The current implementation is correct, and can be used for profiles if you use the above trick.

    - Disable this feature by setting logon home = "" - using the empty string. + Disable this feature by setting logon home = "" - using the empty string.

    This option is only useful if Samba is set up as a logon server.

    Default: logon home = \\%N\%U @@ -2160,7 +2160,7 @@ This parameter specifies the directory where roaming profiles (Desktop, NTuser.dat, etc) are stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles. To find out how to handle roaming profiles for Win 9X system, see the - logon home parameter. + logon home parameter.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. It also specifies the directory from which the "Application Data", (desktop, start menu, network neighborhood, programs and other @@ -2189,7 +2189,7 @@ provided system tool.

    Note that this option is only useful if Samba is set up as a domain controller.

    Disable the use of roaming profiles by setting the value of this parameter to the empty string. For - example, logon path = "". Take note that even if the default setting + example, logon path = "". Take note that even if the default setting in the smb.conf file is the empty string, any value specified in the user account settings in the passdb backend will over-ride the effect of setting this parameter to null. Disabling of all roaming profile use requires that the user account settings must also be blank. @@ -2206,7 +2206,7 @@ must contain the DOS style CR/LF line endings. Using a DOS-style editor to create the file is recommended.

    The script must be a relative path to the [netlogon] service. If the [netlogon] - service specifies a path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the file that will be downloaded is: + service specifies a path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the file that will be downloaded is: 

     	/usr/local/samba/netlogon/STARTUP.BAT

    @@ -2246,7 +2246,7 @@ will have the SPOOLED or PRINTING status.

    Note that it is good practice to include the absolute path in the lppause command as the PATH may not be available to the server.

    Default: lppause command = # Currently no default value is given to - this string, unless the value of the printing + this string, unless the value of the printing parameter is SYSV, in which case the default is : lp -i %p-%j -H hold or if the value of the printing parameter is @@ -2294,11 +2294,11 @@ executed on the server host in order to restart or continue printing or spooling a specific print job.

    This command should be a program or script which takes a printer name and job number to resume the print job. See - also the lppause command parameter.

    If a %p is given then the printer name + also the lppause command parameter.

    If a %p is given then the printer name is put in its place. A %j is replaced with the job number (an integer).

    Note that it is good practice to include the absolute path in the lpresume command as the PATH may not - be available to the server.

    See also the printing parameter.

    Default: Currently no default value is given + be available to the server.

    See also the printing parameter.

    Default: Currently no default value is given to this string, unless the value of the printing parameter is SYSV, in which case the default is :

    lp -i %p-%j -H resume

    or if the value of the printing parameter is SOFTQ, then the default is:

    qstat -s -j%j -r

    Default: lpresume command = lpresume command = /usr/bin/lpalt %p-%j -p2 @@ -2321,18 +2321,18 @@

    Default: lprm command = determined by printing parameter

    machine password timeout (G)

    - If a Samba server is a member of a Windows NT Domain (see the security = domain parameter) then periodically a running smbd process will try and change + If a Samba server is a member of a Windows NT Domain (see the security = domain parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called private/secrets.tdb . This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in seconds), the same as a Windows NT Domain member server.

    See also smbpasswd(8), - and the security = domain parameter. + and the security = domain parameter.

    Default: machine password timeout = 604800

    magic output (S)

    This parameter specifies the name of a file which will contain output created by a magic script (see the - magic script parameter below). + magic script parameter below).

    Warning

    If two clients use the same magic script in the same directory the output file content is undefined.

    Default: magic output = <magic script name>.out @@ -2345,7 +2345,7 @@ executed on behalf of the connected user.

    Scripts executed in this way will be deleted upon completion assuming that the user has the appropriate level of privilege and the file permissions allow the deletion.

    If the script generates output, output will be sent to - the file specified by the magic output + the file specified by the magic output parameter (see above).

    Note that some shells are unable to interpret scripts containing CR/LF instead of CR as the end-of-line marker. Magic scripts must be executable @@ -2366,7 +2366,7 @@ So to map html to htm you would use:

    - mangled map = (*.html *.htm). + mangled map = (*.html *.htm).

    One very useful case is to remove the annoying ;1 off the ends of filenames on some CDROMs (only visible under some UNIXes). To do this use a map of @@ -2378,7 +2378,7 @@

    mangled names (S)

    This controls whether non-DOS names under UNIX should be mapped to DOS-compatible names ("mangled") and made visible, - or whether non-DOS names should simply be ignored.

    See the section on name mangling for + or whether non-DOS names should simply be ignored.

    See the section on name mangling for details on how to control the mangling process.

    If mangling is used then the mangling algorithm is as follows:

    mangling char (S)

    This controls what character is used as - the magic character in name mangling. The + the magic character in name mangling. The default is a '~' but this may interfere with some software. Use this option to set it to whatever you prefer. This is effective only when mangling method is hash.

    Default: mangling char = ~ @@ -2445,23 +2445,23 @@ any file it touches from becoming executable under UNIX. This can be quite annoying for shared source code, documents, etc...

    - Note that this requires the create mask parameter to be set such that owner + Note that this requires the create mask parameter to be set such that owner execute bit is not masked out (i.e. it must include 100). See the parameter - create mask for details. + create mask for details.

    Default: map archive = yes

    map hidden (S)

    This controls whether DOS style hidden files should be mapped to the UNIX world execute bit.

    - Note that this requires the create mask to be set such that the world execute - bit is not masked out (i.e. it must include 001). See the parameter create mask + Note that this requires the create mask to be set such that the world execute + bit is not masked out (i.e. it must include 001). See the parameter create mask for details.

    No default

    map read only (S)

    This controls how the DOS read only attribute should be mapped from a UNIX filesystem.

    This parameter can take three different values, which tell smbd(8) how to display the read only attribute on files, where either - store dos attributes is set to No, or no extended attribute is - present. If store dos attributes is set to yes then this + store dos attributes is set to No, or no extended attribute is + present. If store dos attributes is set to yes then this parameter is ignored. This is a new parameter introduced in Samba version 3.0.21.

    The three settings are :

    Default: map read only = yes

    map system (S)

    This controls whether DOS style system files should be mapped to the UNIX group execute bit.

    - Note that this requires the create mask to be set such that the group + Note that this requires the create mask to be set such that the group execute bit is not masked out (i.e. it must include 010). See the parameter - create mask for details. + create mask for details.

    Default: map system = no -

    map to guest (G)

    This parameter is only useful in SECURITY = +

    map to guest (G)

    This parameter is only useful in SECURITY = security modes other than security = share - i.e. user, server, and domain.

    This parameter can take four different values, which tell @@ -2495,9 +2495,9 @@ default.

  • Bad User - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and - mapped into the guest account.

  • Bad Password - Means user logins + mapped into the guest account.

  • Bad Password - Means user logins with an invalid password are treated as a guest login and mapped - into the guest account. Note that + into the guest account. Note that this can cause problems as it means that any user incorrectly typing their password will be silently logged on as "guest" - and will not know the reason they cannot access files they think @@ -2527,7 +2527,7 @@ If max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.

    Record lock files are used to implement this feature. The lock files will be stored in - the directory specified by the lock directory option.

    Default: max connections = 0 + the directory specified by the lock directory option.

    Default: max connections = 0

    Example: max connections = 10 @@ -2617,7 +2617,7 @@ never need to change this parameter. The default is 3 days.

    Default: max ttl = 259200

    • max wins ttl (G)

    This option tells smbd(8) when acting as a WINS server - (wins support = yes) what the maximum + (wins support = yes) what the maximum 'time to live' of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this parameter. The default is 6 days (518400 seconds).

    Default: max wins ttl = 518400 @@ -2678,18 +2678,18 @@

    min protocol (G)

    The value of the parameter (a string) is the lowest SMB protocol dialect than Samba will support. Please refer - to the max protocol + to the max protocol parameter for a list of valid protocol names and a brief description of each. You may also wish to refer to the C source code in source/smbd/negprot.c for a listing of known protocol dialects supported by clients.

    If you are viewing this parameter as a security measure, you should - also refer to the lanman auth parameter. Otherwise, you should never need + also refer to the lanman auth parameter. Otherwise, you should never need to change this parameter.

    Default: min protocol = CORE

    Example: min protocol = NT1

    min wins ttl (G)

    This option tells nmbd(8) - when acting as a WINS server (wins support = yes) what the minimum 'time to live' + when acting as a WINS server (wins support = yes) what the minimum 'time to live' of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this parameter. The default is 6 hours (21600 seconds).

    Default: min wins ttl = 21600 @@ -2699,7 +2699,7 @@ the value of the parameter. When clients attempt to connect to this share, they are redirected to the proxied share using the SMB-Dfs protocol.

    Only Dfs roots can act as proxy shares. Take a look at the - msdfs root and host msdfs + msdfs root and host msdfs options to find out how to set up a Dfs root share.

    No default

    Example: msdfs proxy = \otherserver\someshare

    msdfs root (S)

    If set to yes, Samba treats the @@ -2735,9 +2735,9 @@ useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap._tcp.domain.

  • wins : Query a name with - the IP address listed in the WINSSERVER parameter. If no WINS server has + the IP address listed in the WINSSERVER parameter. If no WINS server has been specified this method will be ignored.

  • bcast : Do a broadcast on - each of the known local interfaces listed in the interfaces + each of the known local interfaces listed in the interfaces parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.

    • The example below will cause the local lmhosts file to be examined @@ -2789,7 +2789,7 @@ it will be mounted on the Samba client directly from the directory server. When Samba is returning the home share to the client, it will consult the NIS map specified in - homedir map and return the server + homedir map and return the server listed there.

    Note that for this option to work there must be a working NIS system and the Samba server with this option must also be a logon server.

    Default: nis homedir = no @@ -2826,7 +2826,7 @@ should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba - always ignores PAM for authentication in the case of encrypt passwords = yes. The reason + always ignores PAM for authentication in the case of encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption.

    Default: obey pam restrictions = no @@ -2837,7 +2837,7 @@ client can supply a username to be used by the server. Enabling this parameter will force the server to only use the login names from the user list and is only really - useful in security = share level security.

    Note that this also means Samba won't try to deduce + useful in security = share level security.

    Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for the [homes] section. To get around this you could use user = %S which means your user list @@ -2877,11 +2877,11 @@ docs/ directory.

    Oplocks may be selectively turned off on certain files with a share. See - the veto oplock files parameter. On some systems + the veto oplock files parameter. On some systems oplocks are recognized by the underlying operating system. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process. See the - kernel oplocks parameter for details. + kernel oplocks parameter for details.

    Default: oplocks = yes

    os2 driver map (G)

    The parameter is used to define the absolute @@ -2897,7 +2897,7 @@

    os level (G)

    This integer value controls what level Samba advertises itself as for browse elections. The value of this parameter determines whether nmbd(8) -has a chance of becoming a local master browser for the workgroup in the local broadcast area.

    +has a chance of becoming a local master browser for the workgroup in the local broadcast area.

    Note :By default, Samba will win a local master browsing election over all Microsoft operating systems except a Windows NT 4.0/2000 Domain Controller. This means that a misconfigured Samba host can effectively isolate a subnet for browsing purposes. This parameter is largely auto-configured in the Samba-3 @@ -2911,9 +2911,9 @@ this parameter, it is possible to use PAM's password change control flag for Samba. If enabled, then PAM will be used for password changes when requested by an SMB client instead of the program listed in - passwd program. + passwd program. It should be possible to enable this without changing your - passwd chat parameter for most setups.

    Default: pam password change = no + passwd chat parameter for most setups.

    Default: pam password change = no

    panic action (G)

    This is a Samba developer option that allows a system command to be called when either smbd(8) or smbd(8) crashes. This is usually used to @@ -2942,10 +2942,10 @@ backend. Takes a path to the smbpasswd file as an optional argument.

  • tdbsam - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb - in the private dir directory.

  • ldapsam - The LDAP based passdb + in the private dir directory.

  • ldapsam - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to ldap://localhost)

    LDAP connections should be secured where possible. This may be done using either - Start-TLS (see ldap ssl) or by + Start-TLS (see ldap ssl) or by specifying ldaps:// in the URL argument.

    Multiple servers may also be specified in double-quotes, if your LDAP libraries supports the LDAP URL notation. @@ -2991,15 +2991,15 @@ conversation that takes places between smbd(8) and the local password changing program to change the user's password. The string describes a sequence of response-receive pairs that smbd(8) uses to determine what to send to the - passwd program and what to expect back. If the expected output is not + passwd program and what to expect back. If the expected output is not received then the password is not changed.

    This chat sequence is often quite site specific, depending on what local methods are used for password control (such as NIS - etc).

    Note that this parameter only is only used if the unix password sync parameter is set to yes. This sequence is + etc).

    Note that this parameter only is only used if the unix password sync parameter is set to yes. This sequence is then called AS ROOT when the SMB password in the smbpasswd file is being changed, without access to the old password cleartext. This means that root must be able to reset the user's password without knowing the text of the previous password. In the presence of - NIS/YP, this means that the passwd program must + NIS/YP, this means that the passwd program must be executed on the NIS master.

    The string can contain the macro %n which is substituted for the new password. The chat sequence can also contain the standard @@ -3008,7 +3008,7 @@ a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces in them into a single string.

    If the send string in any part of the chat sequence is a full stop ".", then no string is sent. Similarly, if the - expect string is a full stop then no string is expected.

    If the pam password change parameter is set to yes, the + expect string is a full stop then no string is expected.

    If the pam password change parameter is set to yes, the chat pairs may be matched in any order, and success is determined by the PAM result, not any particular output. The \n macro is ignored for PAM conversions.

    Default: passwd chat = *new*password* %n\n*new*password* %n\n *changed* @@ -3019,13 +3019,13 @@ parameter is run in debug mode. In this mode the strings passed to and received from the passwd chat are printed in the smbd(8) log with a - debug level + debug level of 100. This is a dangerous option as it will allow plaintext passwords to be seen in the smbd log. It is available to help Samba admins debug their passwd chat scripts when calling the passwd program and should be turned off after this has been done. This option has no effect if the - pam password change + pam password change paramter is set. This parameter is off by default.

    Default: passwd chat debug = no

    • passwd chat timeout (G)

    This integer specifies the number of seconds smbd will wait for an initial @@ -3072,7 +3072,7 @@ process a new connection.

    A value of zero will cause only two attempts to be made - the password as is and the password in all-lower case.

    This parameter is used only when using plain-text passwords. It is not at all used when encrypted passwords as in use (that is the default - since samba-3.0.0). Use this only when encrypt passwords = No.

    Default: password level = 0 + since samba-3.0.0). Use this only when encrypt passwords = No.

    Default: password level = 0

    Example: password level = 4 @@ -3088,7 +3088,7 @@ Samba will use the standard LDAP port of tcp/389. Note that port numbers have no effect on password servers for Windows NT 4.0 domains or netbios connections.

    If parameter is a name, it is looked up using the - parameter name resolve order and so may resolved + parameter name resolve order and so may resolved by any method and order described in that parameter.

    The password server must be a machine capable of using the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode.

    Note

    Using a password server means your UNIX box (running @@ -3150,7 +3150,7 @@ on this connection. Any occurrences of %m will be replaced by the NetBIOS name of the machine they are connecting from. These replacements are very useful for setting - up pseudo home directories for users.

    Note that this path will be based on root dir + up pseudo home directories for users.

    Note that this path will be based on root dir if one was specified.

    Default: path =

    Example: path = /home/fred @@ -3184,13 +3184,13 @@ preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    - See also preexec close and postexec. + See also preexec close and postexec.

    Default: preexec =

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    - This boolean option controls whether a non-zero return code from preexec + This boolean option controls whether a non-zero return code from preexec should close the service being connected to.

    Default: preexec close = no @@ -3199,7 +3199,7 @@

    If this is set to yes, on startup, nmbd will force an election, and it will have a slight advantage in winning the election. It is recommended that this - parameter is used in conjunction with domain master = yes, so that + parameter is used in conjunction with domain master = yes, so that nmbd can guarantee becoming a domain master.

    Use this option with caution, because if there are several hosts (whether Samba servers, Windows 95 or NT) @@ -3213,7 +3213,7 @@ for homes and printers services that would otherwise not be visible.

    Note that if you just want all printers in your - printcap file loaded then the load printers + printcap file loaded then the load printers option is easier.

    Default: preload = @@ -3227,7 +3227,7 @@

    preserve case (S)

    This controls if new filenames are created with the case that the client passes, or if - they are forced to be the default case. + they are forced to be the default case.

    See the section on NAME MANGLING for a fuller discussion.

    Default: preserve case = yes @@ -3236,7 +3236,7 @@ clients may open, write to and submit spool files on the directory specified for the service.

    Note that a printable service will ALWAYS allow writing to the service path (user privileges permitting) via the spooling - of print data. The read only parameter controls only non-printing access to + of print data. The read only parameter controls only non-printing access to the resource.

    Default: printable = no

    printcap cache time (G)

    This option specifies the number of seconds before the printing @@ -3254,7 +3254,7 @@ /etc/printcap). See the discussion of the [printers] section above for reasons why you might want to do this.

    To use the CUPS printing interface set printcap name = cups . This should - be supplemented by an addtional setting printing = cups in the [global] + be supplemented by an addtional setting printing = cups in the [global] section. printcap name = cups will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file.

    @@ -3307,17 +3307,17 @@ printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed.

    Note that printing may fail on some UNIXes from the nobody account. If this happens then create - an alternative guest account that can print and set the guest account + an alternative guest account that can print and set the guest account in the [global] section.

    You can form quite complex print commands by realizing that they are just passed to a shell. For example the following will log a print job, print the file, then remove it. Note that ';' is the usual separator for command in shell scripts.

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    You may have to vary this command considerably depending on how you normally print files on your system. The default for - the parameter varies depending on the setting of the printing + the parameter varies depending on the setting of the printing parameter.

    Default: For printing = BSD, AIX, QNX, LPRNG or PLP :

    print command = lpr -r -P%p %s

    For printing = SYSV or HPUX :

    print command = lp -c -d%p %s; rm %s

    For printing = SOFTQ :

    print command = lp -d%p -s %s; rm %s

    For printing = CUPS : If SAMBA is compiled against - libcups, then printcap = cups + libcups, then printcap = cups uses the CUPS API to submit jobs, etc. Otherwise it maps to the System V commands with the -oraw option for printing, i.e. it @@ -3349,7 +3349,7 @@ If specified in the [global] section, the printer name given will be used for any printable service that does not have its own printer name specified.

    - The default value of the printer name may be lp on many + The default value of the printer name may be lp on many systems.

    Default: printer name = none @@ -3416,7 +3416,7 @@

    queueresume command (S)

    This parameter specifies the command to be executed on the server host in order to resume the printer queue. It is the command to undo the behavior that is caused by the - previous parameter (queuepause command).

    This command should be a program or script which takes + previous parameter (queuepause command).

    This command should be a program or script which takes a printer name as its only parameter and resumes the printer queue, such that queued jobs are resubmitted to the printer.

    This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 @@ -3436,15 +3436,15 @@

    read list (S)

    This is a list of users that are given read-only access to a service. If the connecting user is in this list - then they will not be given write access, no matter what the read only option is set - to. The list can include group names using the syntax described in the invalid users + then they will not be given write access, no matter what the read only option is set + to. The list can include group names using the syntax described in the invalid users parameter. -

    This parameter will not work with the security = share in +

    This parameter will not work with the security = share in Samba 3.0. This is by design.

    Default: read list =

    Example: read list = mary, @students -

    read only (S)

    An inverted synonym is writeable.

    If this parameter is yes, then users +

    read only (S)

    An inverted synonym is writeable.

    If this parameter is yes, then users of a service may not create or modify files in the service's directory.

    Note that a printable service (printable = yes) will ALWAYS allow writing to the directory @@ -3480,7 +3480,7 @@

    the above line would cause nmbd to announce itself to the two given IP addresses using the given workgroup names. If you leave out the - workgroup name then the one given in the workgroup parameter + workgroup name then the one given in the workgroup parameter is used instead.

    The IP addresses you choose would normally be the broadcast addresses of the remote @@ -3517,7 +3517,7 @@ that the remote machine is available, is listening, nor that it is in fact the browse master on its segment.

    - The remote browse sync may be used on networks + The remote browse sync may be used on networks where there is no WINS server, and may be used on disjoint networks where each network has its own WINS server.

    Default: remote browse sync = @@ -3579,7 +3579,7 @@ means.

    Note

    The security advantage of using restrict anonymous = 2 is removed - by setting guest ok = yes on any share. + by setting guest ok = yes on any share.

    Default: restrict anonymous = 0

    root

    This parameter is a synonym for root directory.

    root dir

    This parameter is a synonym for root directory.

    root directory (G)

    The server will chroot() (i.e. @@ -3589,7 +3589,7 @@ It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use ".." in file names to access other directories (depending on the setting of the - wide smbconfoptions parameter). + wide smbconfoptions parameter).

    Adding a root directory entry other than "/" adds an extra level of security, but at a price. It absolutely ensures that no access is given to files not in the @@ -3644,9 +3644,9 @@ want to mainly setup shares without a password (guest shares). This is commonly used for a shared printer server. It is more difficult to setup guest shares with security = user, see - the map to guestparameter for details.

    It is possible to use smbd in a + the map to guestparameter for details.

    It is possible to use smbd in a hybrid mode where it is offers both user and share - level security under different NetBIOS aliases.

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they + level security under different NetBIOS aliases.

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with @@ -3659,10 +3659,10 @@ in share level security, smbd uses several techniques to determine the correct UNIX user to use on behalf of the client.

    A list of possible UNIX usernames to match with the given - client password is constructed using the following methods :

    server schannel (G)

    This controls whether the server offers or even demands the use of the netlogon schannel. - server schannel = no does not offer the schannel, server schannel = auto offers the schannel but does not enforce it, and server schannel = yes denies access if the client is not able to speak netlogon schannel. + server schannel = no does not offer the schannel, server schannel = auto offers the schannel but does not enforce it, and server schannel = yes denies access if the client is not able to speak netlogon schannel. This is only the case for Windows NT4 before SP4.

    Please note that with this set to no you will have to apply the WindowsXP @@ -3838,8 +3838,8 @@

    short preserve case (S)

    This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced - to be the default case - . This option can be use with preserve case = yes + to be the default case + . This option can be use with preserve case = yes to permit long filenames to retain their case, while short names are lowered.

    See the section on NAME MANGLING.

    Default: short preserve case = yes @@ -3939,10 +3939,10 @@

    store dos attributes (S)

    If this parameter is set Samba attempts to first read DOS attributes (SYSTEM, HIDDEN, ARCHIVE or READ-ONLY) from a filesystem extended attribute, before mapping DOS attributes to UNIX permission bits (such - as occurs with map hidden and map readonly). When set, DOS + as occurs with map hidden and map readonly). When set, DOS attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or - directory. For no other mapping to occur as a fall-back, the parameters map hidden, - map system, map archive and map readonly must be set to off. This parameter writes the DOS attributes as a string into the extended + directory. For no other mapping to occur as a fall-back, the parameters map hidden, + map system, map archive and map readonly must be set to off. This parameter writes the DOS attributes as a string into the extended attribute named "user.DOSATTRIB". This extended attribute is explicitly hidden from smbd clients requesting an EA list. On Linux the filesystem must have been mounted with the mount option user_xattr in order for extended attributes to work, also extended attributes must be compiled into the Linux kernel. @@ -4079,8 +4079,8 @@ passwords to be made over a longer period. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to no.

    - In order for this parameter to be operative the encrypt passwords parameter must - be set to no. The default value of encrypt passwords = Yes. Note: This must be set to no for this update encrypted to work. + In order for this parameter to be operative the encrypt passwords parameter must + be set to no. The default value of encrypt passwords = Yes. Note: This must be set to no for this update encrypted to work.

    Note that even when this parameter is set a user authenticating to smbd must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd) @@ -4152,7 +4152,7 @@ they will be able to do no more damage than if they started a telnet session. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do.

    To restrict a service to a particular set of users you - can use the valid users parameter.

    If any of the usernames begin with a '@' then the name + can use the valid users parameter.

    If any of the usernames begin with a '@' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users @@ -4242,7 +4242,7 @@ Note that the remapping is applied to all occurrences of usernames. Thus if you connect to \\server\fred and fred is remapped to mary then you will actually be connecting to \\server\mary and will need to supply a password suitable for mary not - fred. The only exception to this is the username passed to the password server (if you have one). The password server will receive whatever username the client + fred. The only exception to this is the username passed to the password server (if you have one). The password server will receive whatever username the client supplies without modification.

    Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been @@ -4270,7 +4270,7 @@ # no username map

    username map script (G)

    This script is a mutually exclusive alternative to the - username map parameter. This parameter + username map parameter. This parameter specifies and external program or script that must accept a single command line option (the username transmitted in the authentication request) and return a line line on standard output (the name to which @@ -4354,11 +4354,11 @@ Each entry must be a unix path, not a DOS path and must not include the unix directory separator '/'.

    - Note that the case sensitive option is applicable in vetoing files. + Note that the case sensitive option is applicable in vetoing files.

    One feature of the veto files parameter that it is important to be aware of is Samba's behaviour when trying to delete a directory. If a directory that is to be deleted contains nothing but veto files this - deletion will fail unless you also set the delete veto files + deletion will fail unless you also set the delete veto files parameter to yes.

    Setting this parameter will affect the performance of Samba, as it will be forced to check all files @@ -4378,11 +4378,11 @@

    Default: veto files = No files or directories are vetoed.

    veto oplock files (S)

    - This parameter is only valid when the oplocks + This parameter is only valid when the oplocks parameter is turned on for a share. It allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the - veto files parameter. + veto files parameter.

    You might want to do this on files that you know will be heavily contended for by clients. A good example of this is in the NetBench SMB benchmark @@ -4554,12 +4554,12 @@

    workgroup (G)

    This controls what workgroup your server will appear to be in when queried by clients. Note that this parameter also controls the Domain name used with - the security = domain + the security = domain setting.

    Default: workgroup = WORKGROUP

    Example: workgroup = MYGROUP -

    writable

    This parameter is a synonym for writeable.

    writeable (S)

    Inverted synonym for read only.

    No default

    write cache size (S)

    If this integer parameter is set to non-zero value, +

    writable

    This parameter is a synonym for writeable.

    writeable (S)

    Inverted synonym for read only.

    No default

    write cache size (S)

    If this integer parameter is set to non-zero value, Samba will create an in-memory cache for each oplocked file (it does not do this for non-oplocked files). All writes that the client does not request @@ -4580,14 +4580,14 @@

    write list (S)

    This is a list of users that are given read-write access to a service. If the connecting user is in this list then they will be given write access, no matter - what the read only option is set to. The list can + what the read only option is set to. The list can include group names using the @group syntax.

    Note that if a user is in both the read list and the write list then they will be given write access.

    By design, this parameter will not work with the - security = share in Samba 3.0. + security = share in Samba 3.0.

    Default: write list =

    Example: write list = admin, root, @staff @@ -4608,7 +4608,7 @@

    Example: wtmp directory = /var/log/wtmp -

    WARNINGS

    +

    WARNINGS

    Although the configuration file permits service names to contain spaces, your client software may not. Spaces will be ignored in comparisons anyway, so it shouldn't be a problem - but be aware of the possibility.

    @@ -4621,8 +4621,8 @@ for an administrator easy, but the various combinations of default attributes can be tricky. Take extreme care when designing these sections. In particular, ensure that the permissions on spool directories are correct. -

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    - samba(7), smbpasswd(8), swat(8), smbd(8), nmbd(8), smbclient(1), nmblookup(1), testparm(1), testprns(1).

    AUTHOR

    +

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    + samba(7), smbpasswd(8), swat(8), smbd(8), nmbd(8), smbclient(1), nmblookup(1), testparm(1), testprns(1).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/2000users.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/2000users.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/2000users.html 2005-12-29 10:24:19.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/2000users.html 2006-01-29 10:18:12.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 6. A Distributed 2000-User Network

    Chapter 6. A Distributed 2000-User Network
    Prev Part I. Example Network Configurations Next

    Chapter 6. A Distributed 2000-User Network

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers

    +Chapter 6. A Distributed 2000-User Network

    Chapter 6. A Distributed 2000-User Network
    Prev Part I. Example Network Configurations Next

    Chapter 6. A Distributed 2000-User Network

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers

    There is something indeed mystical about things that are big. Large networks exhibit a certain magnetism and exude a sense of importance that obscures reality. You and I know that it is no more @@ -30,7 +30,7 @@ Samba are largely under control. So in this section you focus on the specifics of implementing LDAP changes, Samba changes, and approach and design of the solution and its deployment. -

    Introduction

    +

    Introduction

    Abmas is a miracle company. Most businesses would have collapsed under the weight of rapid expansion that this company has experienced. Samba is flexible, so there is no need to reinstall the whole operating @@ -39,19 +39,19 @@ and then do a near-live conversion. There is no need to reinstall a Samba server just to change the way your network should function.

    - + Network growth is common to all organizations. In this exercise, your preoccupation is with the mechanics of implementing Samba and LDAP so that network users on each network segment can work without impediment. -

    Assignment Tasks

    +

    Assignment Tasks

    Starting with the configuration files for the server called MASSIVE in ???, you now deal with the issues that are particular to large distributed networks. Your task is simple identify the challenges, consider the alternatives, and then design and implement a solution.

    - + Remember, you have users based in London (UK), Los Angeles, Washington. DC, and, three buildings in New York. A significant portion of your workforce have notebook computers and roam all over the @@ -72,18 +72,18 @@ You have outsourced all desktop deployment and management to DirectPointe. Your concern is server maintenance and third-level support. Build a plan and show what must be done. -

    Dissection and Discussion

    - - +

    Dissection and Discussion

    + + In ???, you implemented an LDAP server that provided the passdb backend for the Samba servers. You explored ways to accelerate Windows desktop profile handling and you took control of network performance.

    - - - - + + + + The implementation of an LDAP-based passdb backend (known as ldapsam in Samba parlance), or some form of database that can be distributed, is essential to permit the deployment of Samba @@ -96,8 +96,8 @@ support the range of account facilities demanded by modern network managers.

    - - + + The new tdbsam facility supports functionality that is similar to an ldapsam, but the lack of distributed infrastructure sorely limits the scope for its @@ -105,10 +105,10 @@ an XML-based backend, or for that matter, why not use an SQL-based backend? Is support for these tools broken? Answers to these questions require a bit of background.

    - - - - + + + + What is a directory? A directory is a collection of information regarding objects that can be accessed to rapidly find information that is relevant in a particular and @@ -116,19 +116,19 @@ generally more often searched (read) than updated. As a consequence, the information is organized to facilitate read access rather than to support transaction processing.

    - - - - + + + + The Lightweight Directory Access Protocol (LDAP) differs considerably from a traditional database. It has a simple search facility that uniquely makes a highly preferred mechanism for managing user identities. LDAP provides a scalable mechanism for distributing the data repository and for keeping all copies (slaves) in sync with the master repository.

    - - - + + + Samba is a flexible and powerful file and print sharing technology. It can use many external authentication sources and can be part of a total authentication and identity management @@ -136,7 +136,7 @@ are Microsoft Active Directory and LDAP. Sites that specifically wish to avoid the proprietary implications of Microsoft Active Directory naturally gravitate toward OpenLDAP.

    - + In ???, you had to deal with a locally routed network. All deployment concerns focused around making users happy, and that simply means taking control over all network practices and @@ -147,12 +147,12 @@ between offices. You must take into account the way users need to access information globally. And you must make the network robust enough so that it can sustain partial breakdown without causing loss of -productivity.

    Technical Issues

    +productivity.

    Technical Issues

    There are at least three areas that need to be addressed as you approach the challenge of designing a network solution for the newly expanded business: -

    • - User needs such as mobility and data access

    • The nature of Windows networking protocols

    • Identity management infrastructure needs

    Let's look at each in turn.

    User Needs

    +

    • + User needs such as mobility and data access

    • The nature of Windows networking protocols

    • Identity management infrastructure needs

    Let's look at each in turn.

    User Needs

    The new company has three divisions. Staff for each division are spread across the company. Some staff are office-bound and some are mobile users. Mobile users travel globally. Some spend considerable periods working in other offices. @@ -163,7 +163,7 @@ curtail user needs. Parts of the global Internet infrastructure remain shielded off for reasons outside the scope of this discussion.

    - + Decisions must be made regarding where data is to be stored, how it will be replicated (if at all), and what the network bandwidth implications are. For example, one decision that can be made is to give each office its own master @@ -174,8 +174,8 @@ This way, they can synchronize all files that have changed since each logon to the network.

    - - + + No matter which way you look at this, the bandwidth requirements for acceptable performance are substantial even if only 10 percent of staff are global data users. A company with 3,500 employees, @@ -188,11 +188,11 @@ profile involves a transfer of over 750 KB from the profile server to and from the client.

    - + Obviously then, user needs and wide-area practicalities dictate the economic and technical aspects of your network design as well as for standard operating procedures. -

    The Nature of Windows Networking Protocols

    - +

    The Nature of Windows Networking Protocols

    + Network logons that include roaming profile handling requires from 140 KB to 2 MB. The inclusion of support for a minimal set of common desktop applications can push the size of a complete profile to over 15 MB. This has substantial implications @@ -200,8 +200,8 @@ determining the nature and style of mandatory profiles that may be enforced as part of a total service-level assurance program that might be implemented.

    - - + + One way to reduce the network bandwidth impact of user logon traffic is through folder redirection. In ???, you implemented this in the new Windows XP Professional standard @@ -210,14 +210,14 @@ also be excluded from synchronization to and from the server on logon or logout. Redirected folders are analogous to network drive connections. -

    +

    Of course, network applications should only be run off local application servers. As a general rule, even with 2 Mb/sec network bandwidth, it would not make sense at all for someone who is working out of the London office to run applications off a server that is located in New York.

    - + When network bandwidth becomes a precious commodity (that is most of the time), there is a significant demand to understand network processes and to mold the limits of acceptability around the @@ -226,15 +226,15 @@ When a Windows NT4/200x/XP Professional client user logs onto the network, several important things must happen.

    • - + The client obtains an IP address via DHCP. (DHCP is necessary so that users can roam between offices.)

    • - - + + The client must register itself with the WINS and/or DNS server.

    • - + The client must locate the closest domain controller.

    • The client must log onto a domain controller and obtain as part of @@ -256,15 +256,15 @@ name both by broadcast and Unicast registration that is directed at the WINS server.

      - - + + Given that the client is already a domain member, it then sends a directed (Unicast) request to the WINS server seeking the list of IP addresses for domain controllers (NetBIOS name type 0x1C). The WINS server replies with the information requested.

      - - - + + + The client sends two netlogon mailslot broadcast requests to the local network and to each of the IP addresses returned by the WINS server. Whichever answers this request first appears to @@ -274,9 +274,9 @@ was listed in the WINS server response to a request for the list of domain controllers.

      - - - + + + The logon process begins with negotiation of the SMB/CIFS protocols that are to be used; this is followed by an exchange of information that ultimately includes the client sending the @@ -287,10 +287,10 @@ needs. A secondary fact we need to know is, what happens when local domain controllers fail or break?

      - - - - + + + + Under most circumstances, the nearest domain controller responds to the netlogon mailslot broadcast. The exception to this norm occurs when the nearest domain controller is too busy or is out @@ -299,18 +299,18 @@ domain controllers. Since there can be only one PDC, all additional domain controllers are by definition BDCs.

      - - + + The provision of sufficient servers that are BDCs is an important design factor. The second important design factor involves how each of the BDCs obtains user authentication data. That is the subject of the next section, which involves key decisions regarding Identity Management facilities. -

    Identity Management Needs

    - - - - +

    Identity Management Needs

    + + + + Network managers recognize that in large organizations users generally need to be given resource access based on needs, while being excluded from other resources for reasons of privacy. It is @@ -319,9 +319,9 @@ by which user credentials are validated and filtered and appropriate rights and privileges are allocated.

    - - - + + + Unfortunately, network resources tend to have their own Identity Management facilities, the quality and manageability of which varies from quite poor to exceptionally good. Corporations that use a mixture @@ -333,7 +333,7 @@ What was once called Yellow Pages is today known as Network Information System (NIS).

    - + NIS gained a strong following throughout the UNIX/VMS space in a short period of time and retained that appeal and use for over a decade. Security concerns and inherent limitations have caused it to enter its @@ -343,9 +343,9 @@ demands as the demand for directory services that can be coupled with other information systems is catching on.

    - - - + + + Nevertheless, both NIS and NIS+ continue to hold ground in business areas where UNIX still has major sway. Examples of organizations that remain firmly attached to the use of NIS and @@ -353,14 +353,14 @@ and large corporations that have a scientific or engineering focus.

    - - + + Today's networking world needs a scalable, distributed Identity Management infrastructure, commonly called a directory. The most popular technologies today are Microsoft Active Directory service and a number of LDAP implementations.

    - + The problem of managing multiple directories has become a focal point over the past decade, creating a large market for metadirectory products and services that allow organizations that @@ -369,15 +369,15 @@ another. The attendant benefit to end users is the promise of having to remember and deal with fewer login identities and passwords.

    - + The challenge of every large network is to find the optimum balance of internal systems and facilities for Identity Management resources. How well the solution is chosen and implemented has potentially significant impact on network bandwidth and systems response needs.

    + + - - In ???, you implemented a single LDAP server for the entire network. This may work for smaller networks, but almost certainly fails to meet the needs of large and complex networks. The @@ -386,8 +386,8 @@ What is the best method for implementing master/slave LDAP servers within the context of a distributed 2,000-user network is a question that remains to be answered.

    - - + + One possibility that has great appeal is to create a single, large distributed domain. The practical implications of this design (see ???) demands the placement of @@ -398,7 +398,7 @@ productivity against the cost of network management and maintenance.

    - + The network design in ??? takes the approach that management of networks that are too remote to be managed effectively from New York ought to be given a certain degree of @@ -409,22 +409,22 @@ the ability for network users to roam globally without some compromise in how they may access global resources.

    - + Desk-bound users need not be negatively affected by this design, since the use of interdomain trusts can be used to satisfy the need for global data sharing.

    - - - + + + When Samba-3 is configured to use an LDAP backend, it stores the domain account information in a directory entry. This account entry contains the domain SID. An unintended but exploitable side effect is that this makes it possible to operate with more than one PDC on a distributed network.

    - - - + + + How might this peculiar feature be exploited? The answer is simple. It is imperative that each network segment have its own WINS server. Major servers on remote network segments can be given a static WINS entry in @@ -434,8 +434,8 @@ same domain SID. Since all domain account information can be stored in a single LDAP backend, users have unfettered ability to roam.

    - - + + This concept has not been exhaustively validated, though we can see no reason why this should not work. The important facets are the following: The name of the domain must be identical in all locations. Each network segment must have @@ -446,10 +446,10 @@ on every network segment. Finally, the BDCs should each use failover LDAP servers that are in fact slave LDAP servers on the local segments.

    - + + + - - With a single master LDAP server, all network updates are effected on a single server. In the event that this should become excessively fragile or network bandwidth limiting, one could implement a delegated LDAP domain. This is also @@ -463,7 +463,7 @@ administrators must of necessity follow the same standard procedures for managing the directory, because retroactive correction of inconsistent directory information can be exceedingly difficult. -

    Political Issues

    +

    Political Issues

    As organizations grow, the number of points of control increases also. In a large distributed organization, it is important that the Identity Management system be capable of being updated from @@ -471,11 +471,11 @@ become usable in a reasonable period, typically minutes rather than days (the old limitation of highly manual systems). -

    Implementation

    - - - - +

    Implementation

    + + + + Samba-3 has the ability to use multiple password (authentication and identity resolution) backends. The diagram in ??? demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system @@ -483,13 +483,13 @@ authentication and identity resolution (obtaining a UNIX UID/GID) using the specific systems shown.

    Figure 6.1. Samba and Authentication Backend Search Pathways

    Samba and Authentication Backend Search Pathways

    - - - - - - - + + + + + + + Samba is capable of using the smbpasswd, tdbsam, xmlsam, and mysqlsam authentication databases. The SMB @@ -497,7 +497,7 @@ backend. LDAP is the preferred passdb backend for distributed network operations.

    - + Additionally, it is possible to use multiple passdb backends concurrently as well as have multiple LDAP backends. As a result, you can specify a failover LDAP backend. The syntax for specifying a @@ -509,8 +509,8 @@

    This configuration tells Samba to use a single LDAP server, as shown in ???.

    Figure 6.2. Samba Configuration to Use a Single LDAP Server

    Samba Configuration to Use a Single LDAP Server

    - - + + The addition of a failover LDAP server can simply be done by adding a second entry for the failover server to the single ldapsam entry, as shown here (note the particular use of the double quotes): @@ -532,7 +532,7 @@ ldapsam:ldap://slave.abmas.biz ...

    - + The effect of this style of entry is that Samba lists the users that are in both LDAP databases. If both contain the same information, it results in each record being shown twice. This is, of course, not the @@ -553,9 +553,9 @@ It is assumed that the network you are working with follows in a pattern similar to what was covered in ???. The following steps permit the operation of a master/slave OpenLDAP arrangement. -

    Procedure 6.1. Implementation Steps for an LDAP Slave Server

    1. - - +

      Procedure 6.1. Implementation Steps for an LDAP Slave Server

      1. + + Log onto the master LDAP server as root. You are about to change the configuration of the LDAP server, so it makes sense to temporarily halt it. Stop OpenLDAP from running on @@ -568,7 +568,7 @@ root# service ldap stop

      2. - + Edit the /etc/openldap/slapd.conf file so it matches the content of ???.

      3. @@ -592,8 +592,8 @@ root# slapadd -v -l admin-accts.ldif

      4. - - + + Change directory to a suitable place to dump the contents of the LDAP server. The dump file (and LDIF file) is used to preload the slave LDAP server database. You can dump the database by executing: @@ -602,7 +602,7 @@

        Each record is written to the file.

      5. - + Copy the file LDAP-transfer-LDIF.txt to the intended slave LDAP server. A good location could be in the directory /etc/openldap/preload. @@ -652,9 +652,9 @@ root# chkconfig ldap on

      6. - - - + + + Go back to the master LDAP server. Execute the following to start LDAP as well as slurpd, the synchronization daemon, as shown here: 

        @@ -663,10 +663,10 @@
 root#  rcslurpd start
 root#  chkconfig slurpd on

        - + On Red Hat Linux, check the equivalent command to start slurpd.

      7. - + On the master LDAP server you may now add an account to validate that replication is working. Assuming the configuration shown in ???, execute: 

        @@ -791,12 +791,12 @@
 index sambaPrimaryGroupSID  eq
 index sambaDomainName       eq
 index default               sub
-

      Example 6.3. Primary Domain Controller smb.conf File Part A

      # Global parameters
      [global]
      unix charset = LOCALE
      workgroup = MEGANET2
      passdb backend = ldapsam:ldap://massive.abmas.biz
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 0
      smb ports = 139
      name resolve order = wins bcast hosts
      time server = Yes
      printcap name = CUPS
      add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'
      delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'
      add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'
      delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'
      add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'
      delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'
      set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'
      add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'
      shutdown script = /var/lib/samba/scripts/shutdown.sh
      abort shutdown script = /sbin/shutdown -c
      logon script = scripts\logon.bat
      logon path = \\%L\profiles\%U
      logon drive = X:
      domain logons = Yes
      domain master = Yes
      wins support = Yes
      ldap suffix = dc=abmas,dc=biz
      ldap machine suffix = ou=People
      ldap user suffix = ou=People
      ldap group suffix = ou=Groups
      ldap idmap suffix = ou=Idmap
      ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz
      idmap backend = ldap://massive.abmas.biz
      idmap uid = 10000-20000
      idmap gid = 10000-20000
      printer admin = root
      printing = cups

      Example 6.4. Primary Domain Controller smb.conf File Part B

      [IPC$]
      path = /tmp
      [accounts]
      comment = Accounting Files
      path = /data/accounts
      read only = No
      [service]
      comment = Financial Services Files
      path = /data/service
      read only = No
      [pidata]
      comment = Property Insurance Files
      path = /data/pidata
      read only = No
      [homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No
      [printers]
      comment = SMB Print Spool
      path = /var/spool/samba
      guest ok = Yes
      printable = Yes
      browseable = No

      Example 6.5. Primary Domain Controller smb.conf File Part C

      [apps]
      comment = Application Files
      path = /apps
      admin users = bjones
      read only = No
      [netlogon]
      comment = Network Logon Service
      path = /var/lib/samba/netlogon
      admin users = root, Administrator
      guest ok = Yes
      locking = No
      [profiles]
      comment = Profile Share
      path = /var/lib/samba/profiles
      read only = No
      profile acls = Yes
      [profdata]
      comment = Profile Data Share
      path = /var/lib/samba/profdata
      read only = No
      profile acls = Yes
      [print$]
      comment = Printer Drivers
      path = /var/lib/samba/drivers
      write list = root
      admin users = root, Administrator

      Example 6.6. Backup Domain Controller smb.conf File Part A

      # # Global parameters
      [global]
      unix charset = LOCALE
      workgroup = MEGANET2
      netbios name = BLDG1
      passdb backend = ldapsam:ldap://lapdc.abmas.biz
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 50
      smb ports = 139
      name resolve order = wins bcast hosts
      printcap name = CUPS
      show add printer wizard = No
      logon script = scripts\logon.bat
      logon path = \\%L\profiles\%U
      logon drive = X:
      domain logons = Yes
      os level = 63
      domain master = No
      wins server = 192.168.2.1
      ldap suffix = dc=abmas,dc=biz
      ldap machine suffix = ou=People
      ldap user suffix = ou=People
      ldap group suffix = ou=Groups
      ldap idmap suffix = ou=Idmap
      ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz
      utmp = Yes
      idmap backend = ldap://massive.abmas.biz
      idmap uid = 10000-20000
      idmap gid = 10000-20000
      printing = cups
      [accounts]
      comment = Accounting Files
      path = /data/accounts
      read only = No
      [service]
      comment = Financial Services Files
      path = /data/service
      read only = No

      Example 6.7. Backup Domain Controller smb.conf File Part B

      [pidata]
      comment = Property Insurance Files
      path = /data/pidata
      read only = No
      [homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No
      [printers]
      comment = SMB Print Spool
      path = /var/spool/samba
      guest ok = Yes
      printable = Yes
      browseable = No
      [apps]
      comment = Application Files
      path = /apps
      admin users = bjones
      read only = No
      [netlogon]
      comment = Network Logon Service
      path = /var/lib/samba/netlogon
      guest ok = Yes
      locking = No
      [profiles]
      comment = Profile Share
      path = /var/lib/samba/profiles
      read only = No
      profile acls = Yes
      [profdata]
      comment = Profile Data Share
      path = /var/lib/samba/profdata
      read only = No
      profile acls = Yes

      Key Points Learned

      • - +

      Example 6.3. Primary Domain Controller smb.conf File Part A

      # Global parameters
      [global]
      unix charset = LOCALE
      workgroup = MEGANET2
      passdb backend = ldapsam:ldap://massive.abmas.biz
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 0
      smb ports = 139
      name resolve order = wins bcast hosts
      time server = Yes
      printcap name = CUPS
      add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'
      delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'
      add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'
      delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'
      add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'
      delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'
      set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'
      add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'
      shutdown script = /var/lib/samba/scripts/shutdown.sh
      abort shutdown script = /sbin/shutdown -c
      logon script = scripts\logon.bat
      logon path = \\%L\profiles\%U
      logon drive = X:
      domain logons = Yes
      domain master = Yes
      wins support = Yes
      ldap suffix = dc=abmas,dc=biz
      ldap machine suffix = ou=People
      ldap user suffix = ou=People
      ldap group suffix = ou=Groups
      ldap idmap suffix = ou=Idmap
      ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz
      idmap backend = ldap://massive.abmas.biz
      idmap uid = 10000-20000
      idmap gid = 10000-20000
      printer admin = root
      printing = cups

      Example 6.4. Primary Domain Controller smb.conf File Part B

      [IPC$]
      path = /tmp
      [accounts]
      comment = Accounting Files
      path = /data/accounts
      read only = No
      [service]
      comment = Financial Services Files
      path = /data/service
      read only = No
      [pidata]
      comment = Property Insurance Files
      path = /data/pidata
      read only = No
      [homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No
      [printers]
      comment = SMB Print Spool
      path = /var/spool/samba
      guest ok = Yes
      printable = Yes
      browseable = No

      Example 6.5. Primary Domain Controller smb.conf File Part C

      [apps]
      comment = Application Files
      path = /apps
      admin users = bjones
      read only = No
      [netlogon]
      comment = Network Logon Service
      path = /var/lib/samba/netlogon
      admin users = root, Administrator
      guest ok = Yes
      locking = No
      [profiles]
      comment = Profile Share
      path = /var/lib/samba/profiles
      read only = No
      profile acls = Yes
      [profdata]
      comment = Profile Data Share
      path = /var/lib/samba/profdata
      read only = No
      profile acls = Yes
      [print$]
      comment = Printer Drivers
      path = /var/lib/samba/drivers
      write list = root
      admin users = root, Administrator

      Example 6.6. Backup Domain Controller smb.conf File Part A

      # # Global parameters
      [global]
      unix charset = LOCALE
      workgroup = MEGANET2
      netbios name = BLDG1
      passdb backend = ldapsam:ldap://lapdc.abmas.biz
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 50
      smb ports = 139
      name resolve order = wins bcast hosts
      printcap name = CUPS
      show add printer wizard = No
      logon script = scripts\logon.bat
      logon path = \\%L\profiles\%U
      logon drive = X:
      domain logons = Yes
      os level = 63
      domain master = No
      wins server = 192.168.2.1
      ldap suffix = dc=abmas,dc=biz
      ldap machine suffix = ou=People
      ldap user suffix = ou=People
      ldap group suffix = ou=Groups
      ldap idmap suffix = ou=Idmap
      ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz
      utmp = Yes
      idmap backend = ldap://massive.abmas.biz
      idmap uid = 10000-20000
      idmap gid = 10000-20000
      printing = cups
      [accounts]
      comment = Accounting Files
      path = /data/accounts
      read only = No
      [service]
      comment = Financial Services Files
      path = /data/service
      read only = No

      Example 6.7. Backup Domain Controller smb.conf File Part B

      [pidata]
      comment = Property Insurance Files
      path = /data/pidata
      read only = No
      [homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No
      [printers]
      comment = SMB Print Spool
      path = /var/spool/samba
      guest ok = Yes
      printable = Yes
      browseable = No
      [apps]
      comment = Application Files
      path = /apps
      admin users = bjones
      read only = No
      [netlogon]
      comment = Network Logon Service
      path = /var/lib/samba/netlogon
      guest ok = Yes
      locking = No
      [profiles]
      comment = Profile Share
      path = /var/lib/samba/profiles
      read only = No
      profile acls = Yes
      [profdata]
      comment = Profile Data Share
      path = /var/lib/samba/profdata
      read only = No
      profile acls = Yes

      Key Points Learned

      • + Where Samba-3 is used as a domain controller, the use of LDAP is an essential component to permit the use of BDCs.

      • - + Replication of the LDAP master server to create a network of BDCs is an important mechanism for limiting WAN traffic.

      • @@ -808,55 +808,55 @@ Roaming profiles must be contained to the local network segment. Any departure from this may clog wide-area arteries and slow legitimate network traffic to a crawl. -

      Figure 6.6. Network Topology 2000 User Complex Design A

      Network Topology 2000 User Complex Design A

      Figure 6.7. Network Topology 2000 User Complex Design B

      Network Topology 2000 User Complex Design B

      Questions and Answers

      +

    Figure 6.6. Network Topology 2000 User Complex Design A

    Network Topology 2000 User Complex Design A

    Figure 6.7. Network Topology 2000 User Complex Design B

    Network Topology 2000 User Complex Design B

    Questions and Answers

    There is much rumor and misinformation regarding the use of MS Windows networking protocols. These questions are just a few of those frequently asked. -

    +

    DHCP networkbandwidth Is it true that DHCP uses lots of WAN bandwidth? -
    +
    background communication LDAPmaster/slavebackground communication How much background communication takes place between a master LDAP server and its slave LDAP servers? -
    +
    LDAP has a database. Is LDAP not just a fancy database front end? -
    +
    OpenLDAP Can Active Directory obtain account information from an OpenLDAP server? -
    +
    What are the parts of a roaming profile? How large is each part? -
    +
    Can the My Documents folder be stored on a network drive? -
    +
    wide-area networkbandwidth WINS How much WAN bandwidth does WINS consume? -
    +
    How many BDCs should I have? What is the right number of Windows clients per server? -
    +
    NIS serverLDAP I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server? -
    +
    Can I use NIS in place of LDAP? -

    - - +

    + + Is it true that DHCP uses lots of WAN bandwidth?

    - - - + + + It is a smart practice to localize DHCP servers on each network segment. As a rule, there should be two DHCP servers per network segment. This means that if one server fails, there is always another to service user needs. DHCP requests use only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network routers. This makes it possible to run fewer DHCP servers.

    - - + + A DHCP network address request and confirmation usually results in about six UDP packets. The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP clients and that uses a 24-hour IP address lease. This means that all clients renew @@ -874,28 +874,28 @@

    From this can be seen that the traffic impact would be minimal.

    - - + + Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link, the impact of the update is no more than the DHCP IP address renewal traffic and thus still insignificant for most practical purposes. -

    - - +

    + + How much background communication takes place between a master LDAP server and its slave LDAP servers?

    - + The process that controls the replication of data from the master LDAP server to the slave LDAP servers is called slurpd. The slurpd remains nascent (quiet) until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete) two user accounts requires less than 10KB traffic. -

    +

    LDAP has a database. Is LDAP not just a fancy database front end?

    + + - - LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific data storage system. This type of database is indexed so that records can be rapidly located, but the database is not generic and can be used only in particular pre-programmed ways. General external @@ -904,17 +904,17 @@ orientation and typically allows external programs to perform ad hoc queries, even across data tables. An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific simple queries. The term database is heavily overloaded and thus much misunderstood. -

    - +

    + Can Active Directory obtain account information from an OpenLDAP server?

    - + No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface to OpenLDAP using standard LDAP queries and updates. -

    +

    What are the parts of a roaming profile? How large is each part? -

    +

    A roaming profile consists of

    • Desktop folders such as Desktop, My Documents, @@ -922,39 +922,39 @@ Cookies, Application Data, Local Settings, and more. See ???, ???.

      - + Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all such folders can be redirected to network drive resources. See ??? for more information regarding folder redirection.

    • A static or rewritable portion that is typically only a few files (2-5 KB of information).

    • - - + + The registry load file that modifies the HKEY_LOCAL_USER hive. This is the NTUSER.DAT file. It can be from 0.4 to 1.5 MB.

    - + Microsoft Outlook PST files may be stored in the Local Settings\Application Data folder. It can be up to 2 GB in size per PST file. -

    +

    Can the My Documents folder be stored on a network drive?

    - - + + Yes. More correctly, such folders can be redirected to network shares. No specific network drive connection is required. Registry settings permit this to be redirected directly to a UNC (Universal Naming Convention) resource, though it is possible to specify a network drive letter instead of a UNC name. See ???. -

    - - - +

    + + + How much WAN bandwidth does WINS consume?

    - - - + + + MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS server, the total bandwidth demand measured at the WINS server, averaged over an 8-hour working day, @@ -966,7 +966,7 @@

    In conclusion, the total load afforded through WINS traffic is again marginal to total operational usage as it should be. -

    +

    How many BDCs should I have? What is the right number of Windows clients per server?

    It is recommended to have at least one BDC per network segment, including the segment served @@ -980,19 +980,19 @@

    As unsatisfactory as the answer might sound, it all depends on network and server load characteristics. -

    - +

    + I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server?

    The correct answer to both questions is yes. But do understand that an LDAP server has a configurable schema that can store far more information for many more purposes than just NIS. -

    +

    Can I use NIS in place of LDAP?

    - - + + No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal with the types of data necessary for interoperability with Microsoft Windows networking. The use of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/appendix.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/appendix.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/appendix.html 2005-12-29 10:24:28.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/appendix.html 2006-01-29 10:18:17.000000000 -0600 @@ -1,18 +1,18 @@ -Chapter 15. A Collection of Useful Tidbits

    Chapter 15. A Collection of Useful Tidbits
    Prev Part III. Reference Section Next

    Chapter 15. A Collection of Useful Tidbits

    Table of Contents

    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    IDEALX Management Console
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls

    - - +Chapter 15. A Collection of Useful Tidbits

    Chapter 15. A Collection of Useful Tidbits
    Prev Part III. Reference Section Next

    Chapter 15. A Collection of Useful Tidbits

    Table of Contents

    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    IDEALX Management Console
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls

    + + Information presented here is considered to be either basic or well-known material that is informative yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical, as shown in the example given below.

    Joining a Domain: Windows 200x/XP Professional

    - + Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. This section steps through the process for making a Windows 200x/XP Professional machine a member of a Domain Security environment. It should be noted that this process is identical when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. -

    Procedure 15.1. Steps to Join a Domain

    1. +

      Procedure 15.1. Steps to Join a Domain

      1. Click Start.

      2. Right-click My Computer, and then select Properties. @@ -50,19 +50,19 @@ The “Welcome to the MIDEARTH domain” dialog box should appear. At this point, the machine must be rebooted. Joining the domain is now complete.

      - - + + The screen capture shown in ??? has a button labeled More.... This button opens a panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.

      - - + + Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server to find the services (like which machines are domain controllers or which machines have the Netlogon service running).

      - + The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to a valid IP address. @@ -70,12 +70,12 @@ The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain. Where the client is a member of a Samba domain, it is preferable to leave this field blank.

      - + According to Microsoft documentation, “If this computer belongs to a group with Group Policy enabled on Primary DNS suffice of this computer, the string specified in the Group Policy is used as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is used only if Group Policy is disabled or unspecified.” -

    Samba System File Location

    +

    Samba System File Location

    One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is in the /usr/local/samba directory. This is a perfectly reasonable location, particularly given all the other @@ -83,7 +83,7 @@

    Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team default. -

    +

    Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy System (FHS), have elected to locate the configuration files under the /etc/samba directory, common binary files (those used by users) in the /usr/bin directory, and the administrative files (daemons) in the @@ -92,13 +92,13 @@ /usr/share/swat. There are additional support files for smbd in the /usr/lib/samba directory tree. The files located there include the dynamically loadable modules for the passdb backend as well as for the VFS modules. -

    +

    Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in the /var/lib/samba directory. Log files are created in /var/log/samba.

    When Samba is built and installed using the default Samba Team process, all files are located under the /usr/local/samba directory tree. This makes it simple to find the files that Samba owns. -

    +

    One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location of all files called smbd. Here is an example: 

    @@ -131,7 +131,7 @@
 	
    
 	Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
 	by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
-	executing:
+	executing:
 
     root#  rpm -qa | grep samba
 samba3-pdb-3.0.20-1
@@ -143,9 +143,9 @@
 samba3-doc-3.0.20-1
 samba3-client-3.0.20-1
 samba3-cifsmount-3.0.20-1
-	
    
+

    The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. -

    Starting Samba

    +

    Starting Samba

    Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba, there are three daemons, two of which are needed as a minimum. @@ -186,19 +186,19 @@ fi exit 0

    nmbd

    - - + + This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.

    smbd

    - - + + This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.

    winbindd

    - - + + This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when Samba has trust relationships with another domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid @@ -252,22 +252,22 @@ echo "Usage: smb {start|stop|restart|status}" exit 1 esac -

    +

    SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently executed from the command line is shown in ???. This can be located in the directory /sbin in a file called samba. This type of control script should be owned by user root and group root, and set so that only root can execute it. -

    +

    A sample startup script for a Red Hat Linux system is shown in ???. This file could be located in the directory /etc/rc.d and can be called samba. A similar startup script is required to control winbind. If you want to find more information regarding startup scripts please refer to the packaging section of the Samba source code distribution tarball. The packaging files for each platform include a startup control file. -

    DNS Configuration Files

    +

    DNS Configuration Files

    The following files are common to all DNS server configurations. Rather than repeat them multiple times, they are presented here for general reference. -

    The Forward Zone File for the Loopback Adaptor

    +

    The Forward Zone File for the Loopback Adaptor

    The forward zone file for the loopback address never changes. An example file is shown in ???. All traffic destined for an IP address that is hosted on a physical interface on the machine itself is routed to the loopback adaptor. This is @@ -284,7 +284,7 @@ IN NS @ IN A 127.0.0.1 -

    The Reverse Zone File for the Loopback Adaptor

    +

    The Reverse Zone File for the Loopback Adaptor

    The reverse zone file for the loopback address as shown in ??? is necessary so that references to the address 127.0.0.1 can be resolved to the correct name of the interface. @@ -344,15 +344,15 @@ . 3600000 NS M.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 ; End of File -

    DNS Root Server Hint File

    +

    DNS Root Server Hint File

    The content of the root hints file as shown in ??? changes slowly over time. Periodically this file should be updated from the source shown. Because of its size, this file is located at the end of this chapter. -

    Alternative LDAP Database Initialization

    +

    Alternative LDAP Database Initialization

    The following procedure may be used as an alternative means of configuring the initial LDAP database. Many administrators prefer to have greater control over how system files get configured. -

    Initialization of the LDAP Database

    +

    Initialization of the LDAP Database

    The first step to get the LDAP server ready for action is to create the LDIF file from which the LDAP database will be preloaded. This is necessary to create the containers into which the user, group, and other accounts are written. It is also necessary to @@ -705,14 +705,14 @@ sambaGroupType: 2 displayName: Domain Users description: Domain Users -

    The LDAP Account Manager

    - - - +

    The LDAP Account Manager

    + + + + + - - The LDAP Account Manager (LAM) is an application suite that has been written in PHP. LAM can be used with any Web server that has PHP4 support. It connects to the LDAP server either using unencrypted connections or via SSL/TLS. LAM can be used to manage @@ -724,24 +724,24 @@ The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter of 2005.

    - - - + + + Requirements:

    • A web server that will work with PHP4.

    • PHP4 (available from the PHP home page.)

    • OpenLDAP 2.0 or later.

    • A Web browser that supports CSS.

    • Perl.

    • The gettext package.

    • mcrypt + mhash (optional).

    • It is also a good idea to install SSL support.

    LAM is a useful tool that provides a simple Web-based device that can be used to manage the contents of the LDAP directory to: - - - + + +

    • Display user/group/host and Domain entries.

    • Manage entries (Add/Delete/Edit).

    • Filter and sort entries.

    • Store and use multiple operating profiles.

    • Edit organizational units (OUs).

    • Upload accounts from a file.

    • Is compatible with Samba-2.2.x and Samba-3.

    When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba user, group, and windows domain member machine accounts.

    - - - - + + + + The default password is “lam.” It is highly recommended that you use only an SSL connection to your Web server for all remote operations involving LAM. If you want secure connections, you must configure your Apache Web server to permit connections @@ -760,7 +760,7 @@ For example, on SUSE Linux Enterprise Server 9, copy to the /srv/www/htdocs directory.

  • - + Set file permissions using the following commands: 

     root#  chown -R wwwrun:www /srv/www/htdocs/lam
@@ -770,7 +770,7 @@
 root#  chmod 755 /srv/www/htdocs/lam/lib/*pl

  • - + Using your favorite editor create the following config.cfg LAM configuration file: 

    @@ -778,8 +778,8 @@
 root#  cp config.cfg_sample config.cfg
 root#  vi config.cfg

    - - + + An example file is shown in ???. This is the minimum configuration that must be completed. The LAM profile file can be created using a convenient wizard that is part of the LAM @@ -794,7 +794,7 @@ lam.conf then, using your favorite editor, change the settings to match local site needs.

    • - + An example of a working file is shown here in ???. This file has been stripped of comments to keep the size small. The comments and help information provided in the profile file that the wizard creates @@ -802,12 +802,12 @@ Your configuration file obviously reflects the configuration options that are preferred at your site.

    - + It is important that your LDAP server is running at the time that LAM is being configured. This permits you to validate correct operation. An example of the LAM login screen is provided in ???.

    Figure 15.6. The LDAP Account Manager Login Screen

    The LDAP Account Manager Login Screen

    - + The LAM configuration editor has a number of options that must be managed correctly. An example of use of the LAM configuration editor is shown in ???. It is important that you correctly set the minimum and maximum UID/GID values that are @@ -817,13 +817,13 @@ the initial settings to be made. Do not forget to reset these to sensible values before using LAM to add additional users and groups.

    Figure 15.7. The LDAP Account Manager Configuration Screen

    The LDAP Account Manager Configuration Screen

    - + LAM has some nice, but unusual features. For example, one unexpected feature in most application screens permits the generation of a PDF file that lists configuration information. This is a well thought out facility. This option has been edited out of the following screen shots to conserve space.

    - + When you log onto LAM the opening screen drops you right into the user manager as shown in ???. This is a logical action as it permits the most-needed facility to be used immediately. The editing of an existing user, as with the addition of a new user, @@ -837,7 +837,7 @@ shows a sub-screen from the group editor that permits users to be assigned secondary group memberships.

    Figure 15.9. The LDAP Account Manager Group Edit Screen

    The LDAP Account Manager Group Edit Screen

    Figure 15.10. The LDAP Account Manager Group Membership Edit Screen

    The LDAP Account Manager Group Membership Edit Screen

    - + The final screen presented here is one that you should not normally need to use. Host accounts will be automatically managed using the smbldap-tools scripts. This means that the screen ??? will, in most cases, not be used. @@ -883,7 +883,7 @@ samba3: yes cachetimeout: 5 pwdhash: SSHA -

    IDEALX Management Console

    +

    IDEALX Management Console

    IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive web-based management interface for UNIX and Linux systems.

    @@ -897,7 +897,7 @@

    For further information regarding IMC refer to the web site. Prebuilt RPM packages are also available. -

    Effect of Setting File and Directory SUID/SGID Permissions Explained

    +

    Effect of Setting File and Directory SUID/SGID Permissions Explained

    The setting of the SUID/SGID bits on the file or directory permissions flag has particular consequences. If the file is executable and the SUID bit is set, it executes with the privilege of (with the UID of) the owner of the file. For example, if you are logged onto a system as @@ -967,34 +967,34 @@ total 1 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt

    -

    Shared Data Integrity

    +

    Shared Data Integrity

    The integrity of shared data is often viewed as a particularly emotional issue, especially where there are concurrent problems with multiuser data access. Contrary to the assertions of some who have experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.

    The solution to concurrent multiuser data access problems must consider three separate areas - from which the problem may stem: -

    • application-level locking controls

    • client-side locking controls

    • server-side locking controls

    + from which the problem may stem: +

    • application-level locking controls

    • client-side locking controls

    • server-side locking controls

    Many database applications use some form of application-level access control. An example of one well-known application that uses application-level locking is Microsoft Access. Detailed guidance is provided here because this is the most common application for which problems have been reported. -

    +

    Common applications that are affected by client- and server-side locking controls include MS Excel and Act!. Important locking guidance is provided here. -

    Microsoft Access

    +

    Microsoft Access

    The best advice that can be given is to carefully read the Microsoft knowledgebase articles that cover this area. Examples of relevant documents include: -

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;208778

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;299373

    +

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;208778

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;299373

    Make sure that your MS Access database file is configured for multiuser access (not set for exclusive open). Open MS Access on each client workstation, then set the following: (Menu bar) Tools+Options+[tab] General. Set network path to Default database folder: \\server\share\folder.

    You can configure MS Access file sharing behavior as follows: click [tab] Advanced. - Set: -

    • Default open mode: Shared

    • Default Record Locking: Edited Record

    • Open databases using record_level locking

    + Set: +

    • Default open mode: Shared

    • Default Record Locking: Edited Record

    • Open databases using record_level locking

    You must now commit the changes so that they will take effect. To do so, click ApplyOk. At this point, you should exit MS Access, restart it, and then validate that these settings have not changed. -

    Act! Database Sharing

    +

    Act! Database Sharing

    Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you must disable opportunistic locking on the server and all workstations. Failure to do so results in data corruption. This information is available from the Act! Web site @@ -1002,7 +1002,7 @@ 1998223162925 as well as from article 200110485036. -

    +

    These documents clearly state that opportunistic locking must be disabled on both the server (Samba in the case we are interested in here), as well as on every workstation from which the centrally shared Act! database will be accessed. Act! provides @@ -1010,18 +1010,18 @@ registry settings that may otherwise interfere with the operation of Act! Registered Act! users may download this utility from the Act! Web site. -

    Opportunistic Locking Controls

    +

    Opportunistic Locking Controls

    Third-party Windows applications may not be compatible with the use of opportunistic file - and record locking. For applications that are known not to be compatible,[14] oplock + and record locking. For applications that are known not to be compatible,[14] oplock support may need to be disabled both on the Samba server and on the Windows workstations. -

    +

    Oplocks enable a Windows client to cache parts of a file that are being edited. Another windows client may then request to open the file with the ability to write to it. The server will then ask the original workstation that had the file open with a write lock to release its lock. Before doing so, that workstation must flush the file from cache memory to the disk or network drive. -

    +

    Disabling of Oplocks usage may require server and client changes. Oplocks may be disabled by file, by file pattern, on the share, or on the Samba server. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/Big500users.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/Big500users.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/Big500users.html 2005-12-29 10:24:14.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/Big500users.html 2006-01-29 10:18:10.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 4. The 500-User Office

    Chapter 4. The 500-User Office
    Prev Part I. Example Network Configurations Next

    Chapter 4. The 500-User Office

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers

    +Chapter 4. The 500-User Office

    Chapter 4. The 500-User Office
    Prev Part I. Example Network Configurations Next

    Chapter 4. The 500-User Office

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers

    The Samba-3 networking you explored in ??? covers the finer points of configuration of peripheral services such as DHCP and DNS, and WINS. You experienced implementation of a simple configuration of the services that are important adjuncts @@ -17,9 +17,9 @@ that same approach to printing, but ??? presents an opportunity to make printing more complex for the administrator while making it easier for the user.

    - + + - ??? demonstrates operation of a DHCP server and a DNS server as well as a central WINS server. You validated the operation of these services and saw an effective implementation of a Samba domain controller using the @@ -41,7 +41,7 @@ improve network management and control while reducing human resource overheads. You should take the opportunity to innovate and expand on the methods presented here and explore them to the fullest. -

    Introduction

    +

    Introduction

    Business continues to go well for Abmas. Mr. Meany is driving your success and the network continues to grow thanks to the hard work Christine has done. You recently hired Stanley Soroka as manager of information systems. Christine recommended Stan @@ -66,7 +66,7 @@ and to allow Stan and Christine to fully stage the new network and test it before it is rolled out. Your strategy is to complete the new network so that it is ready for operation when the old office moves into the new premises. -

    Assignment Tasks

    +

    Assignment Tasks

    The acquired business had 280 network users. The old Abmas building housed 220 network users in unbelievably cramped conditions. The network that initially served 130 users now handles 220 users quite well. @@ -107,7 +107,7 @@ DirectPointe Inc. receives from you a new standard desktop configuration every four months. They automatically roll that out to each desktop system. You must keep DirectPointe informed of all changes. -

    +

    The new network has a single Samba Primary Domain Controller (PDC) located in the Network Operation Center (NOC). Buildings 1 and 2 each have a local server for local application servicing. It is a domain member. The new system @@ -115,8 +115,8 @@

    Printing is based on raw pass-through facilities just as it has been used so far. All printer drivers are installed on the desktop and notebook computers. -

    Dissection and Discussion

    - +

    Dissection and Discussion

    + The example you are building in this chapter is of a network design that works, but this does not make it a design that is recommended. As a general rule, there should be at least one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind @@ -127,22 +127,22 @@ responsiveness. This network will have 500 clients serviced by one central domain controller. This is not a good omen for user satisfaction. You, of course, address this very soon (see ???). -

    Technical Issues

    +

    Technical Issues

    Stan has talked you into a horrible compromise, but it is addressed. Just make certain that the performance of this network is well validated before going live.

    Design decisions made in this design include the following:

    • + + - - A single PDC is being implemented. This limitation is based on the choice not to use LDAP. Many network administrators fear using LDAP because of the perceived complexity of implementation and management of an LDAP-based backend for all user identity management as well as to store network access credentials.

    • - - + + Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the only choice that makes sense with 500 users is to use the tdbsam passwd backend. This type of backend is not receptive to replication to BDCs. If the tdbsam @@ -156,7 +156,7 @@ for a simple mode of operation but has to be balanced with network performance and integrity of operations considerations.

    • - + A single central WINS server is being used. The PDC is also the WINS server. Any attempt to operate a routed network without a WINS server while using NetBIOS over TCP/IP protocols does not work unless on each client the name resolution @@ -167,12 +167,12 @@ At this time the Samba WINS database cannot be replicated. That is why a single WINS server is being implemented. This should work without a problem.

    • - + BDCs make use of winbindd to provide access to domain security credentials for file system access and object storage.

    • - - + + Configuration of Windows XP Professional clients is achieved using DHCP. Each subnet has its own DHCP server. Backup DHCP serving is provided by one alternate DHCP server. This necessitates enabling of the DHCP Relay agent on @@ -188,13 +188,13 @@ The network address and subnetmask chosen provide 1022 usable IP addresses in each subnet. If in the future more addresses are required, it would make sense to add further subnets rather than change addressing. -

    Political Issues

    +

    Political Issues

    This case gets close to the real world. You and I know the right way to implement domain control. Politically, we have to navigate a minefield. In this case, the need is to get the PDC rolled out in compliance with expectations and also to be ready to save the day by having the real solution ready before it is needed. That real solution is presented in ???. -

    Implementation

    +

    Implementation

    The following configuration process begins following installation of Red Hat Fedora Core2 on the three servers shown in the network topology diagram in ???. You have selected hardware that is appropriate to the task. @@ -205,9 +205,9 @@

    The abbreviation shown in this table as {VLN} refers to the directory location beginning with /var/lib/named. -

    Table 4.1. Domain: MEGANET, File Locations for Servers

    File InformationServer Name
    SourceTarget LocationMASSIVEBLDG1BLDG2
    ???/etc/samba/smb.confYesNoNo
    ???/etc/samba/dc-common.confYesNoNo
    ???/etc/samba/common.confYesYesYes
    ???/etc/samba/smb.confNoYesNo
    ???/etc/samba/smb.confNoNoYes
    ???/etc/samba/dommem.confNoYesYes
    ???/etc/dhcpd.confYesNoNo
    ???/etc/dhcpd.confNoYesNo
    ???/etc/dhcpd.confNoNoYes
    ???/etc/named.conf (part A)YesNoNo
    ???/etc/named.conf (part B)YesNoNo
    ???/etc/named.conf (part C)YesNoNo
    ???{VLN}/master/abmas.biz.hostsYesNoNo
    ???{VLN}/master/abmas.us.hostsYesNoNo
    ???/etc/named.conf (part A)NoYesYes
    ???/etc/named.conf (part B)NoYesYes
    ???{VLN}/localhost.zoneYesYesYes
    ???{VLN}/127.0.0.zoneYesYesYes
    ???{VLN}/root.hintYesYesYes

    Server Preparation: All Servers

    +

    Table 4.1. Domain: MEGANET, File Locations for Servers

    File InformationServer Name
    SourceTarget LocationMASSIVEBLDG1BLDG2
    ???/etc/samba/smb.confYesNoNo
    ???/etc/samba/dc-common.confYesNoNo
    ???/etc/samba/common.confYesYesYes
    ???/etc/samba/smb.confNoYesNo
    ???/etc/samba/smb.confNoNoYes
    ???/etc/samba/dommem.confNoYesYes
    ???/etc/dhcpd.confYesNoNo
    ???/etc/dhcpd.confNoYesNo
    ???/etc/dhcpd.confNoNoYes
    ???/etc/named.conf (part A)YesNoNo
    ???/etc/named.conf (part B)YesNoNo
    ???/etc/named.conf (part C)YesNoNo
    ???{VLN}/master/abmas.biz.hostsYesNoNo
    ???{VLN}/master/abmas.us.hostsYesNoNo
    ???/etc/named.conf (part A)NoYesYes
    ???/etc/named.conf (part B)NoYesYes
    ???{VLN}/localhost.zoneYesYesYes
    ???{VLN}/127.0.0.zoneYesYesYes
    ???{VLN}/root.hintYesYesYes

    Server Preparation: All Servers

    The following steps apply to all servers. Follow each step carefully. -

    Procedure 4.1. Server Preparation Steps

    1. +

      Procedure 4.1. Server Preparation Steps

      1. Using the UNIX/Linux system tools, set the name of the server as shown in the network topology diagram in ???. For SUSE Linux products, the tool that permits this is called yast2; for Red Hat Linux products, @@ -221,8 +221,8 @@ root# hostname -f

      2. - - + + Edit your /etc/hosts file to include the primary names and addresses of all network interfaces that are on the host server. This is necessary so that during startup the system is able to resolve all its own names to the IP address prior to @@ -230,7 +230,7 @@ CUPS print server is started before the DNS server (named), you should also include an entry for the printers in the /etc/hosts file.

      3. - + All DNS name resolution should be handled locally. To ensure that the server is configured correctly to handle this, edit /etc/resolv.conf so it has the following content: @@ -241,8 +241,8 @@ This instructs the name resolver function (when configured correctly) to ask the DNS server that is running locally to resolve names to addresses.

      4. - - + + Add the root user to the password backend: 

         root#  smbpasswd -a root
@@ -255,8 +255,8 @@
 			deleted. If for any reason the account is deleted, you may not be able to recreate this account
 			without considerable trouble.

      5. - - + + Create the username map file to permit the root account to be called Administrator from the Windows network environment. To do this, create the file /etc/samba/smbusers with the following contents: @@ -294,16 +294,16 @@ Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - - + +

      6. - + Only on the server to which the printer is attached configure the CUPS Print Queues as follows: 

         root#  lpadmin -p printque -v socket://printer-name.abmas.biz:9100 -E

        - + This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, that is, printing without use of filters. The name printque is the name you have assigned for @@ -323,9 +323,9 @@ root# /usr/bin/accept printque

      7. + + - - This step, as well as the next one, may be omitted where CUPS version 1.1.18 or later is in use. Although it does no harm to follow it anyway, and may help to avoid time spent later trying to figure out why print jobs may be @@ -336,7 +336,7 @@ application/octet-stream application/vnd.cups-raw 0 -

      8. - + Edit the file /etc/cups/mime.types to uncomment the line: 

         application/octet-stream
@@ -359,17 +359,17 @@
 	processes to automap Windows client drives to an application server that is nearest to the client. This
 	is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
 	as elegantly as you see in the next chapter.
-

    Server-Specific Preparation

    +

    Server-Specific Preparation

    There are some steps that apply to particular server functionality only. Each step is critical to correct server operation. The following step-by-step installation guidance will assist you in working through the process of configuring the PDC and then both BDC's. -

    Configuration for Server: MASSIVE

    +

    Configuration for Server: MASSIVE

    The steps presented here attempt to implement Samba installation in a generic manner. While some steps are clearly specific to Linux, it should not be too difficult to apply them to your platform of choice. -

    Procedure 4.2. Primary Domain Controller Preparation

    1. - - +

      Procedure 4.2. Primary Domain Controller Preparation

      1. + + The host server acts as a router between the two internal network segments as well as for all Internet access. This necessitates that IP forwarding be enabled. This can be achieved by adding to the /etc/rc.d/boot.local an entry as follows: @@ -397,7 +397,7 @@ startup files as follows: (SUSE) /etc/rc.d/boot.local, (Red Hat) /etc/rc.d/init.d/rc.local.

      2. - + The final step that must be completed is to edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -405,24 +405,24 @@ hosts: files dns wins

      3. - + Create and map Windows domain groups to UNIX groups. A sample script is provided in ???. Create a file containing this script. You called yours /etc/samba/initGrps.sh. Set this file so it can be executed and then execute the script. An example of the execution of this script as well as its validation are shown in Section 4.3.2, Step 5.

      4. - - - + + + For each user who needs to be given a Windows domain account, make an entry in the /etc/passwd file as well as in the Samba password backend. Use the system tool of your choice to create the UNIX system account, and use the Samba smbpasswd to create a domain user account.

        - - - + + + There are a number of tools for user management under UNIX, such as useradd, adduser, as well as a plethora of custom tools. With the tool of your choice, create a home directory for each user. @@ -435,7 +435,7 @@ file is /data. Format the file system as required and mount the formatted file system partition using appropriate system tools.

      5. - + Create the top-level file storage directories for data and applications as follows: 

         root#  mkdir -p /data/{accounts,finsvcs,pidata}
@@ -475,8 +475,8 @@
 root#  chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'

      6. - - + + Create a logon script. It is important that each line is correctly terminated with a carriage return and line-feed combination (i.e., DOS encoding). The following procedure works if the right tools (unxi2dos and dos2unix) are installed. @@ -518,8 +518,8 @@ The following steps will guide you through the nuances of implementing BDCs for the broadcast isolated network segments. Remember that if the target installation platform is not Linux, it may be necessary to adapt some commands to the equivalent on the target platform. -

        Procedure 4.3. Backup Domain Controller Configuration Steps

        1. - +

          Procedure 4.3. Backup Domain Controller Configuration Steps

          1. + The final step that must be completed is to edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -532,14 +532,14 @@ Follow the steps outlined in ??? to start all services. Do not start Samba at this time. Samba is controlled by the process called smb.

          2. - + You must now attempt to join the domain member servers to the domain. The following instructions should be executed to effect this: 

             root#  net rpc join

          3. - + You now start the Samba services by executing: 

             root#  service smb start
@@ -548,7 +548,7 @@
                         Your server is ready for validation testing. Do not proceed with the steps in
                         ??? until after the operation of the server has been
                         validated following the same methods as outlined in ???.
-

      Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf

      # Global parameters
      [global]
      workgroup = MEGANET
      netbios name = MASSIVE
      interfaces = eth1, lo
      bind interfaces only = Yes
      passdb backend = tdbsam
      smb ports = 139
      add user script = /usr/sbin/useradd -m '%u'
      delete user script = /usr/sbin/userdel -r '%u'
      add group script = /usr/sbin/groupadd '%g'
      delete group script = /usr/sbin/groupdel '%g'
      add user to group script = /usr/sbin/usermod -G '%g' '%u'
      add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'
      preferred master = Yes
      wins support = Yes
      include = /etc/samba/dc-common.conf
      [accounts]
      comment = Accounting Files
      path = /data/accounts
      read only = No
      [service]
      comment = Financial Services Files
      path = /data/service
      read only = No
      [pidata]
      comment = Property Insurance Files
      path = /data/pidata
      read only = No

      Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf

      # Global parameters
      [global]
      shutdown script = /var/lib/samba/scripts/shutdown.sh
      abort shutdown script = /sbin/shutdown -c
      logon script = scripts\logon.bat
      logon path = \%L\profiles\%U
      logon drive = X:
      logon home = \%L\%U
      domain logons = Yes
      preferred master = Yes
      include = /etc/samba/common.conf
      [homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No
      [netlogon]
      comment = Network Logon Service
      path = /var/lib/samba/netlogon
      guest ok = Yes
      locking = No
      [profiles]
      comment = Profile Share
      path = /var/lib/samba/profiles
      read only = No
      profile acls = Yes

      Example 4.3. Common Samba Configuration File: /etc/samba/common.conf

      [global]
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 50
      smb ports = 139
      name resolve order = wins bcast hosts
      time server = Yes
      printcap name = CUPS
      show add printer wizard = No
      shutdown script = /var/lib/samba/scripts/shutdown.sh
      abort shutdown script = /sbin/shutdown -c
      utmp = Yes
      map acl inherit = Yes
      printing = cups
      veto files = /*.eml/*.nws/*.{*}/
      veto oplock files = /*.doc/*.xls/*.mdb/
      include =
      # Share and Service Definitions are common to all servers
      [printers]
      comment = SMB Print Spool
      path = /var/spool/samba
      guest ok = Yes
      printable = Yes
      use client driver = Yes
      default devmode = Yes
      browseable = No
      [apps]
      comment = Application Files
      path = /apps
      admin users = bjordan
      read only = No

      Example 4.4. Server: BLDG1 (Member), File: smb.conf

      # Global parameters
      [global]
      workgroup = MEGANET
      netbios name = BLDG1
      include = /etc/samba/dom-mem.conf

      Example 4.5. Server: BLDG2 (Member), File: smb.conf

      # Global parameters
      [global]
      workgroup = MEGANET
      netbios name = BLDG2
      include = /etc/samba/dom-mem.conf

      Example 4.6. Common Domain Member Include File: dom-mem.conf

      # Global parameters
      [global]
      shutdown script = /var/lib/samba/scripts/shutdown.sh
      abort shutdown script = /sbin/shutdown -c
      preferred master = Yes
      wins server = 172.16.0.1
      idmap uid = 15000-20000
      idmap gid = 15000-20000
      include = /etc/samba/common.conf

      Example 4.7. Server: MASSIVE, File: dhcpd.conf

      +

    Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf

    # Global parameters
    [global]
    workgroup = MEGANET
    netbios name = MASSIVE
    interfaces = eth1, lo
    bind interfaces only = Yes
    passdb backend = tdbsam
    smb ports = 139
    add user script = /usr/sbin/useradd -m '%u'
    delete user script = /usr/sbin/userdel -r '%u'
    add group script = /usr/sbin/groupadd '%g'
    delete group script = /usr/sbin/groupdel '%g'
    add user to group script = /usr/sbin/usermod -G '%g' '%u'
    add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'
    preferred master = Yes
    wins support = Yes
    include = /etc/samba/dc-common.conf
    [accounts]
    comment = Accounting Files
    path = /data/accounts
    read only = No
    [service]
    comment = Financial Services Files
    path = /data/service
    read only = No
    [pidata]
    comment = Property Insurance Files
    path = /data/pidata
    read only = No

    Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf

    # Global parameters
    [global]
    shutdown script = /var/lib/samba/scripts/shutdown.sh
    abort shutdown script = /sbin/shutdown -c
    logon script = scripts\logon.bat
    logon path = \%L\profiles\%U
    logon drive = X:
    logon home = \%L\%U
    domain logons = Yes
    preferred master = Yes
    include = /etc/samba/common.conf
    [homes]
    comment = Home Directories
    valid users = %S
    read only = No
    browseable = No
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    locking = No
    [profiles]
    comment = Profile Share
    path = /var/lib/samba/profiles
    read only = No
    profile acls = Yes

    Example 4.3. Common Samba Configuration File: /etc/samba/common.conf

    [global]
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    time server = Yes
    printcap name = CUPS
    show add printer wizard = No
    shutdown script = /var/lib/samba/scripts/shutdown.sh
    abort shutdown script = /sbin/shutdown -c
    utmp = Yes
    map acl inherit = Yes
    printing = cups
    veto files = /*.eml/*.nws/*.{*}/
    veto oplock files = /*.doc/*.xls/*.mdb/
    include =
    # Share and Service Definitions are common to all servers
    [printers]
    comment = SMB Print Spool
    path = /var/spool/samba
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    default devmode = Yes
    browseable = No
    [apps]
    comment = Application Files
    path = /apps
    admin users = bjordan
    read only = No

    Example 4.4. Server: BLDG1 (Member), File: smb.conf

    # Global parameters
    [global]
    workgroup = MEGANET
    netbios name = BLDG1
    include = /etc/samba/dom-mem.conf

    Example 4.5. Server: BLDG2 (Member), File: smb.conf

    # Global parameters
    [global]
    workgroup = MEGANET
    netbios name = BLDG2
    include = /etc/samba/dom-mem.conf

    Example 4.6. Common Domain Member Include File: dom-mem.conf

    # Global parameters
    [global]
    shutdown script = /var/lib/samba/scripts/shutdown.sh
    abort shutdown script = /sbin/shutdown -c
    preferred master = Yes
    wins server = 172.16.0.1
    idmap uid = 15000-20000
    idmap gid = 15000-20000
    include = /etc/samba/common.conf

    Example 4.7. Server: MASSIVE, File: dhcpd.conf

     # Abmas Accounting Inc.
 
 default-lease-time 86400;
@@ -898,8 +898,8 @@
 net groupmap add ntgroup="Financial Services"  unixgroup=finsrvcs type=d
 net groupmap add ntgroup="Insurance Group"     unixgroup=piops type=d

    Process Startup Configuration

    - - + + There are two essential steps to process startup configuration. A process must be configured so that it is automatically restarted each time the server is rebooted. This step involves use of the chkconfig tool that @@ -908,7 +908,7 @@ directories. Links are created so that when the system run-level is changed, the necessary start or kill script is run.

    - + In the event that a service is provided not as a daemon but via the internetworking super daemon (inetd or xinetd), then the chkconfig tool makes the necessary entries in the /etc/xinetd.d directory @@ -918,10 +918,10 @@ Last, each service must be started to permit system validation to proceed. The following steps are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you are installing Samba. -

    Procedure 4.4. Process Startup Configuration Steps

    1. +

      Procedure 4.4. Process Startup Configuration Steps

      1. Use the standard system tool to configure each service to restart automatically at every system reboot. For example, - + 

         root#  chkconfig dhpc on
 root#  chkconfig named on
@@ -930,9 +930,9 @@
 root#  chkconfig swat on

      2. - - - + + + Now start each service to permit the system to be validated. Execute each of the following in the sequence shown: @@ -946,11 +946,11 @@

    Windows Client Configuration

    The procedure for desktop client configuration for the network in this chapter is similar to that used for the previous one. There are a few subtle changes that should be noted. -

    Procedure 4.5. Windows Client Configuration Steps

    1. +

      Procedure 4.5. Windows Client Configuration Steps

      1. Install MS Windows XP Professional. During installation, configure the client to use DHCP for TCP/IP protocol configuration. - + DHCP configures all Windows clients to use the WINS Server address that has been defined for the local subnet.

      2. @@ -985,7 +985,7 @@ also configure use of the identical printers that are located in the financial services department. Install printers on each machine using the following steps: -

        Procedure 4.6. Steps to Install Printer Drivers on Windows Clients

        1. +

          Procedure 4.6. Steps to Install Printer Drivers on Windows Clients

          1. Click Start->Settings->Printers+Add Printer+Next. Do not click Network printer. Ensure that Local printer is selected.

          2. @@ -1038,7 +1038,7 @@ user, of course.

          3. Instruct all users to log onto the workstation using their assigned username and password. -

        Key Points Learned

        +

    Key Points Learned

    The network you have just deployed has been a valuable exercise in forced constraint. You have deployed a network that works well, although you may soon start to see performance problems, at which time the modifications demonstrated in ??? @@ -1054,33 +1054,33 @@ to resources on the domain member servers

  • The introduction of roaming profiles -

    • Questions and Answers

    -

    +

    Questions and Answers

    +

    The example smb.conf files in this chapter make use of the include facility. How may I get to see what the actual working smb.conf settings are? -
    +
    Why does the include file common.conf have an empty include statement? -
    +
    I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. I tried using rsync to replicate the passdb.tdb, and it seems to work fine! So what is the problem? -
    +
    You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? -
    +
    How does the Windows client find the PDC? -
    +
    Why did you enable IP forwarding (routing) only on the server called MASSIVE? -
    +
    You did nothing special to implement roaming profiles. Why? -
    +
    On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. You did not configure any PAM settings. Is this an omission?
    You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
    The domain controller has an auto-shutdown script. Isn't that dangerous? -

    +

    The example smb.conf files in this chapter make use of the include facility. How may I get to see what the actual working smb.conf settings are?

    @@ -1088,7 +1088,7 @@ 

     root#  testparm -s | less

    -

    +

    Why does the include file common.conf have an empty include statement?

    The use of the empty include statement nullifies further includes. For example, let's say you @@ -1101,7 +1101,7 @@ If the include parameter was not in the common.conf file, the final smb.conf file leaves the include in place, even though the file it points to has already been included. This is a bug that will be fixed at a future date. -

    +

    I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. I tried using rsync to replicate the passdb.tdb, and it seems to work fine! @@ -1111,7 +1111,7 @@ contents between the PDC and BDCs. The most notable symptom is that workstations may not be able to log onto the network following a reboot and may have to rejoin the domain to recover network access capability. -

    +

    You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?

    No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server @@ -1120,26 +1120,26 @@

    The only exception to this rule is when the client makes a directed request from a specific DHCP server for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. -

    +

    How does the Windows client find the PDC?

    The Windows client obtains the WINS server address from the DHCP lease information. It also obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast) to register itself with the WINS server and to obtain enumeration of vital network information to enable it to operate successfully. -

    +

    Why did you enable IP forwarding (routing) only on the server called MASSIVE?

    The server called MASSIVE is acting as a router to the Internet. No other server (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network. Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network segments to the router that is its gateway to them. -

    +

    You did nothing special to implement roaming profiles. Why?

    Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional clients is to use roaming profiles. -

    +

    On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. You did not configure any PAM settings. Is this an omission?

    @@ -1157,7 +1157,7 @@ of smb.conf include files because SWAT optimizes them out into an aggregated file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to handle this functionality gracefully. -

    +

    The domain controller has an auto-shutdown script. Isn't that dangerous?

    Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ch14.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ch14.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ch14.html 2005-12-29 10:24:26.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ch14.html 2006-01-29 10:18:16.000000000 -0600 @@ -1,9 +1,9 @@ -Chapter 14. Samba Support

    Chapter 14. Samba Support
    Prev Part III. Reference Section Next

    Chapter 14. Samba Support

    Table of Contents

    Free Support
    Commercial Support

    - +Chapter 14. Samba Support

    Chapter 14. Samba Support
    Prev Part III. Reference Section Next

    Chapter 14. Samba Support

    Table of Contents

    Free Support
    Commercial Support

    + One of the most difficult to answer questions in the information technology industry is, “What is support?”. That question irritates some folks, as much as common answers may annoy others.

    - + The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: “Oh, Linux? We do not support Linux!”. It has happened to me, and similar situations happen @@ -15,50 +15,50 @@ at the right time, no matter the situation. Support is all that it takes to take away pain, disruption, inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk.

    - - - + + + One of the forces that has become a driving force for the adoption of open source software is the fact that many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or that have been found wanting for other reasons.

    - - + + In recognition of the need for needs satisfaction as the primary experience an information technology user or consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience in respect of problem resolution.

    - - - + + + In the open source software arena there are two support options: free support and paid-for (commercial) support. -

    Free Support

    - - - - - - +

    Free Support

    + + + + + + Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user supported mutual assistance.

    - - - - - + + + + + The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments. Information regarding subscription to the Samba mailing list can be found on the Samba web site. The public mailing list that can be used to obtain free, user contributed, support is called the samba list. The email address for this list is at mail:samba@samba.org. Information regarding the Samba IRC channels may be found on the Samba IRC web page.

    - - - - + + + + As a general rule, it is considered poor net behavior to contact a Samba Team member directly for free support. Most active members of the Samba Team work exceptionally long hours to assist users who have demonstrated a qualified problem. Some team members may respond to direct email @@ -66,9 +66,9 @@ Team members actually provide professional paid-for Samba support and it is therefore wise to show appropriate discretion and reservation in all direct contact.

    - - - + + + When you stumble across a Samba bug, often the quickest way to get it resolved is by posting a bug report. All such reports are mailed to the responsible code maintainer for action. The better the report, and the more serious it is, @@ -76,16 +76,16 @@ the reported bug it is likely to be rejected. It is up to you to provide sufficient information that will permit the problem to be reproduced.

    - + We all recognize that sometimes free support does not provide the answer that is sought within the time-frame required. At other times the problem is elusive and you may lack the experience necessary to isolate the problem and thus to resolve it. This is a situation where is may be prudent to purchase paid-for support. -

    Commercial Support

    +

    Commercial Support

    There are six basic support oriented services that are most commonly sought by Samba sites:

    • Assistance with network design

    • Staff Training

    • Assistance with Samba network deployment and installation

    • Priority telephone or email Samba configuration assistance

    • Trouble-shooting and diagnostic assistance

    • Provision of quality assured ready-to-install Samba binary packages

    - - + + Information regarding companies that provide professional Samba support can be obtained by performing a Google search, as well as by reference to the Samba Support web page. Companies who notify the Samba Team that they provide commercial support are given a free listing that is sorted by the country of origin. @@ -93,13 +93,13 @@ provider and to satisfy yourself that both the company and its staff are able to deliver what is required of them.

    - + The policy within the Samba Team is to treat all commercial support providers equally and to show no preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. You are encouraged to obtain the services needed from a company in your local area. The open source movement is pro-community; so do what you can to help a local business to prosper.

    - + Open source software support can be found in any quality, at any price and in any place you can to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for suffering in the mistaken belief that Samba is unsupported software it is supported. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/DMSMig.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/DMSMig.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/DMSMig.html 2005-12-29 10:24:25.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/DMSMig.html 2006-01-29 10:18:14.000000000 -0600 @@ -1,4 +1,4 @@ -Part II. Domain Members, Updating Samba and Migration

    Part II. Domain Members, Updating Samba and Migration
    Prev   Next

    Domain Members, Updating Samba and Migration

    Domain Members, Updating Samba and Migration

    +Part II. Domain Members, Updating Samba and Migration

    Part II. Domain Members, Updating Samba and Migration
    Prev   Next

    Domain Members, Updating Samba and Migration

    Domain Members, Updating Samba and Migration

    This section Samba-3 by Example covers two main topics: How to add Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other subject is that of how to migrate from and NT4 Domain, a NetWare server, or from an earlier @@ -7,4 +7,4 @@ Those who are making use of the chapter on Adding UNIX clients and servers running Samba to a Samba or a Windows networking domain may also benefit by referring to the book The Official Samba-3 HOWTO and Reference Guide. -

    Table of Contents

    7. Adding Domain Member Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using NSS LDAP
    NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    NT4/Samba Domain with Samba Domain Member Server without NSS Support
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    8. Updating Samba-3
    Introduction
    Cautions and Notes
    Upgrading from Samba 1.x and 2.x to Samba-3
    Samba 1.9.x and 2.x Versions Without LDAP
    Applicable to All Samba 2.x to Samba-3 Upgrades
    Samba-2.x with LDAP Support
    Updating a Samba-3 Installation
    Samba-3 to Samba-3 Updates on the Same Server
    Migrating Samba-3 to a New Server
    Migration of Samba Accounts to Active Directory
    9. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    10. Migrating NetWare Server to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    NetWare Migration Using LDAP Backend
    Prev   Next
    Chapter 6. A Distributed 2000-User Network Home Chapter 7. Adding Domain Member Servers and Clients
    +

    Table of Contents

    7. Adding Domain Member Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using NSS LDAP
    NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    NT4/Samba Domain with Samba Domain Member Server without NSS Support
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    8. Updating Samba-3
    Introduction
    Cautions and Notes
    Upgrading from Samba 1.x and 2.x to Samba-3
    Samba 1.9.x and 2.x Versions Without LDAP
    Applicable to All Samba 2.x to Samba-3 Upgrades
    Samba-2.x with LDAP Support
    Updating a Samba-3 Installation
    Samba-3 to Samba-3 Updates on the Same Server
    Migrating Samba-3 to a New Server
    Migration of Samba Accounts to Active Directory
    9. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    10. Migrating NetWare Server to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    NetWare Migration Using LDAP Backend
    Prev   Next
    Chapter 6. A Distributed 2000-User Network Home Chapter 7. Adding Domain Member Servers and Clients
    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/DomApps.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/DomApps.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/DomApps.html 2005-12-29 10:24:26.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/DomApps.html 2006-01-29 10:18:15.000000000 -0600 @@ -1,9 +1,9 @@ -Chapter 12. Integrating Additional Services
    Chapter 12. Integrating Additional Services
    Prev Part III. Reference Section Next

    Chapter 12. Integrating Additional Services

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-Existing Conflicting RPMs
    Key Points Learned
    Questions and Answers

    - - - +Chapter 12. Integrating Additional Services

    Chapter 12. Integrating Additional Services
    Prev Part III. Reference Section Next

    Chapter 12. Integrating Additional Services

    Table of Contents

    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-Existing Conflicting RPMs
    Key Points Learned
    Questions and Answers

    - + + + + You've come a long way now. You have pretty much mastered Samba-3 for most uses it can be put to. Up until now, you have cast Samba-3 in the leading role, and where authentication was required, you have used one or another of @@ -14,7 +14,7 @@ implementing Samba and Samba-supported services in a domain controlled by the latest Windows authentication technologies. Let's get started this is leading edge. -

    Introduction

    +

    Introduction

    Abmas has continued its miraculous growth; indeed, nothing seems to be able to stop its diversification into multiple (and seemingly unrelated) fields. Its latest acquisition is Abmas Snack Foods, a big player in the snack-food @@ -30,17 +30,17 @@ You have decided to set the ball rolling by introducing Samba-3 into the network gradually, taking over key services and easing the way to a full migration and, therefore, integration into Abmas's existing business later. -

    Assignment Tasks

    - - +

    Assignment Tasks

    + + You've promised the skeptical Abmas Snack Foods management team that you can show them how Samba can ease itself and other Open Source technologies into their existing infrastructure and deliver sound business advantages. Cost cutting is high on their agenda (a major promise of the acquisition). You have chosen Web proxying and caching as your proving ground.

    - - + + Abmas Snack Foods has several thousand users housed at its head office and multiple regional offices, plants, and warehouses. A high proportion of the business's work is done online, so Internet access for most of these @@ -50,9 +50,9 @@ the team soon discovered proxying and caching. In fact, they became one of the earliest commercial users of Microsoft ISA.

    - - - + + + The team is not happy with ISA. Because it never lived up to its marketing promises, it underperformed and had reliability problems. You have pounced on the opportunity to show what Open Source can do. The one thing they do like, however, is ISA's @@ -63,7 +63,7 @@

    This is a hands-on exercise. You build software applications so that you obtain the functionality Abmas needs. -

    Dissection and Discussion

    +

    Dissection and Discussion

    The key requirements in this business example are straightforward. You are not required to do anything new, just to replicate an existing system, not lose any existing features, and improve performance. The key points are: @@ -73,20 +73,20 @@ Distributed system to accommodate load and geographical distribution of users

  • Seamless and transparent interoperability with the existing Active Directory domain -

    • Technical Issues

    - - - - - - +

    Technical Issues

    + + + - - - - - + + + + + + + + Functionally, the user's Internet Explorer requests a browsing session with the Squid proxy, for which it offers its AD authentication token. Squid hands off the authentication request to the Samba-3 authentication helper application @@ -107,25 +107,25 @@ Configuring, compiling, and then installing the supporting Samba-3 components

  • Tying it all together -

    • Political Issues

    +

    Political Issues

    You are a stranger in a strange land, and all eyes are upon you. Some would even like to see you fail. For you to gain the trust of your newly acquired IT people, it is essential that your solution does everything the old one did, but does it better in every way. Only then will the entrenched positions consider taking up your new way of doing things on a wider scale. -

    Implementation

    - +

    Implementation

    + First, your system needs to be prepared and in a known good state to proceed. This consists of making sure that everything the system depends on is present and that everything that could interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3 packages and updating them if necessary. If conflicting packages of these programs are installed, they must be removed.

    - + The following packages should be available on your Red Hat Linux system:

    • - - + + krb5-libs

    • krb5-devel @@ -136,14 +136,14 @@

    • pam_krb5

    - + In the case of SUSE Linux, these packages are called:

    • heimdal-lib

    • heimdal-devel

    • - + heimdal

    • pam_krb5 @@ -152,26 +152,26 @@ them from the vendor's installation media. Follow the administrative guide for your Linux system to ensure that the packages are correctly updated.

      Note

      - - - + + + If the requirement is for interoperation with MS Windows Server 2003, it will be necessary to ensure that you are using MIT Kerberos version 1.3.1 or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires updating.

      - - + + Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version.

      Removal of Pre-Existing Conflicting RPMs

      - + If Samba and/or Squid RPMs are installed, they should be updated. You can build both from source.

      - - - + + + Locating the packages to be un-installed can be achieved by running: 

       root#  rpm -qa | grep -i samba
@@ -181,11 +181,11 @@
 
       root#  rpm -e samba-common
 
      
-	
      Kerberos Configuration
      
-	
-	
-	
+	
      Kerberos Configuration
      
 	
+	
+	
+	
 	The systems Kerberos installation must be configured to communicate with 
 	your primary Active Directory server (ADS KDC).
 	
      
@@ -193,13 +193,13 @@
 	although the current default Red Hat MIT version 1.2.7 gives acceptable results 
 	unless you are using Windows 2003 servers.
 	
      
-	
-	
-	
-	
-	
+	
+	
 	
 	
+	
+	
+	
 	Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an /etc/krb5.conf 
 	file in order to work correctly. All ADS domains automatically create SRV records in the 
 	DNS zone Kerberos.REALM.NAME for each KDC in the realm. Since both 
@@ -207,25 +207,25 @@
 	automatically find the KDCs. In addition, krb5.conf allows 
 	specifying only a single KDC, even if there is more than one. Using the DNS lookup 
 	allows the KRB5 libraries to use whichever KDCs are available.
-	
      Procedure 12.1. Kerberos Configuration Steps
      1. 
-		
+	
        Procedure 12.1. Kerberos Configuration Steps
        1. 
+		
 		If you find the need to manually configure the krb5.conf, you should edit it
 		to have the contents shown in ???. The final fully qualified path for this file 
 		should be /etc/krb5.conf.
 		
        2. 
-		
-		
-		
-		
-		
-		
-		
-		
-		
+		
+		
+		
+		
+		
+		
 		
 		
 		
-		
+		
+		
+		
+		
 		The following gotchas often catch people out. Kerberos is case sensitive. Your realm must
 		be in UPPERCASE, or you will get an error: “Cannot find KDC for requested realm while getting
 		initial credentials”.  Kerberos is picky about time synchronization. The time
@@ -241,7 +241,7 @@
 		NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error
 		when you try to join the realm.
 		
        3. 
-		
+		
 		You are now ready to test your installation by issuing the command:
 
           root#  kinit [USERNAME@REALM]
@@ -261,29 +261,29 @@
 	LONDON.ABMAS.BIZ = {
 	kdc = w2k3s.london.abmas.biz
 	}
-
        
+

      The command 

       root#  klist -e

      shows the Kerberos tickets cached by the system. -

      Samba Configuration

      - +

      Samba Configuration

      + Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it has the necessary components to interface with Active Directory. -

      Procedure 12.2. Securing Samba-3 With ADS Support Steps

      1. - - - - - +

        Procedure 12.2. Securing Samba-3 With ADS Support Steps

        1. + + + + + Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team FTP site. The official Samba Team RPMs for Red Hat Fedora Linux contain the ntlm_auth tool needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use.

          - - + + The necessary, validated RPM packages for SUSE Linux may be obtained from the SerNet FTP site that is located in Germany. All SerNet RPMs are validated, have the necessary @@ -293,11 +293,11 @@ Using your favorite editor, change the /etc/samba/smb.conf file so it has contents similar to the example shown in ???.

        2. - - - i - - + + + i + + Next you need to create a computer account in the Active Directory. This sets up the trust relationship needed for other clients to authenticate to the Samba server with an Active Directory Kerberos ticket. @@ -307,11 +307,11 @@ root# net ads join -U administrator%vulcon

        3. - - - - - + + + + + Your new Samba binaries must be started in the standard manner as is applicable to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: 

          @@ -320,11 +320,11 @@
 root#  winbindd -B

        4. - - - - + + + + We now need to test that Samba is communicating with the Active Directory domain; most specifically, we want to see whether winbind is enumerating users and groups. Issue the following commands: @@ -357,8 +357,8 @@

          This enumerates all the groups in your Active Directory tree.

        5. - - + + Squid uses the ntlm_auth helper build with Samba-3. You may test ntlm_auth with the command: 

          @@ -370,14 +370,14 @@
 root#  NT_STATUS_OK: Success (0x0)

        6. - - - - - - - - + + + + + + + + The ntlm_auth helper, when run from a command line as the user “root”, authenticates against your Active Directory domain (with the aid of winbind). It manages this by reading from the winbind privileged pipe. @@ -395,37 +395,37 @@ root# chgrp squid /var/lib/samba/winbindd_privileged root# chmod 750 /var/lib/samba/winbindd_privileged

          -

      NSS Configuration

      - - - +

    NSS Configuration

    + + + For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.

    Edit your /etc/nsswitch.conf file so it has the parameters shown in ???. -

    Example 12.2. Samba Configuration File: /etc/samba/smb.conf

    [global]
    workgroup = LONDON
    netbios name = W2K3S
    realm = LONDON.ABMAS.BIZ
    security = ads
    encrypt passwords = yes
    password server = w2k3s.london.abmas.biz
    # separate domain and username with '/', like DOMAIN/username
    winbind separator = /
    # use UIDs from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use GIDs from 10000 to 20000 for domain groups
    idmap gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    winbind user default domain = yes

    Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf

    +	
    Example 12.2. Samba Configuration  File: /etc/samba/smb.conf
     
    [global]
    workgroup = LONDON
    netbios name = W2K3S
    realm = LONDON.ABMAS.BIZ
    security = ads
    encrypt passwords = yes
    password server = w2k3s.london.abmas.biz
    # separate domain and username with '/', like DOMAIN/username
    winbind separator = /
    # use UIDs from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use GIDs from 10000 to 20000 for domain groups
    idmap gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    winbind user default domain = yes
    Example 12.3. NSS Configuration File Extract  File: /etc/nsswitch.conf
     passwd: files winbind
 shadow: files
 group: files winbind
-

    Squid Configuration

    - - +

    Squid Configuration

    + + Squid must be configured correctly to interact with the Samba-3 components that handle Active Directory authentication. -

    Configuration

    Procedure 12.3. Squid Configuration Steps

    1. - - - +

    Configuration

    Procedure 12.3. Squid Configuration Steps

    1. + + + If your Linux distribution is SUSE Linux 9, the version of Squid supplied is already enabled to use the winbind helper agent. You can therefore omit the steps that would build the Squid binary programs.

    2. - - - - - + + + + + Squid, by default, runs as the user nobody. You need to add a system user squid and a system group squid if they are not set up already (if the default @@ -433,16 +433,16 @@ squid user in /etc/passwd and a squid group in /etc/group if these aren't there already.

    3. - - + + You now need to change the permissions on Squid's var directory. Enter the following command: 

       root#  chown -R squid /var/cache/squid

    4. - - + + Squid must also have control over its logging. Enter the following commands: 

       root#  chown -R chown squid:squid /var/log/squid
@@ -456,11 +456,11 @@
 root#  chmod 770 /var/cache/squid

    5. - + The /etc/squid/squid.conf file must be edited to include the lines from ??? and ???.

    6. - + You must create Squid's cache directories before it may be run. Enter the following command: 

       root#  squid -z
@@ -487,23 +487,23 @@
 	auth_param basic credentialsttl 2 hours
 	acl AuthorizedUsers proxy_auth REQUIRED
 	http_access allow all AuthorizedUsers
-

    Key Points Learned

    - - - - - +

    Key Points Learned

    + + + + + Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft Windows clients use, even when accessing traditional services such as Web browsers. Depending on whom you discuss this with, this is either good or bad. No matter how you might evaluate this, the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over the cookie-based authentication regime used by all competing browsers. It is Samba's implementation of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. -

    Questions and Answers

    - - - - +

    Questions and Answers

    + + + + The development of the ntlm_auth module was first discussed in many Open Source circles in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of ntlm_auth during one of the late developer meetings that took place. Since that time, the @@ -522,34 +522,34 @@ You would be well-advised to recognize that all cache-intensive proxying solutions demand a lot of memory. Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. -

    +

    What does Samba have to do with Web proxy serving? -
    +
    What other services does Samba provide? -
    +
    Does use of Samba (ntlm_auth) improve the performance of Squid? -

    +

    What does Samba have to do with Web proxy serving?

    - - - - - + + + + + To provide transparent interoperability between Windows clients and the network services that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit of Open Source software is that it can readily be reused. The current ntlm_auth module is basically a wrapper around authentication code from the core of the Samba project.

    - - - - - + + + - - - + + + + + The ntlm_auth module supports basic plain-text authentication and NTLMSSP protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without the user being interrupted via his or her Windows logon credentials. This facility is available with @@ -557,36 +557,36 @@ There are a few open source initiatives to provide support for these protocols in the Apache Web server also.

    - + The short answer is that by adding a wrapper around key authentication components of Samba, other projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. -

    +

    What other services does Samba provide?

    - - - - - + + + + + Samba-3 is a file and print server. The core components that provide this functionality are smbd, nmbd, and the identity resolver daemon, winbindd.

    - - + + Samba-3 is an SMB/CIFS client. The core component that provides this is called smbclient.

    - - - - - + + + + + Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux servers and clients. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switch (NSS) modules to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial server products). -

    +

    Does use of Samba (ntlm_auth) improve the performance of Squid?

    Not really. Samba's ntlm_auth module handles only authentication. It requires that diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ExNetworks.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ExNetworks.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ExNetworks.html 2005-12-29 10:24:19.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ExNetworks.html 2006-01-29 10:18:12.000000000 -0600 @@ -19,4 +19,4 @@ commercial support options may be obtained from the commercial support pages from the Samba web site. -

    Table of Contents

    1. No-Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    2. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    3. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    4. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. Making Happy Users
    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    6. A Distributed 2000-User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    Prev   Next
    Preface Home Chapter 1. No-Frills Samba Servers
    +

    Table of Contents

    1. No-Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    2. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    3. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    4. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. Making Happy Users
    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    6. A Distributed 2000-User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    Prev   Next
    Preface Home Chapter 1. No-Frills Samba Servers
    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/go01.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/go01.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/go01.html 2005-12-29 10:24:29.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/go01.html 2006-01-29 10:18:18.000000000 -0600 @@ -1,4 +1,4 @@ -Glossary
    Glossary
    Prev   Next

    Glossary

    Access Control List

    +Glossary

    Glossary
    Prev   Next

    Glossary

    Access Control List

    A detailed list of permissions granted to users or groups with respect to file and network resource access.

    Active Directory Service

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/HA.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/HA.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/HA.html 2005-12-29 10:24:26.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/HA.html 2006-01-29 10:18:16.000000000 -0600 @@ -1,7 +1,7 @@ -Chapter 13. Performance, Reliability, and Availability

    Chapter 13. Performance, Reliability, and Availability
    Prev Part III. Reference Section Next

    Chapter 13. Performance, Reliability, and Availability

    Table of Contents

    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN-Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Large Directories
    Key Points Learned

    - - - +Chapter 13. Performance, Reliability, and Availability

    Chapter 13. Performance, Reliability, and Availability
    Prev Part III. Reference Section Next

    Chapter 13. Performance, Reliability, and Availability

    Table of Contents

    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN-Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Large Directories
    Key Points Learned

    + + + Well, you have reached one of the last chapters of this book. It is customary to attempt to wrap up the theme and contents of a book in what is generally regarded as the chapter that should draw conclusions. This book is a suspense thriller, and since @@ -10,8 +10,8 @@ regarding some of the things everyone can do to deliver a reliable Samba-3 network.

     

    In a world so full of noise, how can the sparrow be heard? -

    		 
     --Anonymous

    Introduction

    - +

    		 
     --Anonymous

    Introduction

    + The sparrow is a small bird whose sounds are drowned out by the noise of the busy world it lives in. Likewise, the simple steps that can be taken to improve the reliability and availability of a Samba network are often drowned out by the volume @@ -20,22 +20,22 @@ itself to discussion of clustering because each clustering methodology uses its own custom tools and methods. Only passing comments are offered concerning these methods.

    - - - + + + A search for “samba cluster” produced 71,600 hits. And a search for “highly available samba” and “highly available windows” produced an amazing number of references. It is clear from the resources on the Internet that Windows file and print services availability, reliability, and scalability are of vital interest to corporate network users.

    - + So without further background, you can review a checklist of simple steps that can be taken to ensure acceptable network performance while keeping costs of ownership well under control. -

    Dissection and Discussion

    - - +

    Dissection and Discussion

    + + If it is your purpose to get the best mileage out of your Samba servers, there is one rule that must be obeyed. If you want the best, keep your implementation as simple as possible. You may well be forced to introduce some complexities, but you should do so only as a last resort. @@ -44,8 +44,8 @@ make life easier for your successor. Simple implementations can be more readily audited than can complex ones.

    - - + + Problems reported by users fall into three categories: configurations that do not work, those that have broken behavior, and poor performance. The term broken behavior means that the function of a particular Samba component appears to work sometimes, but not at @@ -54,12 +54,12 @@ list of Windows machines in MS Explorer changes, sometimes listing machines that are running and at other times not listing them even though the machines are in use on the network.

    - - - - - - + + + + + + A significant number of reports concern problems with the smbfs file system driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that smbfs is part of Samba, simply because Samba includes the front-end tools @@ -70,32 +70,32 @@ common infrastructure with some Samba components, but they are not maintained as part of Samba and are really foreign to it.

    - + The new project, cifsfs, is destined to replace smbfs. It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in this project.

    Table 13.1 lists typical causes of:

    • Not Working (NW)

    • Broken Behavior (BB)

    • Poor Performance (PP)

    Table 13.1. Effect of Common Problems

    Problem

    NW

    BB

    PP

    File locking

    -

    X

    -

    Hardware problems

    X

    X

    X

    Incorrect authentication

    X

    X

    -

    Incorrect configuration

    X

    X

    X

    LDAP problems

    X

    X

    -

    Name resolution

    X

    X

    X

    Printing problems

    X

    X

    -

    Slow file transfer

    -

    -

    X

    Winbind problems

    X

    X

    -

    - + It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate problems that affect basic network operation. This book has provided sufficient working examples to help you to avoid all these problems. -

    Guidelines for Reliable Samba Operation

    - - +

    Guidelines for Reliable Samba Operation

    + + Your objective is to provide a network that works correctly, can grow at all times, is resilient at times of extreme demand, and can scale to meet future needs. The following subject areas provide pointers that can help you today. -

    Name Resolution

    +

    Name Resolution

    There are three basic current problem areas: bad hostnames, routed networks, and network collisions. These are covered in the following discussion. -

    Bad Hostnames

    - - - - - +

    Bad Hostnames

    + + + + + When configured as a DHCP client, a number of Linux distributions set the system hostname to localhost. If the parameter netbios name is not specified to something other than localhost, the Samba server appears @@ -107,13 +107,13 @@ the local Windows machine itself. Hostnames must be valid for Windows networking to function correctly.

    - + A few sites have tried to name Windows clients and Samba servers with a name that begins with the digits 1-9. This does not work either because it may result in the client or server attempting to use that name as an IP address.

    - - + + A Samba server called FRED in a NetBIOS domain called COLLISION in a network environment that is part of the fully-qualified Internet domain namespace known as parrots.com, results in DNS name lookups for fred.parrots.com @@ -122,49 +122,49 @@ attempts to resolve fred.parrots.com.parrots.com, which most likely fails given that you probably do not have this in your DNS namespace.

    Note

    - - - + + + An Active Directory realm called collision.parrots.com is perfectly okay, although it too must be capable of being resolved via DNS, something that functions correctly if Windows 200x ADS has been properly installed and configured. -

    Routed Networks

    - - - +

    Routed Networks

    + + + NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use of UDP-based broadcast traffic, as you saw during the exercises in ???.

    - - - + + + UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based networking cannot function across routed networks (i.e., multi-subnet networks) unless special provisions are made:

    • - - - + + + Either install on every Windows client an LMHOSTS file (located in the directory C:\windows\system32\drivers\etc). It is also necessary to add to the Samba server smb.conf file the parameters remote announce and remote browse sync. For more information, refer to the online manual page for the smb.conf file.

    • - + Or configure Samba as a WINS server, and configure all network clients to use that WINS server in their TCP/IP configuration.

    Note

    - - + + The use of DNS is not an acceptable substitute for WINS. DNS does not store specific information regarding NetBIOS networking particulars that get stored in the WINS name resolution database and that Windows clients require and depend on. -

    Network Collisions

    - - - - +

    Network Collisions

    + + + + Excessive network activity causes NetBIOS network timeouts. Timeouts may result in blue screen of death (BSOD) experiences. High collision rates may be caused by excessive UDP broadcast activity, by defective networking hardware, or through excessive network @@ -173,9 +173,9 @@ The use of WINS is highly recommended to reduce network broadcast traffic, as outlined in ???.

    - - - + + + Under no circumstances should the facility be supported by many routers, known as NetBIOS forwarding, unless you know exactly what you are doing. Inappropriate use of this facility can result in UDP broadcast storms. In one case in 1999, a university network became @@ -183,13 +183,13 @@ testing of a Samba server. The maximum throughput on a 100-Base-T (100 MB/sec) network was less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance immediately returned to 11 MB/sec. -

    Samba Configuration

    +

    Samba Configuration

    As a general rule, the contents of the smb.conf file should be kept as simple as possible. No parameter should be specified unless you know it is essential to operation.

    - - - + + + Many UNIX administrators like to fully document the settings in the smb.conf file. This is a bad idea because it adds content to the file. The smb.conf file is re-read by every smbd process every time the file timestamp changes (or, on systems where this does not work, every 20 seconds or so). @@ -197,7 +197,7 @@ As the size of the smb.conf file grows, the risk of introducing parsing errors also increases. It is recommended to keep a fully documented smb.conf file on hand, and then to operate Samba only with an optimized file. -

    +

    The preferred way to maintain a documented file is to call it something like smb.conf.master. You can generate the optimized file by executing: 

    @@ -223,7 +223,7 @@
 Server role: ROLE_DOMAIN_PDC
 Press enter to see a dump of your service definitions

    - + You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. The important thing to note is the noted Server role, as well as warning messages. Noted configuration conflicts must be remedied before proceeding. For example, the following error message represents a @@ -233,28 +233,28 @@ cannot be set in the smb.conf file. nmbd will abort with this setting.

    - - - + + + There are two parameters that can cause severe network performance degradation: socket options and socket address. The socket options parameter was often necessary when Samba was used with the Linux 2.2.x kernels. Later kernels are largely self-tuning and seldom benefit from this parameter being set. Do not use either parameter unless it has been proven necessary to use them.

    - - - - + + + + Another smb.conf parameter that may cause severe network performance degradation is the strict sync parameter. Do not use this at all. There is no good reason to use this with any modern Windows client. The strict sync is often used with the sync always parameter. This, too, can severely degrade network performance, so do not set it; if you must, do so with caution.

    - - - - + + + + Finally, many network administrators deliberately disable opportunistic locking support. While this does not degrade Samba performance, it significantly degrades Windows client performance because this disables local file caching on Windows clients and forces every file read and written to @@ -262,12 +262,12 @@ support, do so only on the share on which it is required. That way, all other shares can provide oplock support for operations that are tolerant of it. See ??? for more information. -

    Use and Location of BDCs

    - - - - - +

    Use and Location of BDCs

    + + + + + On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of authentication and logon processing. When a sole BDC on a routed network segment gets heavily @@ -275,13 +275,13 @@ to a BDC on a distant network segment. This significantly hinders WAN operations and is undesirable.

    - - + + As a general guide, instead of adding domain member servers to a network, you would be better advised to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add domain member servers. This practice ensures that there are always sufficient domain controllers to handle logon requests and authentication traffic. -

    Use One Consistent Version of MS Windows Client

    +

    Use One Consistent Version of MS Windows Client

    Every network client has its own peculiarities. From a management perspective, it is easier to deal with one version of MS Windows that is maintained to a consistent update level than it is to deal with a mixture of clients. @@ -289,61 +289,61 @@ On a number of occasions, particular Microsoft service pack updates of a Windows server or client have necessitated special handling from the Samba server end. If you want to remain sane, keep you client workstation configurations consistent. -

    For Scalability, Use SAN-Based Storage on Samba Servers

    - - +

    For Scalability, Use SAN-Based Storage on Samba Servers

    + + Many SAN-based storage systems permit more than one server to share a common data store. Use of a shared SAN data store means that you do not need to use time- and resource-hungry data synchronization techniques.

    - - + + The use of a collection of relatively low-cost front-end Samba servers that are coupled to a shared backend SAN data store permits load distribution while containing costs below that of installing and managing a complex clustering facility. -

    Distribute Network Load with MSDFS

    - - +

    Distribute Network Load with MSDFS

    + + Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits data to be accessed from a single share and yet to actually be distributed across multiple actual servers. Refer to TOSHARG2, Chapter 19, for information regarding implementation of an MSDFS installation.

    - - + + The combination of multiple backend servers together with a front-end server and use of MSDFS can achieve almost the same as you would obtain with a clustered Samba server. -

    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth

    - - - +

    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth

    + + + Consider using rsync to replicate data across the WAN during times of low utilization. Users can then access the replicated data store rather than needing to do so across the WAN. This works best for read-only data, but with careful planning can be implemented so that modified files get replicated back to the point of origin. Be careful with your implementation if you choose to permit modification and return replication of the modified file; otherwise, you may inadvertently overwrite important data. -

    Hardware Problems

    - - - - +

    Hardware Problems

    - + + + + + Networking hardware prices have fallen sharply over the past 5 years. A surprising number of Samba networking problems over this time have been traced to defective network interface cards (NICs) or defective HUBs, switches, and cables.

    - + Not surprising is the fact that network administrators do not like to be shown to have made a bad decision. Money saved in buying low-cost hardware may result in high costs incurred in corrective action.

    - - - - - + + + + + Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent or persistent data corruption, slow network throughput, low performance, or even as BSOD problems with MS Windows clients. In one case, a company updated several workstations with newer, faster @@ -352,14 +352,14 @@

    Defective hardware problems may take patience and persistence before the real cause can be discovered.

    - + Networking hardware defects can significantly impact perceived Samba performance, but defective RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server operations. One business came to this realization only after replacing a Samba installation with MS Windows Server 2000 running on the same hardware. The root of the problem completely eluded the network administrator until the entire server was replaced. While you may well think that this would never happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. -

    Large Directories

    +

    Large Directories

    There exist applications that create or manage directories containing many thousands of files. Such applications typically generate many small files (less than 100 KB). At the best of times, under UNIX, listing of the files in a directory that contains many files is slow. By default, Windows NT, 200x, @@ -379,7 +379,7 @@ that the file system is on will be thrashing wildly.

    Samba-3.0.12 and later, includes new code that radically improves Samba perfomance. The secret to this is - really in the case sensitive = True line. This tells smbd never to scan + really in the case sensitive = True line. This tells smbd never to scan for case-insensitive versions of names. So if an application asks for a file called FOO, and it can not be found by a simple stat call, then smbd will return "file not found" immediately without scanning the containing directory for a version of a different case. @@ -399,7 +399,7 @@ All files and directories under the path directory must be in the same case as specified in the smb.conf stanza. This means that smbd will not be able to find lower case filenames with these settings. Note, this is done on a per-share basis. -

    Key Points Learned

    +

    Key Points Learned

    This chapter has touched in broad sweeps on a number of simple steps that can be taken to ensure that your Samba network is resilient, scalable, and reliable, and that it performs well. @@ -408,7 +408,7 @@ In the long term, that may not be you. Spare a thought for your successor and give him or her an even break.

    - + Last, but not least, you should not only keep the network design simple, but also be sure it is well documented. This book may serve as your pattern for documenting every aspect of your design, its implementation, and particularly the objects and assumptions diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/happy.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/happy.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/happy.html 2005-12-29 10:24:18.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/happy.html 2006-01-29 10:18:11.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 5. Making Happy Users

    Chapter 5. Making Happy Users
    Prev Part I. Example Network Configurations Next

    Chapter 5. Making Happy Users

    Table of Contents

    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers

    +Chapter 5. Making Happy Users

    Chapter 5. Making Happy Users
    Prev Part I. Example Network Configurations Next

    Chapter 5. Making Happy Users

    Table of Contents

    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers

    It is said that “a day that is without troubles is not fulfilling. Rather, give me a day of troubles well handled so that I can be content with my achievements.”

    @@ -6,7 +6,7 @@ or experience them. The design of the network implemented in ??? may create problems for some network users. The following lists some of the problems that may occur: -

    Caution

    +

    Caution

    A significant number of network administrators have responded to the guidance given here. It should be noted that there are sites that have a single PDC for many hundreds of concurrent network clients. Network bandwidth, network bandwidth utilization, and server load @@ -30,9 +30,9 @@ 30 to 150 clients. The actual limits are determined by network operational characteristics.

    - - - + + + If the domain controller provides only network logon services and all file and print activity is handled by domain member servers, one domain controller per 150 clients on a single network segment may suffice. In any @@ -46,25 +46,25 @@ that can be supported is limited by the CPU speed, memory and the workload on the Samba server as well as network bandwidth utilization.

    Slow logons and log-offs

    - + Slow logons and log-offs may be caused by many factors that include:

    • - - + + Excessive delays in the resolution of a NetBIOS name to its IP address. This may be observed when an overloaded domain controller is also the WINS server. Another cause may be the failure to use a WINS server (this assumes that there is a single network segment).

    • - - - + + + Network traffic collisions due to overloading of the network segment. One short-term workaround to this may be to replace network HUBs with Ethernet switches.

    • - + Defective networking hardware. Over the past few years, we have seen on the Samba mailing list a significant increase in the number of problems that were traced to a defective network interface controller, @@ -72,8 +72,8 @@ it was the erratic nature of the problem that ultimately pointed to the cause of the problem.

    • + - Excessively large roaming profiles. This type of problem is typically the result of poor user education as well as poor network management. It can be avoided by users not storing huge quantities of email in @@ -81,7 +81,7 @@ These are old bad habits that require much discipline and vigilance on the part of network management.

    • - + You should verify that the Windows XP WebClient service is not running. The use of the WebClient service has been implicated in many Windows networking-related problems. @@ -90,26 +90,26 @@ Loss of access to network resources during client operation may be caused by a number of factors, including:

      • - + Network overload (typically indicated by a high network collision rate)

      • Server overload

      • - + Timeout causing the client to close a connection that is in use but has been latent (no traffic) for some time (5 minutes or more)

      • - + Defective networking hardware

      - + No matter what the cause, a sudden loss of access to network resources can result in BSOD (blue screen of death) situations that necessitate rebooting of the client workstation. In the case of a mild problem, retrying to access the network drive of the printer may restore operations, but in any case this is a serious problem that may lead to the next problem, data corruption.

    Potential data corruption

    - + Data corruption is one of the most serious problems. It leads to uncertainty, anger, and frustration, and generally precipitates immediate corrective demands. Management response to this type of problem may be rational, as well as highly irrational. There have been @@ -123,29 +123,29 @@ anticipate and combat network performance issues. You can work through complex and thorny methods to improve the reliability of your network environment, but be warned that all such steps demand the price of complexity. -

    Regarding LDAP Directories and Windows Computer Accounts

    - +

    Regarding LDAP Directories and Windows Computer Accounts

    + Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some constraints that are described in this section.

    - - - - + + + + The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats them. A user account and a machine account are indistinguishable from each other, except that the machine account ends in a $ character, as do trust accounts.

    - - + + The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID is a design decision that was made a long way back in the history of Samba development. It is unlikely that this decision will be reversed or changed during the remaining life of the Samba-3.x series.

    - - + + The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that must refer back to the host operating system on which Samba is running. The name service switch (NSS) is the preferred mechanism that shields applications (like Samba) from the @@ -158,13 +158,13 @@ possible to do this via LDAP, and for that Samba provides the appropriate hooks so that all account entities can be located in an LDAP directory.

    - + For many the weapon of choice is to use the PADL nss_ldap utility. This utility must be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That is fundamentally an LDAP design question. The information provided on the Samba list and in the documentation is directed at providing working examples only. The design of an LDAP directory is a complex subject that is beyond the scope of this documentation. -

    Introduction

    +

    Introduction

    You just opened an email from Christine that reads:

    Good morning, @@ -193,8 +193,8 @@ regain control of our vital IT operations.

    		 
     --Christine

    - - + + Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a single domain controller is a poor design that has obvious operational effects that may frustrate users. Here is your reply: @@ -204,56 +204,56 @@ boost staff morale. Please go ahead with your plans. If you have any problems, please let me know. Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait for approval; I appreciate the urgency. -

    		 
     --Bob

    Assignment Tasks

    +

    		 
     --Bob

    Assignment Tasks

    The priority of assigned tasks in this chapter is:

    1. - - - - + + + + Implement Backup Domain Controllers (BDCs) in each building. This involves a change from a tdbsam backend that was used in the previous chapter to an LDAP-based backend.

      You can implement a single central LDAP server for this purpose.

    2. - - - - + + + + Rectify the problem of excessive logon times. This involves redirection of folders to network shares as well as modification of all user desktops to exclude the redirected folders from being loaded at login time. You can also create a new default profile that can be used for all new users.

    - + You configure a new MS Windows XP Professional workstation disk image that you roll out to all desktop users. The instructions you have created are followed on a staging machine from which all changes can be carefully tested before inflicting them on your network users.

    - + This is the last network example in which specific mention of printing is made. The example again makes use of the CUPS printing system. -

    Dissection and Discussion

    - - - +

    Dissection and Discussion

    + + + The implementation of Samba BDCs necessitates the installation and configuration of LDAP. For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial LDAP servers in current use with Samba-3 include:

    • - + Novell eDirectory is being successfully used by some sites. Information on how to use eDirectory can be obtained from the Samba mailing lists or from Novell.

    • - + IBM Tivoli Directory Server can be used to provide the Samba LDAP backend. Example schema files are provided in the Samba source code tarball under the directory ~samba/example/LDAP.

    • - + Sun ONE Identity Server product suite provides an LDAP server that can be used for Samba. Example schema files are provided in the Samba source code tarball under the directory @@ -264,19 +264,19 @@ initialize the LDAP directory database. OpenLDAP itself has only command-line tools to help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges.

      - + For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include GUI-based directory management tools. Even a simple task such as adding users to the OpenLDAP database requires an understanding of what you are doing, why you are doing it, and the tools that you must use.

      - - - - - - - + + + + + + + When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. High availability operation may be obtained through directory replication/synchronization and master/slave server configurations. OpenLDAP is a mature platform to host the organizational @@ -286,10 +286,10 @@ contents with greater ability to back up, restore, and modify the directory than is generally possible with Microsoft Active Directory.

      - - - - + + + + A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured for a specific task orientation. It comes with a set of administrative tools that is entirely customized @@ -300,8 +300,8 @@ MS ADAM that provides more generic LDAP services, yet it does not have the vanilla-like services of OpenLDAP.

      - - + + You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly if you find the challenge of learning about LDAP directories, schemas, configuration, and management tools and the creation of shell and Perl scripts a bit @@ -309,7 +309,7 @@ many ready-to-use schemas. Samba-3 provides an OpenLDAP schema file that is required for use as a passdb backend.

      - + For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, there are a few nice Web-based tools that may help you to manage your users and groups more effectively. The Web-based tools you might like to consider include the @@ -334,10 +334,10 @@ LDAP System Administration, by Jerry Carter quite useful.

      - - - - + + + + Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must be loaded over the WAN connection. The addition of BDCs on each network segment significantly @@ -345,31 +345,31 @@ user desktops, and this must be done in a way that wins their support and does not cause further loss of staff morale. The following procedures solve this problem.

      - + There is also an opportunity to implement smart printing features. You add this to the Samba configuration so that future printer changes can be managed without need to change desktop configurations.

      You add the ability to automatically download new printer drivers, even if they are not installed in the default desktop profile. Only one example of printing configuration is given. It is assumed that you can extrapolate the principles and use them to install all printers that may be needed. -

      Technical Issues

      - - - +

      Technical Issues

      + + + The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account attributes Samba needs. Samba-3 can use the LDAP backend to store:

      • Windows Networking User Accounts

      • Windows NT Group Accounts

      • Mapping Information between UNIX Groups and Windows NT Groups

      • ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)

      - - - - - - - - - + + + + + + + + + The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking accounts in the LDAP backend. This implies the need to use the PADL LDAP tools. The resolution @@ -378,16 +378,16 @@ that integrates with the NSS. The same requirements exist for resolution of the UNIX username to the UID. The relationships are demonstrated in ???.

      Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

      The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

      - - + + You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really ought to learn how to configure secure communications over LDAP so that site security is not at risk. This is not covered in the following guidance.

      - - - - + + + + When OpenLDAP has been made operative, you configure the PDC called MASSIVE. You initialize the Samba secrets.tdb file. Then you create the LDAP Interchange Format (LDIF) file from which the LDAP database can be initialized. @@ -395,27 +395,27 @@ You can also find on the enclosed CD-ROM, in the Chap06 directory, a few tools that help to manage user and group configuration.

      - - - + + + In order to effect folder redirection and to add robustness to the implementation, create a network default profile. All network users workstations are configured to use the new profile. Roaming profiles will automatically be deleted from the workstation when the user logs off.

      - + The profile is configured so that users cannot change the appearance of their desktop. This is known as a mandatory profile. You make certain that users are able to use their computers efficiently.

      - + A network logon script is used to deliver flexible but consistent network drive connections.

      Addition of Machines to the Domain

      - - - - + + + + Samba versions prior to 3.0.11 necessitated the use of a domain administrator account that maps to the UNIX UID=0. The UNIX operating system permits only the root user to add user and group accounts. Samba 3.0.11 introduced a new facility known as @@ -425,13 +425,13 @@ In this network example use is made of one of the supported privileges purely to demonstrate how any user can now be given the ability to add machines to the domain using a normal user account that has been given the appropriate privileges. -

      Roaming Profile Background

      +

      Roaming Profile Background

      As XP roaming profiles grow, so does the amount of time it takes to log in and out.

      - - - - + + + + An XP roaming profile consists of the HKEY_CURRENT_USER hive file NTUSER.DAT and a number of folders (My Documents, Application Data, Desktop, Start Menu, Templates, NetHood, Favorites, and so on). When a user logs onto the @@ -453,20 +453,20 @@ user to not place large files on the desktop and to use his or her mapped home directory instead of the My Documents folder for saving documents.

      - + Using a folder other than My Documents is a nuisance for some users, since many applications use it by default.

      - - - + + + The secret to rapid loading of roaming profiles is to prevent unnecessary data from being copied back and forth, without losing any functionality. This is not difficult; it can be done by making changes to the Local Group Policy on each client as well as changing some paths in each user's NTUSER.DAT hive.

      - - + + Every user profile has its own NTUSER.DAT file. This means you need to edit every user's profile, unless a better method can be followed. Fortunately, with the right preparations, this is not difficult. @@ -475,10 +475,10 @@ necessary to copy all files from redirected folders to the network share to which they are redirected.

      The Local Group Policy

      - - - - + + + + Without an Active Directory PDC, you cannot take full advantage of Group Policy Objects. However, you can still make changes to the Local Group Policy by using the Group Policy editor (gpedit.msc). @@ -492,26 +492,26 @@ Simply add the folders you do not wish to be copied back and forth to this semicolon-separated list. Note that this change must be made on all clients that are using roaming profiles. -

      Profile Changes

      - - +

      Profile Changes

      + + There are two changes that should be done to each user's profile. Move each of the directories that you have excluded from being copied back and forth out of the usual profile path. Modify each user's NTUSER.DAT file to point to the new paths that are shared over the network instead of to the default path (C:\Documents and Settings\%USERNAME%).

      - - + + The above modifies existing user profiles. So that newly created profiles have these settings, you need to modify the NTUSER.DAT in the C:\Documents and Settings\Default User folder on each client machine, changing the same registry keys. You could do this by copying NTUSER.DAT to a Linux box and using regedt32. The basic method is described under ???. -

      Using a Network Default User Profile

      - - +

      Using a Network Default User Profile

      + + If you are using Samba as your PDC, you should create a file share called NETLOGON and within that create a directory called Default User, which is a copy of the desired default user @@ -520,10 +520,10 @@ the first login from a new account pulls its configuration from it. See also the Real Men Don't Click Web site. -

      Installation of Printer Driver Auto-Download

      - - - +

      Installation of Printer Driver Auto-Download

      + + + The subject of printing is quite topical. Printing problems run second place to name resolution issues today. So far in this book, you have experienced only what is generally known as “dumb” printing. Dumb printing is the arrangement by which all drivers @@ -532,8 +532,8 @@ many problems, but it has its limitations also. Dumb printing is better known as Raw-Print-Through printing.

      - - + + Samba permits the configuration of smart printing using the Microsoft Windows point-and-click (also called drag-and-drop) printing. What this provides is essentially the ability to print to any printer. If the local client does not yet have a @@ -547,9 +547,9 @@ then invokes a suitable print filter to convert the incoming data stream into a format suited to the printer to which the job is dispatched.

      - - - + + + The CUPS printing subsystem is capable of intelligent printing. It has the capacity to detect the data format and apply a print filter. This means that it is feasible to install on all Windows clients a single printer driver for use with all printers that are routed @@ -574,10 +574,10 @@ simple problems efficiently and effectively.

      Here are some diagnostic guidelines that can be referred to when things go wrong: -

      Preliminary Advice: Dangers Can Be Avoided

      +

      Preliminary Advice: Dangers Can Be Avoided

      The best advice regarding how to mend a broken leg is “Never break a leg!”

      - + Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice regarding the best way to remedy LDAP and Samba problems: “Avoid them like the plague!”

      @@ -593,7 +593,7 @@ Do not be lulled into thinking that you can easily adopt the examples in this book and adapt them without first working through the examples provided. A little thing overlooked can cause untold pain and may permanently tarnish your experience. -

      The Name Service Caching Daemon

      +

      The Name Service Caching Daemon

      The name service caching daemon (nscd) is a primary cause of difficulties with name resolution, particularly where winbind is used. Winbind does its own caching, thus nscd causes double caching which can lead to peculiar problems during @@ -660,17 +660,17 @@ root# chkconfig nscd off root# rcnscd off

      -

      Debugging LDAP

      +

      Debugging LDAP

      + + - - In the example /etc/openldap/slapd.conf control file (see ???) there is an entry for loglevel 256. To enable logging via the syslog infrastructure, it is necessary to uncomment this parameter and restart slapd.

      - - + + LDAP log information can be directed into a file that is separate from the normal system log files by changing the /etc/syslog.conf file so it has the following contents: @@ -689,7 +689,7 @@ local site needs. The configuration used later in this chapter reflects such customization with the intent that LDAP log files will be stored at a location that meets local site needs and wishes more fully. -

      Debugging NSS_LDAP

      +

      Debugging NSS_LDAP

      The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the /etc/ldap.conf file the following parameters: 

      @@ -702,7 +702,7 @@

      The diagnostic process should follow these steps: -

      Procedure 5.1. NSS_LDAP Diagnostic Steps

      1. +

        Procedure 5.1. NSS_LDAP Diagnostic Steps

        1. Verify the nss_base_passwd, nss_base_shadow, nss_base_group entries in the /etc/ldap.conf file and compare them closely with the directory tree location that was chosen when the directory was first created. @@ -792,7 +792,7 @@ Check that the bindpw entry in the /etc/ldap.conf or in the /etc/ldap.secrets file is correct, as specified in the /etc/openldap/slapd.conf file. -

      Debugging Samba

      +

    Debugging Samba

    The following parameters in the smb.conf file can be useful in tracking down Samba-related problems: 

     [global]
@@ -822,17 +822,17 @@
 		
    
 		Search for hints of what may have failed by looking for the words fail
 		and error.
-
    Debugging on the Windows Client

    +

    Debugging on the Windows Client

    MS Windows 2000 Professional and Windows XP Professional clients can be configured to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search the Microsoft knowledge base for detailed instructions. The techniques vary a little with each version of MS Windows. -

    Political Issues

    +

    Political Issues

    MS Windows network users are generally very sensitive to limits that may be imposed when confronted with locked-down workstation configurations. The challenge you face must be promoted as a choice between reliable, fast network operation and a constant flux of problems that result in user irritation. -

    Installation Checklist

    +

    Installation Checklist

    You are starting a complex project. Even though you went through the installation of a complex network in ???, this network is a bigger challenge because of the large number of complex applications that must be configured before the first few steps @@ -840,14 +840,14 @@ frequently review the steps ahead while making at least a mental note of what has already been completed. The following task list may help you to keep track of the task items that are covered: -

    • Samba-3 PDC Server Configuration

      1. DHCP and DNS servers

      2. OpenLDAP server

      3. PAM and NSS client tools

      4. Samba-3 PDC

      5. Idealx smbldap scripts

      6. LDAP initialization

      7. Create user and group accounts

      8. Printers

      9. Share point directory roots

      10. Profile directories

      11. Logon scripts

      12. Configuration of user rights and privileges

    • Samba-3 BDC Server Configuration

      1. DHCP and DNS servers

      2. PAM and NSS client tools

      3. Printers

      4. Share point directory roots

      5. Profiles directories

    • Windows XP Client Configuration

      1. Default profile folder redirection

      2. MS Outlook PST file relocation

      3. Delete roaming profile on logout

      4. Upload printer drivers to Samba servers

      5. Install software

      6. Creation of roll-out images

    Samba Server Implementation

    - - +

    • Samba-3 PDC Server Configuration

      1. DHCP and DNS servers

      2. OpenLDAP server

      3. PAM and NSS client tools

      4. Samba-3 PDC

      5. Idealx smbldap scripts

      6. LDAP initialization

      7. Create user and group accounts

      8. Printers

      9. Share point directory roots

      10. Profile directories

      11. Logon scripts

      12. Configuration of user rights and privileges

    • Samba-3 BDC Server Configuration

      1. DHCP and DNS servers

      2. PAM and NSS client tools

      3. Printers

      4. Share point directory roots

      5. Profiles directories

    • Windows XP Client Configuration

      1. Default profile folder redirection

      2. MS Outlook PST file relocation

      3. Delete roaming profile on logout

      4. Upload printer drivers to Samba servers

      5. Install software

      6. Creation of roll-out images

    Samba Server Implementation

    + + The network design shown in ??? is not comprehensive. It is assumed that you will install additional file servers and possibly additional BDCs.

    Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend

    Network Topology 500 User Network Using ldapsam passdb backend

    - - + + All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to adjust the locations for your particular Linux system distribution/implementation. @@ -868,22 +868,22 @@ with newly installed Linux servers, you must complete the steps shown in ??? before commencing at ???.

    OpenLDAP Server Configuration

    + + - - Confirm that the packages shown in ??? are installed on your system.

    Table 5.2. Required OpenLDAP Linux Packages

    SUSE Linux 8.xSUSE Linux 9.xRed Hat Linux
    nss_ldapnss_ldapnss_ldap
    pam_ldappam_ldappam_ldap
    openldap2openldap2openldap
    openldap2-clientopenldap2-client 

    Samba-3 and OpenLDAP will have a degree of interdependence that is unavoidable. The method for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you follow these guidelines, the resulting system should work fine. -

    Procedure 5.2. OpenLDAP Server Configuration Steps

    1. - +

      Procedure 5.2. OpenLDAP Server Configuration Steps

      1. + Install the file shown in ??? in the directory /etc/openldap.

      2. + + - - Remove all files from the directory /data/ldap, making certain that the directory exists with permissions: 

        @@ -892,14 +892,14 @@

        This may require you to add a user and a group account for LDAP if they do not exist.

      3. - + Install the file shown in ??? in the directory /data/ldap. In the event that this file is added after ldap has been started, it is possible to cause the new settings to take effect by shutting down the LDAP server, executing the db_recover command inside the /data/ldap directory, and then restarting the LDAP server.

      4. - + Performance logging can be enabled and should preferably be sent to a file on a file system that is large enough to handle significantly sized logs. To enable the logging at a verbose level to permit detailed analysis, uncomment the entry in @@ -975,31 +975,31 @@ index sambaDomainName eq index default sub

    PAM and NSS Client Configuration

    - - - + + + The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication.

    - - + + Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely that you may want to use them for UNIX system (Linux) local machine logons. This necessitates correct configuration of PAM. The pam_ldap open source package provides the PAM modules that most people would use. On SUSE Linux systems, the pam_unix2.so module also has the ability to redirect authentication requests through LDAP.

    + + - - You have chosen to configure these services by directly editing the system files, but of course, you know that this configuration can be done using system tools provided by the Linux system vendor. SUSE Linux has a facility in YaST (the system admin tool) through yast->system->ldap-client that permits configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the authconfig tool for this. -

    Procedure 5.3. PAM and NSS Client Configuration Steps

    Example 5.4. Configuration File for NSS LDAP Support /etc/ldap.conf

    +	
    Procedure 5.3. PAM and NSS Client Configuration Steps
    Example 5.4. Configuration File for NSS LDAP Support  /etc/ldap.conf
     host 127.0.0.1
 
 base dc=abmas,dc=biz
@@ -1042,9 +1042,9 @@
 
 ssl off
 
    1. 
+		
+		
 		
-		
-		
 		Execute the following command to find where the nss_ldap module
 		expects to find its control file:
 
      @@ -1057,7 +1057,7 @@
 		On the servers called BLDG1 and BLDG2, install the file shown in
 		??? into the path that was obtained from the step above.
 		
    2. 
-		
+		
 		Edit the NSS control file (/etc/nsswitch.conf) so that the lines that
 		control user and group resolution will obtain information from the normal system files as
 		well as from ldap:
@@ -1080,7 +1080,7 @@
 		Even at the risk of overstating the issue, incorrect and inappropriate configuration of the
 		nsswitch.conf file is a significant cause of operational problems with LDAP.
 		
    3. 
-		
+		
 		For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following
 		files in the /etc/pam.d directory: login, password,
 		samba, sshd.  In each file, locate every entry that has the
@@ -1102,7 +1102,7 @@
 session   required   pam_limits.so

    - + On other Linux systems that do not have an LDAP-enabled pam_unix2.so module, you must edit these files by adding the pam_ldap.so modules as shown here: 

    @@ -1126,14 +1126,14 @@
 		implementation, but if the pam_unix2.so on your system supports
 		LDAP, you probably want to use it rather than add an additional module.

    Samba-3 PDC Configuration

    - + Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the choice to either build your own or obtain the packages from a dependable source. Packages for SUSE Linux 8.x, 9.x, and SUSE Linux Enterprise Server 9, as well as for Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that is included with this book. -

    Procedure 5.4. Configuration of PDC Called MASSIVE

    1. +

      Procedure 5.4. Configuration of PDC Called MASSIVE

      1. Install the files in ???, ???, ???, and ??? into the /etc/samba/ @@ -1143,7 +1143,7 @@ on the master file. The operational smb.conf is then generated as shown in the next step.

      2. - + Create and verify the contents of the smb.conf file that is generated by: 

         root#  testparm -s smb.conf.master > smb.conf
@@ -1180,8 +1180,8 @@
 root#  rm /var/log/samba/*

      3. - - + + Samba-3 communicates with the LDAP server. The password that it uses to authenticate to the LDAP server must be stored in the secrets.tdb file. Execute the following to create the new secrets.tdb files @@ -1194,8 +1194,8 @@ Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb

      4. - - + + Samba-3 generates a Windows Security Identifier (SID) only when smbd has been started. For this reason, you start Samba. After a few seconds delay, execute: @@ -1229,10 +1229,10 @@

      5. When a positive domain SID has been reported, stop Samba.

      6. + + - - - + Configure the NFS server for your Linux system. So you can complete the steps that follow, enter into the /etc/exports the following entry: 

        @@ -1250,8 +1250,8 @@

      Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with configuration of the LDAP server. -

      Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A

      # Global parameters
      [global]
      unix charset = LOCALE
      workgroup = MEGANET2
      netbios name = MASSIVE
      interfaces = eth1, lo
      bind interfaces only = Yes
      passdb backend = ldapsam:ldap://massive.abmas.biz
      enable privileges = Yes
      username map = /etc/samba/smbusers
      log level = 1
      syslog = 0
      log file = /var/log/samba/%m
      max log size = 50
      smb ports = 139
      name resolve order = wins bcast hosts
      time server = Yes
      printcap name = CUPS
      show add printer wizard = No
      add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"
      delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"
      add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"
      delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"
      add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"
      delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"
      set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"
      add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"

      Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B

      logon script = scripts\logon.bat
      logon path = \\%L\profiles\%U
      logon drive = X:
      domain logons = Yes
      preferred master = Yes
      wins support = Yes
      ldap suffix = dc=abmas,dc=biz
      ldap machine suffix = ou=People
      ldap user suffix = ou=People
      ldap group suffix = ou=Groups
      ldap idmap suffix = ou=Idmap
      ldap admin dn = cn=Manager,dc=abmas,dc=biz
      idmap backend = ldap:ldap://massive.abmas.biz
      idmap uid = 10000-20000
      idmap gid = 10000-20000
      map acl inherit = Yes
      printing = cups
      printer admin = root, chrisr

    Install and Configure Idealx smbldap-tools Scripts

    - +

    Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A

    # Global parameters
    [global]
    unix charset = LOCALE
    workgroup = MEGANET2
    netbios name = MASSIVE
    interfaces = eth1, lo
    bind interfaces only = Yes
    passdb backend = ldapsam:ldap://massive.abmas.biz
    enable privileges = Yes
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    time server = Yes
    printcap name = CUPS
    show add printer wizard = No
    add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"
    delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"
    add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"
    delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"
    add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"
    delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"
    set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"
    add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"

    Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B

    logon script = scripts\logon.bat
    logon path = \\%L\profiles\%U
    logon drive = X:
    domain logons = Yes
    preferred master = Yes
    wins support = Yes
    ldap suffix = dc=abmas,dc=biz
    ldap machine suffix = ou=People
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap admin dn = cn=Manager,dc=abmas,dc=biz
    idmap backend = ldap:ldap://massive.abmas.biz
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    map acl inherit = Yes
    printing = cups
    printer admin = root, chrisr

    Install and Configure Idealx smbldap-tools Scripts

    + The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts on the LDAP server. You have chosen the Idealx scripts because they are the best-known LDAP configuration scripts. The use of these scripts will help avoid the necessity @@ -1268,7 +1268,7 @@ The smbldap-tools are located in /opt/IDEALX/sbin. The scripts are not needed on BDC machines because all LDAP updates are handled by the PDC alone. -

    Installation of smbldap-tools from the Tarball

    +

    Installation of smbldap-tools from the Tarball

    To perform a manual installation of the smbldap-tools scripts, the following procedure may be used:

    Procedure 5.5. Unpacking and Installation Steps for the smbldap-tools Tarball

    1. Create the /opt/IDEALX/sbin directory, and set its permissions @@ -1320,10 +1320,10 @@

      The smbldap-tools scripts are now ready for the configuration step outlined in ???. -

    Installing smbldap-tools from the RPM Package

    +

    Installing smbldap-tools from the RPM Package

    In the event that you have elected to use the RPM package provided by Idealx, download the source RPM smbldap-tools-0.9.1-1.src.rpm, then follow this procedure: -

    Procedure 5.6. Installation Steps for smbldap-tools RPM's

    1. +

      Procedure 5.6. Installation Steps for smbldap-tools RPM's

      1. Install the source RPM that has been downloaded as follows: 

         root#  rpm -i smbldap-tools-0.9.1-1.src.rpm
@@ -1368,7 +1368,7 @@
 	
        
 	The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included
 	in the smb.conf file.
-	
        Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use
        1. 
+	
          Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use
          1. 
 		Change into the directory that contains the configure.pl script.
 
             root#  cd /opt/IDEALX/sbin
@@ -1474,7 +1474,7 @@
 		then verify its contents.
 		
          
 	The smbldap-tools are now ready for use.
-

      LDAP Initialization and Creation of User and Group Accounts

      +

    LDAP Initialization and Creation of User and Group Accounts

    The LDAP database must be populated with well-known Windows domain user accounts and domain group accounts before Samba can be used. The following procedures step you through the process.

    @@ -1487,12 +1487,12 @@

    Addition of an account to the LDAP backend can be done in two ways:

    • + + - - - - + + If you always have a user account in the /etc/passwd on every server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in LDAP. In this case, you can add Windows domain user accounts using the @@ -1510,20 +1510,20 @@ Idealx smbldap-tools scripts. A copy of these tools, preconfigured for this system, is included on the enclosed CD-ROM under Chap06/Tools.

    - + If you wish to have more control over how the LDAP database is initialized or if you don't want to use the Idealx smbldap-tools, you should refer to ???, ???.

    - + The following steps initialize the LDAP database, and then you can add user and group accounts that Samba can use. You use the smbldap-populate to seed the LDAP database. You then manually add the accounts shown in ???. The list of users does not cover all 500 network users; it provides examples only.

    Note

    - - - + + + In the following examples, as the LDAP database is initialized, we do create a container for Computer (machine) accounts. In the Samba-3 smb.conf files, specific use is made of the People container, not the Computers container, for domain member accounts. This is not a @@ -1600,7 +1600,7 @@ Starting ldap-server done

  • - + So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -1609,7 +1609,7 @@ dn: ou=Idmap,dc=abmas,dc=biz ou: idmap

    - + If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see ???). You can add the required entries using the following command: @@ -1619,7 +1619,7 @@

    Samba automatically populates this LDAP directory container when it needs to.

  • - + It looks like all has gone well, as expected. Let's confirm that this is the case by running a few tests. First we check the contents of the database directly by running slapcat as follows (the output has been cut down): @@ -1657,7 +1657,7 @@

    This looks good so far.

  • - + The next step is to prove that the LDAP server is running and responds to a search request. Execute the following as shown (output has been cut to save space): 

    @@ -1702,7 +1702,7 @@

    Good. It is all working just fine.

  • - + You must now make certain that the NSS resolver can interrogate LDAP also. Execute the following commands: 

    @@ -1715,16 +1715,16 @@
 Domain Guests:x:514:
 Domain Computers:x:553:

    - + This demonstrates that the nss_ldap library is functioning as it should. If these two steps fail to produce this information, refer to ??? for diagnostic procedures that can be followed to isolate the cause of the problem. Proceed to the next step only when the previous steps have been successfully completed.

  • + + - - Our database is now ready for the addition of network users. For each user for whom an account must be created, execute the following: 

    @@ -1740,7 +1740,7 @@

    where username is the login ID for each user.

  • - + Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the following: 

    @@ -1768,7 +1768,7 @@
 		This confirms that the UNIX (POSIX) user account information can be resolved from LDAP
 		by system tools that make a getentpw() system call.

  • - + The root account must have UID=0; if not, this means that operations conducted from a Windows client using tools such as the Domain User Manager fails under UNIX because the management of user and group accounts requires that the UID=0. Additionally, it is @@ -1802,8 +1802,8 @@

    This is precisely what we want to see.

  • - - + + The final validation step involves making certain that Samba-3 can obtain the user accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: 

    @@ -1834,7 +1834,7 @@

    This looks good. Of course, you fully expected that it would all work, didn't you?

  • - + Now you add the group accounts that are used on the Abmas network. Execute the following exactly as shown: 

    @@ -1845,7 +1845,7 @@
 		The addition of groups does not involve keyboard interaction, so the lack of console
 		output is of no concern.

  • - + You really do want to confirm that UNIX group resolution from LDAP is functioning as it should. Let's do this as shown here: 

    @@ -1862,7 +1862,7 @@
 		The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well
 		as our own site-specific group accounts, are correctly listed. This is looking good.

  • - + The final step we need to validate is that Samba can see all the Windows domain groups and that they are correctly mapped to the respective UNIX group account. To do this, just execute the following command: @@ -1917,7 +1917,7 @@ root# rcwinbind restart

  • - + You may now check Samba-3 operation as follows: 

     root#  smbclient -L massive -U%
@@ -1963,12 +1963,12 @@

    • The server MASSIVE is now configured, and it is time to move onto the next task.

    Printer Configuration

    - + The configuration for Samba-3 to enable CUPS raw-print-through printing has already been taken care of in the smb.conf file. The only preparation needed for smart printing to be possible involves creation of the directories in which Samba-3 stores Windows printing driver files. -

    Procedure 5.9. Printer Configuration Steps

    1. +

      Procedure 5.9. Printer Configuration Steps

      1. Configure all network-attached printers to have a fixed IP address.

      2. Create an entry in the DNS database on the server MASSIVE @@ -1980,18 +1980,18 @@ Follow the instructions in the printer manufacturers' manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - - + +

      3. - - + + Only on the server to which the printer is attached, configure the CUPS Print Queues as follows: 

         root#  lpadmin -p printque
 	 -v socket://printer-name.abmas.biz:9100 -E

        - + This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, that is, printing without use of filters. The name printque is the name you have assigned for @@ -2011,15 +2011,15 @@ root# /usr/bin/accept printque

      4. - - - + + + Edit the file /etc/cups/mime.convs to uncomment the line: 

         application/octet-stream     application/vnd.cups-raw      0     -

      5. - + Edit the file /etc/cups/mime.types to uncomment the line: 

         application/octet-stream
@@ -2038,7 +2038,7 @@
 root#  chown -R root:root /var/lib/samba/drivers
 root#  chmod -R ug=rwx,o=rx /var/lib/samba/drivers

        -

    Samba-3 BDC Configuration

    Procedure 5.10. Configuration of BDC Called: BLDG1

    1. +

    Samba-3 BDC Configuration

    Procedure 5.10. Configuration of BDC Called: BLDG1

    1. Install the files in ???, ???, and ??? into the /etc/samba/ directory. The three files @@ -2081,7 +2081,7 @@

      This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem.

    2. - + The next step in the verification process involves testing the operation of UNIX group resolution via the NSS LDAP resolver. Execute these commands: 

      @@ -2111,7 +2111,7 @@
 		This is also the correct and desired output, because it demonstrates that the LDAP client
 		is able to communicate correctly with the LDAP server (MASSIVE).

    3. - + You must now set the LDAP administrative password into the Samba-3 secrets.tdb file by executing this command: 

      @@ -2143,7 +2143,7 @@

      This indicates that the domain security account for the BDC has been correctly created.

    4. - + Verify that user and group account resolution works via Samba-3 tools as follows: 

       root#  pdbedit -L
@@ -2231,19 +2231,19 @@
 		should be added together to form the smb.conf file.

    5. Follow carefully the steps shown in ???, starting at step 2. -

    Example 5.8. LDAP Based smb.conf File, Server: BLDG1

    # Global parameters
    [global]
    unix charset = LOCALE
    workgroup = MEGANET2
    netbios name = BLDG1
    passdb backend = ldapsam:ldap://massive.abmas.biz
    enable privileges = Yes
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    printcap name = CUPS
    show add printer wizard = No
    logon script = scripts\logon.bat
    logon path = \\%L\profiles\%U
    logon drive = X:
    domain logons = Yes
    domain master = No
    wins server = 172.16.0.1
    ldap suffix = dc=abmas,dc=biz
    ldap machine suffix = ou=People
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap admin dn = cn=Manager,dc=abmas,dc=biz
    idmap backend = ldap:ldap://massive.abmas.biz
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    printing = cups
    printer admin = root, chrisr

    Example 5.9. LDAP Based smb.conf File, Server: BLDG2

    # Global parameters
    [global]
    unix charset = LOCALE
    workgroup = MEGANET2
    netbios name = BLDG2
    passdb backend = ldapsam:ldap://massive.abmas.biz
    enable privileges = Yes
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    printcap name = CUPS
    show add printer wizard = No
    logon script = scripts\logon.bat
    logon path = \\%L\profiles\%U
    logon drive = X:
    domain logons = Yes
    domain master = No
    wins server = 172.16.0.1
    ldap suffix = dc=abmas,dc=biz
    ldap machine suffix = ou=People
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap admin dn = cn=Manager,dc=abmas,dc=biz
    idmap backend = ldap:ldap://massive.abmas.biz
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    printing = cups
    printer admin = root, chrisr

    Example 5.10. LDAP Based smb.conf File, Shares Section Part A

    [accounts]
    comment = Accounting Files
    path = /data/accounts
    read only = No
    [service]
    comment = Financial Services Files
    path = /data/service
    read only = No
    [pidata]
    comment = Property Insurance Files
    path = /data/pidata
    read only = No
    [homes]
    comment = Home Directories
    valid users = %S
    read only = No
    browseable = No
    [printers]
    comment = SMB Print Spool
    path = /var/spool/samba
    guest ok = Yes
    printable = Yes
    browseable = No

    Example 5.11. LDAP Based smb.conf File, Shares Section Part B

    [apps]
    comment = Application Files
    path = /apps
    admin users = bjordan
    read only = No
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    locking = No
    [profiles]
    comment = Profile Share
    path = /var/lib/samba/profiles
    read only = No
    profile acls = Yes
    [profdata]
    comment = Profile Data Share
    path = /var/lib/samba/profdata
    read only = No
    profile acls = Yes
    [print$]
    comment = Printer Drivers
    path = /var/lib/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root, chrisr

    Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF

    +

    Example 5.8. LDAP Based smb.conf File, Server: BLDG1

    # Global parameters
    [global]
    unix charset = LOCALE
    workgroup = MEGANET2
    netbios name = BLDG1
    passdb backend = ldapsam:ldap://massive.abmas.biz
    enable privileges = Yes
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    printcap name = CUPS
    show add printer wizard = No
    logon script = scripts\logon.bat
    logon path = \\%L\profiles\%U
    logon drive = X:
    domain logons = Yes
    domain master = No
    wins server = 172.16.0.1
    ldap suffix = dc=abmas,dc=biz
    ldap machine suffix = ou=People
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap admin dn = cn=Manager,dc=abmas,dc=biz
    idmap backend = ldap:ldap://massive.abmas.biz
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    printing = cups
    printer admin = root, chrisr

    Example 5.9. LDAP Based smb.conf File, Server: BLDG2

    # Global parameters
    [global]
    unix charset = LOCALE
    workgroup = MEGANET2
    netbios name = BLDG2
    passdb backend = ldapsam:ldap://massive.abmas.biz
    enable privileges = Yes
    username map = /etc/samba/smbusers
    log level = 1
    syslog = 0
    log file = /var/log/samba/%m
    max log size = 50
    smb ports = 139
    name resolve order = wins bcast hosts
    printcap name = CUPS
    show add printer wizard = No
    logon script = scripts\logon.bat
    logon path = \\%L\profiles\%U
    logon drive = X:
    domain logons = Yes
    domain master = No
    wins server = 172.16.0.1
    ldap suffix = dc=abmas,dc=biz
    ldap machine suffix = ou=People
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap admin dn = cn=Manager,dc=abmas,dc=biz
    idmap backend = ldap:ldap://massive.abmas.biz
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    printing = cups
    printer admin = root, chrisr

    Example 5.10. LDAP Based smb.conf File, Shares Section Part A

    [accounts]
    comment = Accounting Files
    path = /data/accounts
    read only = No
    [service]
    comment = Financial Services Files
    path = /data/service
    read only = No
    [pidata]
    comment = Property Insurance Files
    path = /data/pidata
    read only = No
    [homes]
    comment = Home Directories
    valid users = %S
    read only = No
    browseable = No
    [printers]
    comment = SMB Print Spool
    path = /var/spool/samba
    guest ok = Yes
    printable = Yes
    browseable = No

    Example 5.11. LDAP Based smb.conf File, Shares Section Part B

    [apps]
    comment = Application Files
    path = /apps
    admin users = bjordan
    read only = No
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    locking = No
    [profiles]
    comment = Profile Share
    path = /var/lib/samba/profiles
    read only = No
    profile acls = Yes
    [profdata]
    comment = Profile Data Share
    path = /var/lib/samba/profdata
    read only = No
    profile acls = Yes
    [print$]
    comment = Printer Drivers
    path = /var/lib/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root, chrisr

    Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF

     dn: ou=Idmap,dc=abmas,dc=biz
 objectClass: organizationalUnit
 ou: idmap
 structuralObjectClass: organizationalUnit
-

    Miscellaneous Server Preparation Tasks

    +

    Miscellaneous Server Preparation Tasks

    My father would say, “Dinner is not over until the dishes have been done.” The makings of a great network environment take a lot of effort and attention to detail. So far, you have completed most of the complex (and to many administrators, the interesting part of server configuration) steps, but remember to tie it all together. Here are a few more steps that must be completed so that your network runs like a well-rehearsed orchestra. -

    Configuring Directory Share Point Roots

    +

    Configuring Directory Share Point Roots

    In your smb.conf file, you have specified Windows shares. Each has a path parameter. Even though it is obvious to all, one of the common Samba networking problems is caused by forgetting to verify that every such share root directory actually exists and that it @@ -2261,7 +2261,7 @@ root# chmod -R ug+rwxs,o-rwx /data root# chmod -R ug+rwx,o+rx-w /apps

    -

    Configuring Profile Directories

    +

    Configuring Profile Directories

    You made a conscious decision to do everything it would take to improve network client performance. One of your decisions was to implement folder redirection. This means that Windows user desktop profiles are now made up of two components: a dynamically loaded part and a set of file @@ -2286,8 +2286,8 @@ root# chmod -R 750 username

    - - + + You have three options insofar as the dynamically loaded portion of the roaming profile is concerned:

    • You may permit the user to obtain a default profile.

    • You can create a mandatory profile.

    • You can create a group profile (which is almost always a mandatory profile).

    @@ -2295,8 +2295,8 @@ profile is effected by renaming the NTUSER.DAT to NTUSER.MAN, that is, just by changing the filename extension.

    - - + + The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. You can manage this using the Idealx smbldap-tools or using the Windows NT4 Domain User Manager. @@ -2309,8 +2309,8 @@ /var/lib/samba/profiles/username root# chmod 700 /var/lib/samba/profiles/username

    -

    Preparation of Logon Scripts

    - +

    Preparation of Logon Scripts

    + The use of a logon script with Windows XP Professional is an option that every site should consider. Unless you have locked down the desktop so the user cannot change anything, there is risk that a vital network drive setting may be broken or that printer connections may be lost. Logon scripts @@ -2335,7 +2335,7 @@ You should research the options for logon script implementation by referring to TOSHARG2, Chapter 24, Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon facilities in use today is called KiXtart. -

    Assigning User Rights and Privileges

    +

    Assigning User Rights and Privileges

    The ability to perform tasks such as joining Windows clients to the domain can be assigned to normal user accounts. By default, only the domain administrator account (root on UNIX systems because it has UID=0) can add accounts. New to Samba 3.0.11 is the ability to grant @@ -2347,7 +2347,7 @@ Samba limits privileges on a per-server basis. This is a deliberate limitation so that users who are granted rights can be restricted to particular machines. It is left to the network administrator to determine which rights should be provided and to whom. -

    Procedure 5.12. Steps for Assignment of User Rights and Privileges

    1. +

      Procedure 5.12. Steps for Assignment of User Rights and Privileges

      1. Log onto the PDC as the root account.

      2. Execute the following command to grant the Domain Admins group all @@ -2405,8 +2405,8 @@ SeRemoteShutdownPrivilege SeDiskOperatorPrivilege

        -

    Windows Client Configuration

    - +

    Windows Client Configuration

    + In the next few sections, you can configure a new Windows XP Professional disk image on a staging machine. You will configure all software, printer settings, profile and policy handling, and desktop default profile settings on this system. When it is complete, you copy the contents of the @@ -2419,24 +2419,24 @@ Base Profile for All Users."

    Configuration of Default Profile with Folder Redirection

    - + Log onto the Windows XP Professional workstation as the local Administrator. It is necessary to expose folders that are generally hidden to provide access to the Default User folder. -

    Procedure 5.13. Expose Hidden Folders

    1. +

      Procedure 5.13. Expose Hidden Folders

      1. Launch the Windows Explorer by clicking Start->My Computer->Tools->Folder Options->View Tab. Select Show hidden files and folders, and click OK. Exit Windows Explorer.

      2. - + Launch the Registry Editor. Click Start->Run. Key in regedt32, and click OK.

      Procedure 5.14. Redirect Folders in Default System User Profile

      1. - - + + Give focus to HKEY_LOCAL_MACHINE hive entry in the left panel. Click File->Load Hive...->Documents and Settings->Default User->NTUSER->Open. In the dialog box that opens, enter the key name Default and click OK. @@ -2448,15 +2448,15 @@

        The right panel reveals the contents as shown in ???.

      2. - - + + You edit hive keys. Acceptable values to replace the %USERPROFILE% variable includes:

        • A drive letter such as U:

        • A direct network path such as \\MASSIVE\profdata

        • A network redirection (UNC name) that contains a macro such as

          %LOGONSERVER%\profdata\

      3. - + Set the registry keys as shown in ???. Your implementation makes the assumption that users have statically located machines. Notebook computers (mobile users) need to be accommodated using local profiles. This is not an uncommon assumption. @@ -2464,14 +2464,14 @@ Click back to the root of the loaded hive Default. Click File->Unload Hive...->Yes.

      4. - + Click File->Exit. This exits the Registry Editor.

      5. Now follow the procedure given in ???. Make sure that each folder you have redirected is in the exclusion list.

      6. - You are now ready to copy[11] + You are now ready to copy[11] the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, and use it to copy the full contents of the directory Default User that is in the C:\Documents and Settings to the root directory of the @@ -2482,14 +2482,14 @@ Before punching out new desktop images for the client workstations, it is perhaps a good idea that desktop behavior should be returned to the original Microsoft settings. The following steps achieve that ojective: -

        Procedure 5.15. Reset Folder Display to Original Behavior

        • +

          Procedure 5.15. Reset Folder Display to Original Behavior

          • To launch the Windows Explorer, click Start->My Computer->Tools->Folder Options->View Tab. Deselect Show hidden files and folders, and click OK. Exit Windows Explorer. -

          Figure 5.3. Windows XP Professional User Shared Folders

          Windows XP Professional User Shared Folders

          Table 5.4. Default Profile Redirections

          Registry KeyRedirected Value
          Cache%LOGONSERVER%\profdata\%USERNAME%\InternetFiles
          Cookies%LOGONSERVER%\profdata\%USERNAME%\Cookies
          History%LOGONSERVER%\profdata\%USERNAME%\History
          Local AppData%LOGONSERVER%\profdata\%USERNAME%\AppData
          Local Settings%LOGONSERVER%\profdata\%USERNAME%\LocalSettings
          My Pictures%LOGONSERVER%\profdata\%USERNAME%\MyPictures
          Personal%LOGONSERVER%\profdata\%USERNAME%\MyDocuments
          Recent%LOGONSERVER%\profdata\%USERNAME%\Recent

        Configuration of MS Outlook to Relocate PST File

        +

      Figure 5.3. Windows XP Professional User Shared Folders

      Windows XP Professional User Shared Folders

      Table 5.4. Default Profile Redirections

      Registry KeyRedirected Value
      Cache%LOGONSERVER%\profdata\%USERNAME%\InternetFiles
      Cookies%LOGONSERVER%\profdata\%USERNAME%\Cookies
      History%LOGONSERVER%\profdata\%USERNAME%\History
      Local AppData%LOGONSERVER%\profdata\%USERNAME%\AppData
      Local Settings%LOGONSERVER%\profdata\%USERNAME%\LocalSettings
      My Pictures%LOGONSERVER%\profdata\%USERNAME%\MyPictures
      Personal%LOGONSERVER%\profdata\%USERNAME%\MyDocuments
      Recent%LOGONSERVER%\profdata\%USERNAME%\Recent

    Configuration of MS Outlook to Relocate PST File

    + - Microsoft Outlook can store a Personal Storage file, generally known as a PST file. It is the nature of email storage that this file grows, at times quite rapidly. So that users' email is available to them at every workstation they may log onto, @@ -2498,7 +2498,7 @@

    To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave slightly differently), follow these steps: -

    Procedure 5.16. Outlook PST File Relocation

    1. +

      Procedure 5.16. Outlook PST File Relocation

      1. Close Outlook if it is open.

      2. From the Control Panel, launch the Mail icon. @@ -2510,7 +2510,7 @@ may well be the users' home directory.

      3. Add a new data file, selecting the PST file in the new desired target location. - Gice this entry (not the filename) a new name such as “Personal Mail Folders.” + Give this entry (not the filename) a new name such as “Personal Mail Folders.”

        Note: If MS Outlook has been configured to use an IMAP account configuration there may be problems following these instructions. Feedback from users suggests that where IMAP is used the PST @@ -2528,11 +2528,11 @@

      4. Go back to the Data Files window, then delete the old data file entry.

      Note

      - + You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise the user may be not be able to retrieve contacts when addressing a new email message.

      Note

      - + Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook Express storage files can not be redirected to network shares. The options panel will not permit this, but they can be moved to folders outside of the user's profile. They can also be excluded @@ -2541,34 +2541,34 @@ While it is possible to redirect the data stores for Outlook Express data stores by editing the registry, experience has shown that data corruption and loss of email messages will result.

      - - + + In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with roaming profiles this can result in excruciatingly long login and logout behavior will files are synchronized. For this reason, it is highly recommended not to use Outlook Express where roaming profiles are used.

      - + Microsoft does not support storing PST files on network shares, although the practice does appear to be rather popular. Anyone who does relocation the PST file to a network resource should refer the Microsoft reference to better understand the issues.

      - + Apart from manually moving PST files to a network share, it is possible to set the default PST location for new accounts by following the instructions at the WindowsITPro web site.

      - + User feedback suggests that disabling of oplocks on PST files will significantly improve network performance by reducing locking overheads. One way this can be done is to add to the smb.conf file stanza for the share the PST file the following: 

       veto oplock files = /*.pdf/*.PST/

      -

    Configure Delete Cached Profiles on Logout

    +

    Configure Delete Cached Profiles on Logout

    Configure the Windows XP Professional client to auto-delete roaming profiles on logout:

    - + Click Start->Run. In the dialog box, enter MMC and click OK.

    @@ -2576,7 +2576,7 @@ profiles are deleted as network users log out of the system. Click File->Add/Remove Snap-in->Add->Group Policy->Add->Finish->Close->OK.

    - + The Microsoft Management Console now shows the Group Policy utility that enables you to set the policies needed. In the left panel, click Local Computer Policy->Administrative Templates->System->User Profiles. In the right panel, set the properties shown here by double-clicking on each @@ -2584,15 +2584,15 @@

    • Do not check for user ownership of Roaming Profile Folders = Enabled

    • Delete cached copies of roaming profiles = Enabled

    Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies made of this system to deploy the new standard desktop system. -

    Uploading Printer Drivers to Samba Servers

    - +

    Uploading Printer Drivers to Samba Servers

    + Users want to be able to use network printers. You have a vested interest in making it easy for them to print. You have chosen to install the printer drivers onto the Samba servers and to enable point-and-click (drag-and-drop) printing. This process results in Samba being able to automatically provide the Windows client with the driver necessary to print to the printer chosen. The following procedure must be followed for every network printer: -

    Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers

    1. +

      Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers

      1. Join your Windows XP Professional workstation (the staging machine) to the MEGANET2 domain. If you are not sure of the procedure, follow the guidance given in ???, ???. @@ -2617,8 +2617,8 @@ Note that the box labeled Driver is empty. Click the New Driver button that is next to the Driver box. This launches the “Add Printer Wizard”.

      2. + - The “Add Printer Driver Wizard on MASSIVE” panel is now presented. Click Next to continue. From the left panel, select the printer manufacturer. In your case, you are adding a driver for a printer manufactured by @@ -2627,12 +2627,12 @@ progress bar appears and instructs you as each file is being uploaded and that it is being directed at the network server \\massive\ps01-color.

      3. + - - + + - The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, you are returned to the Advanced tab in the Properties panel. You can set the Location (under the General tab) and Security settings (under @@ -2641,7 +2641,7 @@ directory”. When this box is checked, the printer will be published in Active Directory (Applicable to Active Directory use only.)

      4. - + Click OK. It will take a minute or so to upload the settings to the server. You are now returned to the Printers and Faxes on Massive monitor. Right-click on the printer, click Properties->Device Settings. Now change the settings to suit @@ -2653,7 +2653,7 @@ just to initialize the Samba printers database entry for this printer. If you need to revert a setting, click Apply again.

      5. - + Verify that all printer settings are at the desired configuration. When you are satisfied that they are, click the General tab. Now click the Print Test Page button. A test page should print. Verify that it has printed correctly. Then click OK @@ -2663,7 +2663,7 @@ You must repeat this process for all network printers (i.e., for every printer on each server). When you have finished uploading drivers to all printers, close all applications. The next task is to install software your users require to do their work. -

    Software Installation

    +

    Software Installation

    Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. Notebooks require special handling that is beyond the scope of this chapter. @@ -2678,7 +2678,7 @@ When you believe that the overall configuration is complete, be sure to create a shared group profile and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in case a user may have specific needs you had not anticipated. -

    Roll-out Image Creation

    +

    Roll-out Image Creation

    The final steps before preparing the distribution Norton Ghost image file you might follow are:

    Unjoin the domain Each workstation requires a unique name and must be independently @@ -2687,7 +2687,7 @@ Defragment the hard disk While not obvious to the uninitiated, defragmentation results in better performance and often significantly reduces the size of the compressed disk image. That also means it will take less time to deploy the image onto 500 workstations. -

    Key Points Learned

    +

    Key Points Learned

    This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately avoided any consideration of security. Security does not just happen; you must design it into your total network. Security begins with a systems design and implementation that anticipates hostile behavior from @@ -2696,8 +2696,8 @@ practices, you must not deploy the design presented in this book in an environment where there is risk of compromise.

    + - As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be configured to use secure protocols for all communications over the network. Of course, secure networking does not result just from systems design and implementation but involves constant user education @@ -2724,37 +2724,37 @@ Control over roaming profiles, with particular focus on folder redirection to network drives.

  • Use of the CUPS printing system together with Samba-based printer driver auto-download. -

    • Questions and Answers

    +

    Questions and Answers

    Well, here we are at the end of this chapter and we have only ten questions to help you to remember so much. There are bound to be some sticky issues here. -

    +

    Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? -
    +
    You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? -
    +
    You did not use SWAT to configure Samba. Is there something wrong with it? -
    +
    You have exposed a well-used password not24get. Is that not irresponsible? -
    +
    The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing? -
    +
    Can I use LDAP just for Samba accounts and not for UNIX system accounts? -
    +
    Why are the Windows domain RID portions not the same as the UNIX UID? -
    +
    Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work? -
    +
    Is folder redirection dangerous? I've heard that you can lose your data that way. -
    +
    Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile? -

    +

    Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions?

    @@ -2773,7 +2773,7 @@ This book makes little mention of backup techniques. Does that mean that I am recommending that you should implement a network without provision for data recovery and for disaster management? Back to our focus: The deployment of Samba has been clearly demonstrated. -

    +

    You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? @@ -2800,7 +2800,7 @@ of open source software. I favor neither and respect both. I like particular features of both products (companies also). No bias in presentation is intended. Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. -

    +

    You did not use SWAT to configure Samba. Is there something wrong with it?

    That is a good question. As it is, the smb.conf file configurations are presented @@ -2811,14 +2811,14 @@ There are people in the Linux and open source community who feel that SWAT is dangerous and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I hope to have brought their interests on board. SWAT is well covered is TOSHARG2. -

    +

    You have exposed a well-used password not24get. Is that not irresponsible?

    Well, I had to use a password of some sort. At least this one has been consistently used throughout. I guess you can figure out that in a real deployment it would make sense to use a more secure and original password. -

    +

    The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing?

    @@ -2826,7 +2826,7 @@ Let's give Idealx some credit for the contribution they have made. I appreciate their work and, besides, it does no harm to create accounts that are not now used at some time Samba may well use them. -

    +

    Can I use LDAP just for Samba accounts and not for UNIX system accounts?

    Yes, you can do that for user accounts only. Samba requires there to be a POSIX (UNIX) @@ -2834,7 +2834,7 @@ the system password account, how do you plan to keep all domain controller system password files in sync? I think that having everything in LDAP makes a lot of sense for the UNIX administrator who is still learning the craft and is migrating from MS Windows. -

    +

    Why are the Windows domain RID portions not the same as the UNIX UID?

    Samba uses a well-known public algorithm for assigning RIDs from UIDs and GIDs. @@ -2843,7 +2843,7 @@ assignment used the calculation: RID = UID x 2 + 1000. Of course, Samba does permit you to override that to some extent. See the smb.conf man page entry for algorithmic rid base. -

    +

    Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work?

    @@ -2853,7 +2853,7 @@ inkjet printer. Use the appropriate device URI (Universal Resource Interface) argument to the lpadmin -v option that is right for your printer. -

    +

    Is folder redirection dangerous? I've heard that you can lose your data that way.

    The only loss of data I know of that involved folder redirection was caused by @@ -2863,13 +2863,13 @@ he declined to move the data because he thought it was still in the local profile folder. That was not the case, so by declining to move the data back, he wiped out the data. You cannot hold the tool responsible for that. Caveat emptor still applies. -

    +

    Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile?

    Yes. If you do not do this, the data will still be copied from the network folder (share) to the local cached copy of the profile. -


    [11] +


    [11] There is an alternate method by which a default user profile can be added to the NETLOGON share. This facility in the Windows System tool permits profiles to be exported. The export target may be a particular user or diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/index.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/index.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/index.html 2005-12-29 10:26:02.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/index.html 2006-01-29 10:19:19.000000000 -0600 @@ -1,4 +1,4 @@ -Samba-3 by Example

    Samba-3 by Example
       Next

    Samba-3 by Example

    Practical Exercises in Successful Samba Deployment

    John H. Terpstra

    Samba Team

    June, 2005

    Table of Contents

    About the Cover Artwork
    Acknowledgments
    Foreword
    By John M. Weathersby, Executive Director, OSSI
    Preface
    Why Is This Book Necessary?
    Samba 3.0.20 Update Edition
    Prerequisites
    Approach
    Summary of Topics
    Conventions Used
    I. Example Network Configurations
    1. No-Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    2. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    3. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    4. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. Making Happy Users
    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    6. A Distributed 2000-User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    II. Domain Members, Updating Samba and Migration
    7. Adding Domain Member Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using NSS LDAP
    NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    NT4/Samba Domain with Samba Domain Member Server without NSS Support
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    8. Updating Samba-3
    Introduction
    Cautions and Notes
    Upgrading from Samba 1.x and 2.x to Samba-3
    Samba 1.9.x and 2.x Versions Without LDAP
    Applicable to All Samba 2.x to Samba-3 Upgrades
    Samba-2.x with LDAP Support
    Updating a Samba-3 Installation
    Samba-3 to Samba-3 Updates on the Same Server
    Migrating Samba-3 to a New Server
    Migration of Samba Accounts to Active Directory
    9. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    10. Migrating NetWare Server to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    NetWare Migration Using LDAP Backend
    III. Reference Section
    11. Active Directory, Kerberos, and Security
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    Share Access Controls
    Share Definition Controls
    Share Point Directory and File Permissions
    Managing Windows 200x ACLs
    Key Points Learned
    Questions and Answers
    12. Integrating Additional Services
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-Existing Conflicting RPMs
    Key Points Learned
    Questions and Answers
    13. Performance, Reliability, and Availability
    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN-Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Large Directories
    Key Points Learned
    14. Samba Support
    Free Support
    Commercial Support
    15. A Collection of Useful Tidbits
    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    IDEALX Management Console
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls
    16. Networking Primer
    Requirements and Notes
    Introduction
    Assignment Tasks
    Exercises
    Single-Machine Broadcast Activity
    Second Machine Startup Broadcast Interaction
    Simple Windows Client Connection Characteristics
    Windows 200x/XP Client Interaction with Samba-3
    Conclusions to Exercises
    Dissection and Discussion
    Technical Issues
    Questions and Answers
    A. GNU General Public License
    Preamble
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
    Section 0
    Section 1
    Section 2
    Section 3 +Samba-3 by Example
    Samba-3 by Example
       Next

    Samba-3 by Example

    Practical Exercises in Successful Samba Deployment

    John H. Terpstra

    Samba Team

    June, 2005

    Table of Contents

    About the Cover Artwork
    Acknowledgments
    Foreword
    By John M. Weathersby, Executive Director, OSSI
    Preface
    Why Is This Book Necessary?
    Samba 3.0.20 Update Edition
    Prerequisites
    Approach
    Summary of Topics
    Conventions Used
    I. Example Network Configurations
    1. No-Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    2. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    3. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    4. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation: All Servers
    Server-Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. Making Happy Users
    Regarding LDAP Directories and Windows Computer Accounts
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Checklist
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx smbldap-tools Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Assigning User Rights and Privileges
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    6. A Distributed 2000-User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    II. Domain Members, Updating Samba and Migration
    7. Adding Domain Member Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using NSS LDAP
    NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    NT4/Samba Domain with Samba Domain Member Server without NSS Support
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    8. Updating Samba-3
    Introduction
    Cautions and Notes
    Upgrading from Samba 1.x and 2.x to Samba-3
    Samba 1.9.x and 2.x Versions Without LDAP
    Applicable to All Samba 2.x to Samba-3 Upgrades
    Samba-2.x with LDAP Support
    Updating a Samba-3 Installation
    Samba-3 to Samba-3 Updates on the Same Server
    Migrating Samba-3 to a New Server
    Migration of Samba Accounts to Active Directory
    9. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    10. Migrating NetWare Server to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    NetWare Migration Using LDAP Backend
    III. Reference Section
    11. Active Directory, Kerberos, and Security
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    Share Access Controls
    Share Definition Controls
    Share Point Directory and File Permissions
    Managing Windows 200x ACLs
    Key Points Learned
    Questions and Answers
    12. Integrating Additional Services
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-Existing Conflicting RPMs
    Key Points Learned
    Questions and Answers
    13. Performance, Reliability, and Availability
    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN-Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Large Directories
    Key Points Learned
    14. Samba Support
    Free Support
    Commercial Support
    15. A Collection of Useful Tidbits
    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    IDEALX Management Console
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls
    16. Networking Primer
    Requirements and Notes
    Introduction
    Assignment Tasks
    Exercises
    Single-Machine Broadcast Activity
    Second Machine Startup Broadcast Interaction
    Simple Windows Client Connection Characteristics
    Windows 200x/XP Client Interaction with Samba-3
    Conclusions to Exercises
    Dissection and Discussion
    Technical Issues
    Questions and Answers
    A. GNU General Public License
    Preamble
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
    Section 0
    Section 1
    Section 2
    Section 3
    Section 4
    Section 5
    Section 6 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ix01.html samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ix01.html --- samba-3.0.21a/docs/htmldocs/Samba3-ByExample/ix01.html 2005-12-29 10:26:01.000000000 -0600 +++ samba-3.0.21b/docs/htmldocs/Samba3-ByExample/ix01.html 2006-01-29 10:19:19.000000000 -0600 @@ -1 +1 @@ -Index
    Index
    Prev   

    Index

    Symbols

    #delete group script, NT4 Migration Using LDAP Backend
    #delete user from group script, NT4 Migration Using LDAP Backend
    #delete user script, NT4 Migration Using LDAP Backend
    #wins support, NT4 Migration Using LDAP Backend
    %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
    %USERNAME%, Roaming Profile Background, Profile Changes
    %USERPROFILE%, Configuration of Default Profile with Folder Redirection
    /data/ldap, OpenLDAP Server Configuration
    /etc/cups/mime.convs, Implementation, Implementation
    /etc/cups/mime.types, Implementation, Implementation
    /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
    /etc/exports, Samba-3 PDC Configuration
    /etc/group, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, Replacing a Domain Member Server, Questions and Answers, Removal of Pre-Existing Conflicting RPMs
    /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation: All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
    /etc/krb5.conf, IDMAP Storage in LDAP using Winbind, Kerberos Configuration
    /etc/ldap.conf, PAM and NSS Client Configuration, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    /etc/mime.convs, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    /etc/mime.types, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    /etc/named.conf, Configuration of DHCP and DNS Servers
    /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, IDMAP_RID with Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Questions and Answers, NT4 Migration Using LDAP Backend
    /etc/openldap/slapd.conf, Debugging LDAP, OpenLDAP Server Configuration, Implementation
    /etc/passwd, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Questions and Answers, Replacing a Domain Member Server, Technical Issues, Questions and Answers, Technical Issues, Share Point Directory and File Permissions, Removal of Pre-Existing Conflicting RPMs, Findings and Comments
    /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
    /etc/rc.d/rc.local, Implementation
    /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation: All Servers
    /etc/samba, Samba System File Location
    /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
    /etc/samba/smbusers, Server Preparation: All Servers
    /etc/shadow, Replacing a Domain Member Server, Technical Issues
    /etc/squid/squid.conf, Removal of Pre-Existing Conflicting RPMs
    /etc/syslog.conf, Debugging LDAP
    /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
    /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
    /opt/IDEALX/sbin, NT4 Migration Using LDAP Backend
    /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
    /usr/bin, Samba System File Location
    /usr/lib/samba, Samba System File Location
    /usr/local, Samba System File Location
    /usr/local/samba, Samba System File Location
    /usr/local/samba/var/locks, Samba 1.9.x and 2.x Versions Without LDAP
    /usr/sbin, Samba System File Location
    /usr/share, Samba System File Location
    /usr/share/samba/swat, Samba System File Location
    /usr/share/swat, Samba System File Location
    /var/cache/samba, Samba 1.9.x and 2.x Versions Without LDAP
    /var/lib/samba, Samba 1.9.x and 2.x Versions Without LDAP, Samba System File Location
    /var/log/ldaplogs, Debugging LDAP
    /var/log/samba, Samba System File Location
    8-bit, International Language Support

    , Application Share Configuration, Addition of Machines to the Domain, IDMAP_RID with Winbind, Location of config files
    Domain account, Technical Issues
    liability, Dissection and Discussion
    logon, Implementation
    problem, Dissection and Discussion
    transparent inter-operability, Questions and Answers

    A

    abmas-netfw.sh, Basic System Configuration
    abort shutdown script, Samba Configuration, Implementation, Implementation
    accept, Printer Configuration
    accepts liability, Dissection and Discussion
    access, Technical Issues, Checkpoint Controls
    access control, Kerberos Exposed, Using the MMC Computer Management Interface
    Access Control Lists (see ACLs)
    access control settings, Share Access Controls
    access controls, Technical Issues, Share Definition Controls
    accessible, Share Point Directory and File Permissions
    account, Regarding LDAP Directories and Windows Computer Accounts, Share Access Controls
    ADS Domain, Technical Issues
    account credentials, Findings and Comments
    account information, Questions and Answers
    account names, Questions and Answers
    account policies, The LDAP Account Manager
    accountable, Introduction, Dissection and Discussion
    accounts
    authoritative, Technical Issues
    Domain, Introduction, Questions and Answers
    group, Introduction, Questions and Answers, Introduction
    machine, Introduction, Questions and Answers
    manage, The LDAP Account Manager
    user, Introduction, Questions and Answers, Introduction
    ACL, Questions and Answers, Security Identifiers (SIDs), Checkpoint Controls
    ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
    acquisitions, Introduction
    Act!, Shared Data Integrity
    ACT! database, Act! Database Sharing
    Act!Diag, Act! Database Sharing
    Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
    authentication, Squid Configuration
    domain, Samba Configuration
    join, Active Directory Domain with Samba Domain Member Server
    management tools, Technical Issues
    realm, Bad Hostnames
    Replacement, Technical Issues
    server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
    Server, Technical Issues
    tree, Samba Configuration
    active directory, Technical Issues
    AD printer publishing, Uploading Printer Drivers to Samba Servers
    ADAM, Dissection and Discussion, IDMAP Storage in LDAP using Winbind
    add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    Add Printer Wizard
    APW, Uploading Printer Drivers to Samba Servers
    add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    adequate precautions, Introduction
    admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, LDAP Server Configuration
    administrative installation, Application Share Configuration
    administrative rights, Checkpoint Controls
    administrator, Implementation, Samba Configuration, Server Preparation: All Servers
    ADMT, Migration of Samba Accounts to Active Directory
    ADS, IDMAP Storage in LDAP using Winbind, Technical Issues, Kerberos Configuration, Bad Hostnames
    server, Technical Issues
    ADS Domain, Technical Issues
    affordability, The Nature of Windows Networking Protocols
    alarm, Introduction
    algorithm, Technical Issues
    allow trusted domains, IDMAP_RID with Winbind
    alternative, Dissection and Discussion
    analysis, Technical Issues
    anonymous connection, Validation, Validation
    Apache Web server, Questions and Answers
    appliance mode, Technical Issues
    application server, Technical Issues, Application Share Configuration
    application servers, The Nature of Windows Networking Protocols
    application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    APW, Uploading Printer Drivers to Samba Servers
    arp, Validation
    assessment, Introduction
    assistance, Free Support
    assumptions, Key Points Learned
    authconfig, PAM and NSS Client Configuration
    authenticate, LDAP Server Configuration, Samba Configuration
    authenticated, Assignment Tasks
    authenticated connection, Validation, Validation
    authentication, The Nature of Windows Networking Protocols, Questions and Answers, Dissection and Discussion, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
    plain-text, Questions and Answers
    authentication process, Implementation
    authentication protocols, Key Points Learned
    authoritative, Technical Issues
    authorized location, Kerberos Exposed
    auto-generated SID, Questions and Answers
    automatically allocate, Technical Issues
    availability, Performance, Reliability, and Availability

    B

    backends, Integrating Additional Services
    background communication, Questions and Answers
    Backup, Introduction
    Backup Domain Controller (see BDC)
    bandwidth, Assignment Tasks
    requirements, User Needs
    bandwidth calculations, Hardware Requirements
    BDC, Technical Issues, Making Happy Users, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, Technical Issues, Questions and Answers, Security Identifiers (SIDs), NT4 Migration Using tdbsam Backend, Use and Location of BDCs
    benefit, Questions and Answers, Dissection and Discussion
    best practices, Introduction
    bias, Questions and Answers
    binary database, Implementation
    binary files, Updating a Samba-3 Installation
    binary package, Updating a Samba-3 Installation
    bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    broadcast, Routed Networks, Questions and Answers
    directed, The Nature of Windows Networking Protocols
    mailslot, The Nature of Windows Networking Protocols
    broadcast messages, Implementation
    broadcast storms, Network Collisions
    broken, Dissection and Discussion
    broken behavior, Dissection and Discussion
    browse, Technical Issues
    browse master, Findings
    Browse Master, Questions and Answers
    browse.dat, Replacing a Domain Member Server
    browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    Browser Election Service, Questions and Answers
    browsing, Technical Issues, Technical Issues, Assignment Tasks
    budgetted, Introduction
    bug fixes, Introduction
    bug report, Free Support

    C

    cache, Opportunistic Locking Controls
    cache directories, Removal of Pre-Existing Conflicting RPMs
    caching, Samba Configuration
    case sensitive, Large Directories
    case-sensitive, Kerberos Configuration
    centralized storage, Questions and Answers
    character set, International Language Support
    check samba daemons, Validation, Validation
    check-point, Share Definition Controls
    check-point controls, Checkpoint Controls
    Checkpoint Controls, Checkpoint Controls
    chgrp, Samba Configuration
    chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
    chmod, Samba Configuration
    choice, Dissection and Discussion, Technical Issues
    chown, Removal of Pre-Existing Conflicting RPMs
    CIFS, Security Identifiers (SIDs), Findings
    cifsfs, Dissection and Discussion
    clean database, Questions and Answers
    clients per DC, Making Happy Users
    Clock skew, Kerberos Configuration
    cluster, Introduction
    clustering, Introduction, For Scalability, Use SAN-Based Storage on Samba Servers
    code maintainer, Free Support
    codepage, International Language Support
    collision rates, Network Collisions
    comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    commercial, Dissection and Discussion
    commercial software, Dissection and Discussion
    commercial support, Samba Support, Commercial Support
    Common Internet File System (see CIFS)
    comparison
    Active Directory & OpenLDAP, Dissection and Discussion
    compat, Samba Domain with Samba Domain Member Server Using NSS LDAP
    compatible, Technical Issues
    compile-time, Location of config files
    complexities, Dissection and Discussion
    compromise, Introduction, Introduction, Technical Issues
    computer account, Samba Configuration
    Computer Management, Share Access Controls, Questions and Answers
    computer name, Security Identifiers (SIDs)
    condemns, Technical Issues
    conferences, Technical Issues
    configuration files, Introduction
    configure.pl, NT4 Migration Using LDAP Backend
    connection, Share Access Controls
    connectivity, Questions and Answers
    consequential risk, Technical Issues
    consultant, Drafting Office, Introduction, Dissection and Discussion
    consumer, Dissection and Discussion, Technical Issues
    consumer expects, Samba Support
    contiguous directory, Implementation
    contributions, Updating Samba-3
    control files, Updating a Samba-3 Installation
    convmv, International Language Support
    copy, Questions and Answers, LDAP Server Configuration
    corrective action, Hardware Problems
    cost, Dissection and Discussion
    cost-benefit, Assignment Tasks
    country of origin, Commercial Support
    Courier-IMAP, LDAP Server Configuration
    create mask, LDAP Server Configuration
    credential, Share Definition Controls
    credentials, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Technical Issues
    crippled, Dissection and Discussion
    criticism, Active Directory, Kerberos, and Security, Introduction
    Critics, Technical Issues
    Cryptographic, Technical Issues
    CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation: All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
    queue, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    cups options, Samba Configuration, LDAP Server Configuration
    cupsd, Basic System Configuration
    customer expected, Samba Support
    customers, Samba Support

    D

    daemon, Validation, Basic System Configuration, Security Identifiers (SIDs), Technical Issues, Questions and Answers, Starting Samba
    daemon control, Process Startup Configuration
    data
    corruption, Making Happy Users
    integrity, Questions and Answers
    data corruption, Hardware Problems, Act! Database Sharing
    data integrity, Hardware Problems, Shared Data Integrity
    data storage, Implementation
    database, Dissection and Discussion, Questions and Answers, Dissection and Discussion
    database applications, Shared Data Integrity
    DB_CONFIG, OpenLDAP Server Configuration
    DCE, Kerberos Exposed
    DDNS (see dynamic DNS)
    Debian, Migrating NetWare Server to Samba-3
    default devmode, Samba Configuration, Implementation
    default installation, Samba System File Location
    default password, The LDAP Account Manager
    default profile, Assignment Tasks, Technical Issues
    Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
    defective
    cables, Hardware Problems
    HUBs, Hardware Problems
    switches, Hardware Problems
    defects, Technical Issues
    defensible standards, Technical Issues
    defragmentation, Windows Client Configuration
    delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades
    delete user from group script, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, LDAP Server Configuration
    delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delimiter, Checkpoint Controls
    dependability, Technical Issues
    deployment, Free Support
    desired security setting, Setting Posix ACLs in UNIX/Linux
    development, Technical Issues
    DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
    client, Bad Hostnames
    relay, Technical Issues
    Relay Agent, Questions and Answers
    request, Questions and Answers
    requests, Technical Issues
    servers, Questions and Answers
    traffic, Questions and Answers
    dhcp client validation, Validation, Validation
    DHCP Server, Implementation
    DHCP server, Technical Issues
    diagnostic, IDMAP Storage in LDAP using Winbind
    diffusion, Technical Issues
    digital rights, Technical Issues
    digital sign'n'seal, Technical Issues
    digits, Bad Hostnames
    diligence, Technical Issues
    directory, Dissection and Discussion, Political Issues, Location of config files
    Computers container, LDAP Initialization and Creation of User and Group Accounts
    management, Dissection and Discussion
    People container, LDAP Initialization and Creation of User and Group Accounts
    replication, Dissection and Discussion
    schema, Dissection and Discussion
    server, Technical Issues
    synchronization, Dissection and Discussion
    directory mask, LDAP Server Configuration
    directory tree, Setting Posix ACLs in UNIX/Linux
    disable, Introduction
    disable spoolss, Implementation, Implementation
    disaster recovery, Introduction
    disk image, Assignment Tasks
    disruptive, Dissection and Discussion
    distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
    distributed domain, Identity Management Needs
    DMB, Questions and Answers
    DMS, Security Identifiers (SIDs), Replacing a Domain Member Server
    DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, LDAP Server Configuration, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
    configuration, Questions and Answers
    Dynamic, Questions and Answers
    dynamic, Joining a Domain: Windows 200x/XP Professional
    lookup, Questions and Answers, Kerberos Configuration
    name lookup, Bad Hostnames
    SRV records, Kerberos Configuration
    suffix, Joining a Domain: Windows 200x/XP Professional
    DNS server, Implementation, Configuration of DHCP and DNS Servers
    document the settings, Samba Configuration
    documentation, Dissection and Discussion, Technical Issues
    documented, Samba Configuration
    Domain, Technical Issues, Questions and Answers
    group, Questions and Answers
    groups, Technical Issues
    user, Questions and Answers
    domain
    Active Directory, Technical Issues
    controller, Replacing a Domain Controller
    joining, A Collection of Useful Tidbits
    trusted, Questions and Answers
    Domain accounts, Technical Issues
    Domain Administrator, Share Access Controls
    Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
    closest, The Nature of Windows Networking Protocols
    domain controller, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades
    domain controllers, Technical Issues
    Domain Controllers, Questions and Answers
    Domain Groups
    well-known, Initialization of the LDAP Database
    Domain join, Samba Domain with Samba Domain Member Server Using NSS LDAP
    domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    Domain logons, Questions and Answers
    domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    Domain Master Browser (see DMB)
    Domain Member, Use and Location of BDCs
    authoritative
    local accounts, Technical Issues
    client, Implementation
    desktop, Introduction
    server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
    servers, Questions and Answers, Checkpoint Controls
    workstations, Implementation
    domain member
    servers, Technical Issues
    Domain Member server, Technical Issues, Questions and Answers
    Domain Member servers, Questions and Answers
    domain members, Questions and Answers
    domain name space, Identity Management Needs
    domain replication, Questions and Answers
    domain SID, Security Identifiers (SIDs)
    Domain SID, Technical Issues, Questions and Answers
    domain tree, Identity Management Needs
    Domain User Manager, Configuring Profile Directories
    Domain users, Technical Issues
    DOS, Security Identifiers (SIDs)
    dos2unix, Samba Configuration, Configuration for Server: MASSIVE
    down-grade, Introduction
    drive letters, LDAP Server Configuration
    drive mapping, Technical Issues
    dumb printing, Installation of Printer Driver Auto-Download
    dump, Technical Issues, Questions and Answers
    duplicate accounts, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    dynamic DNS, Technical Issues

    E

    e-Directory, Dissection and Discussion
    ea support, NT4 Migration Using LDAP Backend
    Easy Software Products, Installation of Printer Driver Auto-Download
    economically sustainable, Dissection and Discussion
    eDirectory, Dissection and Discussion
    education, Identity Management Needs
    election, Findings
    employment, Introduction, Dissection and Discussion
    enable, Printer Configuration
    enable privileges, Samba-3 PDC Configuration, Samba-3 BDC Configuration
    encrypt passwords, NSS Configuration, Questions and Answers
    encrypted, Findings and Comments
    encrypted password, Windows 200x/XP Client Interaction with Samba-3
    encrypted passwords, Questions and Answers
    End User License Agreement (see EULA)
    enumerating, Samba Configuration
    essential, Introduction
    Ethereal, Requirements and Notes
    ethereal, Exercises
    Ethernet switch, Technical Issues
    ethernet switch, Making Happy Users
    EULA, Dissection and Discussion
    Everyone, Share Access Controls
    Excel, Share Point Directory and File Permissions
    exclusive open, Microsoft Access
    experiment, Active Directory, Kerberos, and Security
    export, Technical Issues
    extent, Dissection and Discussion
    External Domains, Technical Issues
    extreme demand, Guidelines for Reliable Samba Operation

    F

    fail, The Nature of Windows Networking Protocols
    fail-over, Identity Management Needs, Implementation
    failed, Samba Domain with Samba Domain Member Server Using NSS LDAP
    failed join, Samba Domain with Samba Domain Member Server Using NSS LDAP, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind
    failure, Questions and Answers, Samba Configuration
    familiar, Technical Issues
    fatal problem, Samba Configuration
    fear, Technical Issues
    fears, Technical Issues
    Fedora, Drafting Office
    FHS, Samba System File Location
    file and print server, Questions and Answers
    file and print service, Dissection and Discussion
    file caching, Samba Configuration, Opportunistic Locking Controls
    File Hierarchy System (see FHS)
    file locations, Samba System File Location
    file permissions, The LDAP Account Manager
    file server
    read-only, Dissection and Discussion
    file servers, Samba Server Implementation
    file system, Technical Issues
    access control, Samba Configuration
    Ext3, Implementation
    permissions, Samba Configuration, Configuration for Server: MASSIVE
    file system security, Questions and Answers
    filter, Share Access Controls
    financial responsibility, Introduction
    firewall, Technical Issues, Basic System Configuration, Introduction
    fix, Dissection and Discussion
    flaws, Introduction
    flexibility, Technical Issues
    flush
    cache memory, Opportunistic Locking Controls
    folder redirection, Technical Issues, Configuration of Default Profile with Folder Redirection, Questions and Answers
    force group, Implementation, LDAP Server Configuration, Override Controls, Questions and Answers
    force printername, LDAP Server Configuration
    force user, Dissection and Discussion, Implementation, Override Controls, Questions and Answers
    forced settings, Override Controls
    foreign, Samba Domain with Samba Domain Member Server Using NSS LDAP
    foreign SID, Samba Domain with Samba Domain Member Server Using NSS LDAP
    forwarded, Routed Networks
    foundation members, Technical Issues
    Free Standards Group (see FSG)
    free support, Samba Support, Free Support
    front-end, Dissection and Discussion
    server, Distribute Network Load with MSDFS
    frustration, Introduction
    FSG, Samba System File Location
    FTP
    proxy, Questions and Answers
    full control, Share Access Controls, Using MS Windows Explorer (File Manager)
    fully qualified, Checkpoint Controls
    functional differences, Cautions and Notes

    G

    generation, Cautions and Notes
    Gentoo, Migrating NetWare Server to Samba-3
    getent, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind
    getfacl, Setting Posix ACLs in UNIX/Linux
    getgrgid(), Questions and Answers
    getgrnam, Technical Issues
    getpwnam, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP
    getpwnam(), Questions and Answers
    GID, Implementation, Questions and Answers, Questions and Answers
    Goettingen, Questions and Answers
    government, Identity Management Needs
    GPL, Comments Regarding Software Terms of Use
    group account, Implementation, OpenLDAP Server Configuration
    group management, Implementation
    group mapping, LDAP Server Configuration
    group membership, Implementation, Samba Configuration, Samba Domain with Samba Domain Member Server Using NSS LDAP, Share Point Directory and File Permissions
    group names, Questions and Answers
    group policies, Introduction
    Group Policy, Joining a Domain: Windows 200x/XP Professional
    Group Policy editor, The Local Group Policy
    Group Policy Objects, The Local Group Policy
    groupadd, Implementation, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, Questions and Answers
    groupdel, Applicable to All Samba 2.x to Samba-3 Upgrades, Questions and Answers
    groupmem, NT4 Migration Using LDAP Backend
    groupmod, Applicable to All Samba 2.x to Samba-3 Upgrades, Questions and Answers
    GSS-API, Windows 200x/XP Client Interaction with Samba-3
    guest account, Findings and Comments, Dissection and Discussion, Technical Issues, Questions and Answers
    guest ok, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration

    H

    hackers, Introduction
    hardware prices, Hardware Problems
    hardware problems, Hardware Problems
    Heimdal, Implementation, Kerberos Configuration
    Heimdal Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    Heimdal kerberos, IDMAP Storage in LDAP using Winbind
    help, Free Support
    helper agent, Removal of Pre-Existing Conflicting RPMs
    hesiod, Samba Domain with Samba Domain Member Server Using NSS LDAP
    hide files, LDAP Server Configuration
    hierarchy of control, Share Definition Controls
    high availability, Dissection and Discussion
    hire, Dissection and Discussion
    HKEY_CURRENT_USER, Roaming Profile Background
    HKEY_LOCAL_MACHINE, Configuration of Default Profile with Folder Redirection
    HKEY_LOCAL_USER, Questions and Answers
    host announcement, Assignment Tasks, Findings
    hostname, Basic System Configuration, Security Identifiers (SIDs)
    hosts, Questions and Answers
    hosts allow, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support
    HUB, Making Happy Users
    Hybrid, Questions and Answers
    hypothetical, Introduction

    I

    Idealx, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend
    smbldap-tools, Install and Configure Idealx smbldap-tools Scripts, LDAP Initialization and Creation of User and Group Accounts
    identifiers, Technical Issues
    identity, Questions and Answers, Kerberos Exposed
    management, Technical Issues
    identity management, Technical Issues, Dissection and Discussion, Political Issues, Dissection and Discussion
    Identity Management, Dissection and Discussion, The Nature of Windows Networking Protocols, Identity Management Needs
    Identity management, UNIX/Linux Client Domain Member
    Identity resolution, Samba Domain with Samba Domain Member Server Using NSS LDAP, Active Directory Domain with Samba Domain Member Server, UNIX/Linux Client Domain Member, Questions and Answers
    Identity resolver, Questions and Answers
    IDMAP, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP_RID with Winbind
    idmap backend, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, NT4 Migration Using LDAP Backend
    IDMAP backend, Questions and Answers
    idmap gid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, NT4 Migration Using LDAP Backend, NSS Configuration
    idmap uid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, NT4 Migration Using LDAP Backend, NSS Configuration
    idmap_rid, IDMAP_RID with Winbind
    IMAP, Technical Issues
    import, Technical Issues
    include, Implementation
    income, Dissection and Discussion
    independent expert, Introduction
    inetd, Process Startup Configuration
    inetOrgPerson, Technical Issues
    inheritance, Setting Posix ACLs in UNIX/Linux
    initGrps.sh, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    initial credentials, Kerberos Configuration
    inoperative, Dissection and Discussion
    install, Updating Samba-3
    installation, Dissection and Discussion
    integrate, Technical Issues
    integrity, Introduction, Kerberos Exposed
    inter-domain, Applicable to All Samba 2.x to Samba-3 Upgrades
    inter-operability, Dissection and Discussion, Technical Issues, Key Points Learned, Questions and Answers
    interactive help, Free Support
    interdomain trusts, Identity Management Needs
    interfaces, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    intermittent, Hardware Problems
    internationalization, International Language Support
    Internet Explorer, Technical Issues
    Internet Information Server, Questions and Answers
    interoperability, Dissection and Discussion
    IP forwarding, Implementation, Basic System Configuration, Configuration for Server: MASSIVE
    IPC$, Findings and Comments
    iptables, Technical Issues
    IRC, Free Support
    isolated, Introduction
    Italian, Questions and Answers

    J

    jobs, Introduction
    joining a domain, Joining a Domain: Windows 200x/XP Professional

    K

    KDC, Kerberos Configuration
    Kerberos, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Key Points Learned, Technical Issues, Implementation, Kerberos Configuration
    Heimdal, Active Directory Domain with Samba Domain Member Server
    interoperability, Kerberos Exposed
    libraries, Active Directory Domain with Samba Domain Member Server
    MIT, Active Directory Domain with Samba Domain Member Server
    unspecified fields, Kerberos Exposed
    kerberos, Kerberos Exposed
    server, Kerberos Exposed
    Kerberos ticket, Samba Configuration
    kinit, Kerberos Configuration
    Kixtart, LDAP Server Configuration
    klist, Kerberos Configuration
    krb5, Implementation
    krb5.conf, Kerberos Configuration

    L

    LAM, The LDAP Account Manager
    configuration editor, The LDAP Account Manager
    configuration file, The LDAP Account Manager
    login screen, The LDAP Account Manager
    opening screen, The LDAP Account Manager
    profile, The LDAP Account Manager
    wizard, The LDAP Account Manager
    large domain, IDMAP_RID with Winbind
    LDAP, Technical Issues, Assignment Tasks, Dissection and Discussion, Technical Issues, Preliminary Advice: Dangers Can Be Avoided, PAM and NSS Client Configuration, Introduction, Dissection and Discussion, Identity Management Needs, Implementation, Key Points Learned, Questions and Answers, Technical Issues, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades, Assignment Tasks, Technical Issues, Questions and Answers, Dissection and Discussion, LDAP Server Configuration, Technical Issues
    backend, Identity Management Needs
    database, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Alternative LDAP Database Initialization
    directory, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs
    fail-over, Implementation
    initial configuration, Alternative LDAP Database Initialization
    master, Identity Management Needs
    master/slave
    background communication, Questions and Answers
    preload, Implementation
    schema, Updating from Samba Versions between 3.0.6 and 3.0.10
    secure, Technical Issues
    server, Questions and Answers
    slave, Identity Management Needs
    updates, Identity Management Needs
    ldap, Samba Domain with Samba Domain Member Server Using NSS LDAP
    LDAP Account Manager (see LAM)
    ldap admin dn, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP Storage in LDAP using Winbind, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    LDAP backend, Technical Issues
    LDAP database, Questions and Answers
    ldap group suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    ldap idmap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP Storage in LDAP using Winbind, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    LDAP Interchange Format (see LDIF)
    ldap machine suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    ldap passwd sync, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    LDAP server, Identity Management Needs
    ldap ssl, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    ldap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP Storage in LDAP using Winbind, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    ldap timeout, NT4 Migration Using LDAP Backend
    ldap user suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    LDAP-transfer-LDIF.txt, Implementation
    ldap.conf, Samba Domain with Samba Domain Member Server Using NSS LDAP
    ldapadd, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using NSS LDAP
    ldapsam, LDAP Initialization and Creation of User and Group Accounts, Dissection and Discussion, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Updating from Samba Versions between 3.0.6 and 3.0.10, Assignment Tasks, Integrating Additional Services
    ldapsam backend, Samba Domain with Samba Domain Member Server Using NSS LDAP
    ldapsearch, LDAP Initialization and Creation of User and Group Accounts
    LDIF, Technical Issues, Implementation, Technical Issues, LDAP Server Configuration, Initialization of the LDAP Database
    leadership, Technical Issues
    Lightweight Directory Access Protocol (see LDAP)
    limit, Questions and Answers
    Linux desktop, Introduction
    Linux Standards Base (see LSB)
    LMB, Findings, Questions and Answers
    LMHOSTS, Routed Networks
    load distribution, For Scalability, Use SAN-Based Storage on Samba Servers
    local accounts, Technical Issues
    Local Group Policy, Roaming Profile Background
    local groups, Questions and Answers
    Local Master Announcement, Findings
    Local Master Browser (see LMB)
    local users, Questions and Answers
    localhost, Basic System Configuration, Bad Hostnames
    lock directory, Samba 1.9.x and 2.x Versions Without LDAP
    locking, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend
    Application level, Shared Data Integrity
    Client side, Shared Data Integrity
    Server side, Shared Data Integrity
    log file, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    log level, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, IDMAP Storage in LDAP using Winbind, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    logging, Removal of Pre-Existing Conflicting RPMs
    login, Technical Issues
    loglevel, Debugging LDAP
    logon credentials, Questions and Answers
    logon drive, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    logon home, Samba Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    logon hours, Technical Issues, Key Points Learned
    logon machines, Technical Issues
    logon path, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    logon process, Implementation
    logon scrip, Samba Configuration
    logon script, Implementation, Implementation, Samba Configuration, Implementation, Technical Issues, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Preparation of Logon Scripts, Implementation, Technical Issues, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    logon server, The Nature of Windows Networking Protocols
    logon services, Implementation
    logon time, Assignment Tasks
    logon traffic, The Nature of Windows Networking Protocols
    logon.kix, LDAP Server Configuration
    loopback, Validation
    low performance, Hardware Problems
    lower-case, Implementation
    lpadmin, Implementation, Implementation, Implementation, Printer Configuration, Printer Configuration
    LSB, Samba System File Location

    M

    machine, Security Identifiers (SIDs)
    machine account, Regarding LDAP Directories and Windows Computer Accounts
    machine accounts, Questions and Answers
    machine secret password, Technical Issues
    MACHINE.SID, Security Identifiers (SIDs)
    mailing list, Free Support
    mailing lists, Free Support
    managed, Technical Issues
    management, Political Issues, Questions and Answers
    group, Technical Issues
    User, Technical Issues
    mandatory profile, Technical Issues, Configuring Profile Directories
    Mandrake, Migrating NetWare Server to Samba-3
    map acl inherit, Samba Configuration, Implementation, Samba-3 PDC Configuration, NT4 Migration Using LDAP Backend
    map to guest, Implementation
    mapped drives, Questions and Answers
    mapping, Technical Issues, Kerberos Configuration
    consistent, Samba Domain with Samba Domain Member Server Using NSS LDAP
    Mars_NWE, Migrating NetWare Server to Samba-3
    master, Dissection and Discussion
    material, A Collection of Useful Tidbits
    max log size, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend
    memberUID, LDAP Server Configuration
    memory requirements, Hardware Requirements
    merge, Technical Issues, Questions and Answers
    merged, Technical Issues
    meta-directory, Questions and Answers
    meta-service, Questions and Answers
    Microsoft Access, Shared Data Integrity
    Microsoft Excel, Shared Data Integrity
    Microsoft ISA, Assignment Tasks
    Microsoft Management Console (see MMC)
    Microsoft Office, Application Share Configuration, Share Point Directory and File Permissions
    Microsoft Outlook
    PST files, Questions and Answers
    migrate, Updating Samba-3, Technical Issues
    migration, Implementation, Implementation, Assignment Tasks, Introduction, Questions and Answers, Migrating NetWare Server to Samba-3
    objectives, Dissection and Discussion
    Migration speed, Questions and Answers
    mime type, Implementation, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    mime types, Implementation
    missing RPC's, Technical Issues
    MIT, Implementation, Kerberos Configuration
    MIT Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    MIT kerberos, IDMAP Storage in LDAP using Winbind
    MIT KRB5, Samba Configuration
    mixed mode, Active Directory Domain with Samba Domain Member Server
    mixed-mode, Questions and Answers
    MMC, Configure Delete Cached Profiles on Logout, Technical Issues, Questions and Answers
    mobile computing, Dissection and Discussion
    mobility, Technical Issues
    modularization, Technical Issues
    modules, Questions and Answers
    MS Access
    validate, Microsoft Access
    MS Outlook, Configuration of MS Outlook to Relocate PST File
    PST, Configuration of MS Outlook to Relocate PST File
    PST file, Making Happy Users
    MS Windows Server 2003, Implementation
    MS Word, Share Point Directory and File Permissions
    MSDFS, Distribute Network Load with MSDFS
    multi-subnet, Routed Networks
    multi-user
    access, Microsoft Access
    data access, Shared Data Integrity
    multiple directories, Identity Management Needs
    multiple domain controllers, Making Happy Users
    multiple group mappings, Questions and Answers
    mutual assistance, Free Support
    My Documents, Roaming Profile Background
    My Network Places, Implementation
    mysqlsam, Implementation

    N

    name resolution, Configuration of DHCP and DNS Servers, Questions and Answers, Assignment Tasks
    Defective, Active Directory Domain with Samba Domain Member Server
    name resolve order, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, NT4 Migration Using LDAP Backend, LDAP Server Configuration, Questions and Answers
    name service switch, Implementation (see NSS)
    named, Basic System Configuration, Validation, Server Preparation: All Servers
    NAT, Technical Issues
    native, Questions and Answers
    net
    ads
    info, Active Directory Domain with Samba Domain Member Server
    join, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Samba Configuration
    status, Active Directory Domain with Samba Domain Member Server
    getlocalsid, Samba-3 PDC Configuration, Security Identifiers (SIDs)
    group, NT4 Migration Using tdbsam Backend
    groupmap
    add, Samba Configuration
    list, Samba Configuration, LDAP Initialization and Creation of User and Group Accounts
    modify, Samba Configuration
    rpc
    info, Security Identifiers (SIDs)
    join, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, Questions and Answers, NT4 Migration Using tdbsam Backend
    vampire, Updating Samba-3, NT4 Migration Using tdbsam Backend
    setlocalsid, Security Identifiers (SIDs)
    NetBIOS, The Nature of Windows Networking Protocols, Questions and Answers, Bad Hostnames, Routed Networks, Questions and Answers
    name cache, Questions and Answers
    name resolution
    delays, Making Happy Users
    Node Type, Questions and Answers
    netbios
    machine name, Change of hostname
    netbios forwarding, Network Collisions
    netbios name, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Security Identifiers (SIDs), Change of hostname, NT4 Migration Using LDAP Backend, LDAP Server Configuration, NSS Configuration, Bad Hostnames
    NetBIOS name, Kerberos Configuration
    aliases, Identity Management Needs
    NETLOGON, Using a Network Default User Profile, Windows Client Configuration
    netlogon, The Nature of Windows Networking Protocols, LDAP Server Configuration
    Netlogon, Joining a Domain: Windows 200x/XP Professional
    netmask, Implementation
    Netware, Small Office Networking
    NetWare, Migrating NetWare Server to Samba-3, LDAP Server Configuration
    network
    administrators, Technical Issues
    analyzer, Assignment Tasks
    bandwidth, Identity Management Needs, Questions and Answers
    broadcast, Introduction
    captures, Requirements and Notes
    collisions, Network Collisions
    load, Network Collisions
    logon, Making Happy Users
    logon scripts, Dissection and Discussion
    management, Introduction
    multi-segment, Introduction
    overload, Making Happy Users
    performance, Samba Configuration
    routed, Dissection and Discussion
    secure, Introduction
    segment, Dissection and Discussion
    services, Questions and Answers
    sniffer, Requirements and Notes
    timeout, Making Happy Users
    timeouts, Network Collisions
    trace, Assignment Tasks
    traffic
    observation, Technical Issues
    wide-area, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    Network Address Translation (see NAT)
    network administrators, Technical Issues
    network attached storage (see NAS)
    network bandwidth
    utilization, Making Happy Users
    Network Default Profile, Roaming Profile Background
    network hardware
    defective, Making Happy Users
    network hygiene, Dissection and Discussion
    network Identities, Questions and Answers
    network load factors, Dissection and Discussion
    Network Neighborhood, Validation, Technical Issues
    network segment, Use and Location of BDCs
    network segments, Hardware Requirements
    network share, Assignment Tasks
    networking
    client, Security Identifiers (SIDs)
    networking hardware
    defective, Making Happy Users
    networking protocols, Technical Issues
    next generation, Technical Issues
    NextFreeUnixId, NT4 Migration Using LDAP Backend
    NFS server, Samba-3 PDC Configuration
    NICs, Hardware Problems
    NIS, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Political Issues, Questions and Answers
    nis, Samba Domain with Samba Domain Member Server Using NSS LDAP
    NIS schema, Questions and Answers
    NIS server, Questions and Answers
    NIS+, Identity Management Needs
    nisplus, Samba Domain with Samba Domain Member Server Using NSS LDAP
    NLM, Migrating NetWare Server to Samba-3
    nmap, Validation
    nmbd, Validation, Validation, Samba 1.9.x and 2.x Versions Without LDAP, Replacing a Domain Member Server, Samba Configuration, Starting Samba
    nobody, Removal of Pre-Existing Conflicting RPMs, Findings and Comments
    Novell, Migrating NetWare Server to Samba-3, Introduction
    Novell SUSE SLES 9, NT4 Migration Using LDAP Backend
    NSS, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, PAM and NSS Client Configuration, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, IDMAP_RID with Winbind, UNIX/Linux Client Domain Member, Questions and Answers, LDAP Server Configuration, NSS Configuration (see same service switch)
    nss_ldap, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, OpenLDAP Server Configuration, PAM and NSS Client Configuration, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Replacing a Domain Member Server, NT4 Migration Using LDAP Backend
    nt acl support, Dissection and Discussion, Implementation
    NT4 registry, Dissection and Discussion
    NTLM, Technical Issues
    NTLM authentication daemon, Technical Issues
    NTLMSSP, Key Points Learned, Questions and Answers, Windows 200x/XP Client Interaction with Samba-3
    NTLMSSP_AUTH, Windows 200x/XP Client Interaction with Samba-3
    ntlm_auth, Samba Configuration, Questions and Answers
    NTP, Kerberos Configuration
    NTUSER.DAT, Roaming Profile Background, Profile Changes, Using a Network Default User Profile, Questions and Answers
    NULL connection, Validation
    NULL session, Findings and Comments
    NULL-Session, Discussion

    O

    objectClass, LDAP Server Configuration
    off-site storage, Introduction
    Open Magazine, Adding Domain Member Servers and Clients
    Open Source, Dissection and Discussion
    OpenLDAP, Dissection and Discussion, Dissection and Discussion, Questions and Answers, Political Issues, Technical Issues, Introduction, Technical Issues, Key Points Learned, The LDAP Account Manager
    openldap, OpenLDAP Server Configuration
    OpenOffice, Application Share Configuration
    operating profiles, The LDAP Account Manager
    oplock break, Override Controls
    oplocks, Samba Configuration
    Oplocks
    disabled, Opportunistic Locking Controls
    opportunistic
    locking, Override Controls
    opportunistic locking, Implementation, Samba Configuration, Act! Database Sharing
    optimized, Samba Configuration
    options list, Questions and Answers
    organizational units, The LDAP Account Manager
    os level, Implementation
    OS/2, Security Identifiers (SIDs)
    Outlook
    PST, Configuration of MS Outlook to Relocate PST File
    Outlook Address Book, Configuration of MS Outlook to Relocate PST File
    Outlook Express, Political Issues, Configuration of MS Outlook to Relocate PST File
    over-ride, Technical Issues
    over-ride controls, Override Controls
    over-rule, Share Access Controls, Using MS Windows Explorer (File Manager)
    overheads, Override Controls
    ownership, Share Point Directory and File Permissions

    P

    package, Implementation
    package names, Samba System File Location
    packages, Updating a Samba-3 Installation
    PADL, Technical Issues, IDMAP Storage in LDAP using Winbind
    PADL LDAP tools, Technical Issues
    PADL Software, Samba Domain with Samba Domain Member Server Using NSS LDAP
    paid-for support, Samba Support
    PAM, PAM and NSS Client Configuration, UNIX/Linux Client Domain Member, LDAP Server Configuration
    pam password change, Samba Configuration, LDAP Server Configuration
    pam_ldap, OpenLDAP Server Configuration
    pam_ldap.so, PAM and NSS Client Configuration
    pam_unix2.so, PAM and NSS Client Configuration
    use_ldap, PAM and NSS Client Configuration
    parameters, Applicable to All Samba 2.x to Samba-3 Upgrades
    passdb backend, Implementation, Samba Configuration, The 500-User Office, Implementation, Dissection and Discussion, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, Updating Samba-3, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades, Updating from Samba Versions between 3.0.6 and 3.0.10, Assignment Tasks, NT4 Migration Using LDAP Backend, Questions and Answers, LDAP Server Configuration
    passdb.tdb, Technical Issues
    passwd, Implementation, Implementation, Samba Configuration
    passwd chat, Implementation, Samba Configuration
    passwd program, Samba Configuration
    password
    backend, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    password caching, Implementation
    password change, Key Points Learned
    password length, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    password server, NSS Configuration
    path, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    payroll, Introduction
    pdbedit, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, NT4 Migration Using tdbsam Backend, Questions and Answers
    PDC, Assignment Tasks, Technical Issues, Making Happy Users, Technical Issues, The Local Group Policy, The Nature of Windows Networking Protocols, Technical Issues, Questions and Answers, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Use and Location of BDCs
    PDC/BDC ratio, Making Happy Users
    PDF, The LDAP Account Manager
    performance, Dissection and Discussion, Questions and Answers, Performance, Reliability, and Availability, Introduction, Network Collisions
    performance degradation, Override Controls, Samba Configuration
    Perl, LDAP Server Configuration, The LDAP Account Manager
    permission, Share Point Directory and File Permissions
    permissions, Implementation, Technical Issues, Share Access Controls, Checkpoint Controls, Share Point Directory and File Permissions, Removal of Pre-Existing Conflicting RPMs
    excessive, Technical Issues
    group, Share Point Directory and File Permissions
    user, Share Point Directory and File Permissions
    Permissions, Using the MMC Computer Management Interface
    permits, Technical Issues
    permitted group, Using the MMC Computer Management Interface
    PHP, The LDAP Account Manager
    PHP4, The LDAP Account Manager
    pile-driver, Share Definition Controls
    ping, Validation
    pitfalls, The LDAP Account Manager
    plain-text, Questions and Answers
    Pluggable Authentication Modules (see PAM)
    policy, Questions and Answers, Introduction
    poor performance, Dissection and Discussion
    POP3, Technical Issues
    Posix, Dissection and Discussion, Technical Issues, Questions and Answers, Implementation, Questions and Answers, The LDAP Account Manager
    POSIX, Regarding LDAP Directories and Windows Computer Accounts, LDAP Server Configuration
    Posix accounts, LDAP Initialization and Creation of User and Group Accounts, Technical Issues
    Posix ACLs, Managing Windows 200x ACLs
    PosixAccount, LDAP Initialization and Creation of User and Group Accounts
    posixAccount, LDAP Server Configuration
    Postfix, LDAP Server Configuration
    Postscript, Installation of Printer Driver Auto-Download
    powers, Share Definition Controls
    practices, Introduction
    precaution, Introduction
    preferred master, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    presence and leadership, Technical Issues
    price paid, Dissection and Discussion
    primary group, Samba Domain with Samba Domain Member Server Using NSS LDAP, Share Point Directory and File Permissions
    principals, Kerberos Exposed
    print filter, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    print queue, Charity Administration Office, Dissection and Discussion
    print spooler, Charity Administration Office
    Print Test Page, Uploading Printer Drivers to Samba Servers
    printable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    printcap name, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, LDAP Server Configuration
    printer admin, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, IDMAP_RID with Winbind, LDAP Server Configuration
    printer validation, Validation, Validation
    printers
    Advanced, Uploading Printer Drivers to Samba Servers
    Default Settings, Uploading Printer Drivers to Samba Servers
    General, Uploading Printer Drivers to Samba Servers
    Properties, Uploading Printer Drivers to Samba Servers
    Security, Uploading Printer Drivers to Samba Servers
    Sharing, Uploading Printer Drivers to Samba Servers
    printing, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server
    drag-and-drop, Installation of Printer Driver Auto-Download, Uploading Printer Drivers to Samba Servers
    dumb, Installation of Printer Driver Auto-Download
    point-n-click, Installation of Printer Driver Auto-Download
    raw, Dissection and Discussion
    privacy, Identity Management Needs
    Privilege Attribute Certificates (see PAC)
    privilege controls, Share Point Directory and File Permissions
    privileged pipe, Samba Configuration
    privileges, Identity Management Needs, Updating from Samba Versions after 3.0.6 to a Current Release, Technical Issues, Share Definition Controls
    problem report, Free Support
    problem resolution, Samba Support
    product defects, Dissection and Discussion
    professional support, Free Support
    profile
    default, Assignment Tasks
    mandatory, The Nature of Windows Networking Protocols
    roaming, Making Happy Users
    profile acls, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    profile path, Technical Issues
    profile share, Implementation
    profiles, Security Identifiers (SIDs)
    profiles share, Dissection and Discussion
    programmer, Dissection and Discussion
    project, Free Support
    project maintainers, Technical Issues
    Properties, Using the MMC Computer Management Interface
    proprietary, Technical Issues
    protected, Technical Issues
    protection, Technical Issues
    protocol
    negotiation, The Nature of Windows Networking Protocols
    protocol analysis, Requirements and Notes
    protocols, Technical Issues
    provided services, Samba Support
    proxy, Assignment Tasks, Technical Issues
    PST file, Configuration of MS Outlook to Relocate PST File
    public specifications, Technical Issues
    purchase support, Free Support

    Q

    Qbasic, LDAP Server Configuration
    qualified problem, Free Support

    R

    RAID, Hardware Requirements
    RAID controllers, Hardware Problems
    Raw Print Through, Installation of Printer Driver Auto-Download
    raw printing, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    Rbase, LDAP Server Configuration
    rcldap, Implementation
    read only, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    realm, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Kerberos Configuration, NSS Configuration
    recognize, Technical Issues
    record locking, Microsoft Access
    recursively, Setting Posix ACLs in UNIX/Linux
    Red Hat, Drafting Office, Migrating NetWare Server to Samba-3
    Red Hat Fedora Linux, Samba Configuration
    Red Hat Linux, Dissection and Discussion, Accounting Office, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Samba Configuration
    redirected folders, Roaming Profile Background, The Nature of Windows Networking Protocols
    refereed standards, Technical Issues
    regedit, Implementation
    regedt32, Profile Changes, Configuration of Default Profile with Folder Redirection
    registry, Questions and Answers
    keys
    SAM, Dissection and Discussion
    SECURITY, Dissection and Discussion
    registry change, Questions and Answers
    Registry Editor, Configuration of Default Profile with Folder Redirection
    registry hacks, Questions and Answers
    registry keys, Configuration of Default Profile with Folder Redirection
    reimburse, Dissection and Discussion
    rejected, Samba Domain with Samba Domain Member Server Using NSS LDAP, Share Access Controls
    rejoin, Questions and Answers
    reliability, Performance, Reliability, and Availability
    remote announce, Routed Networks
    remote browse sync, Routed Networks
    remote procedure call (see RPC)
    replicate, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    replicated, Dissection and Discussion
    requesting payment, Free Support
    resilient, Guidelines for Reliable Samba Operation
    resolution, Replacing a Domain Member Server
    resolve, Technical Issues, Bad Hostnames
    response, IDMAP_RID with Winbind
    responsibility, Dissection and Discussion
    responsible, Technical Issues
    restrict anonymous, Samba Domain with Samba Domain Member Server Using NSS LDAP
    restricted export, Kerberos Exposed
    Restrictive security, Active Directory Domain with Samba Domain Member Server
    reverse DNS, Kerberos Configuration
    rfc2307bis, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension
    RID, IDMAP_RID with Winbind, LDAP Server Configuration
    risk, Technical Issues, Questions and Answers, Questions and Answers, Introduction
    road-map, Technical Issues
    published, Technical Issues
    roaming profile, Technical Issues, Roaming Profile Background, Configuring Profile Directories, User Needs, Questions and Answers
    roaming profiles, Technical Issues, Implementation, Roaming Profile Background
    routed network, Use and Location of BDCs
    router, Implementation
    routers, Questions and Answers, Routed Networks
    RPC, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    rpc, Security Identifiers (SIDs)
    rpcclient, Security Identifiers (SIDs)
    RPM, Security Identifiers (SIDs), Samba 1.9.x and 2.x Versions Without LDAP, Dissection and Discussion
    install, Implementation
    rpm, Removal of Pre-Existing Conflicting RPMs, Samba System File Location
    RPMs, Samba Configuration
    rpms, Removal of Pre-Existing Conflicting RPMs
    rsync, Samba-3 PDC Configuration, Questions and Answers, LDAP Server Configuration, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    rsyncd.conf, LDAP Server Configuration
    run-time control files, Samba System File Location

    S

    safe-guards, Technical Issues
    SAM, Dissection and Discussion
    samba, Removal of Pre-Existing Conflicting RPMs
    starting samba, Implementation
    Samba, Samba Configuration
    Samba accounts, Technical Issues
    samba cluster, Introduction
    samba control script, Starting Samba
    Samba Domain, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Questions and Answers
    Samba Domain server, Using the MMC Computer Management Interface
    Samba RPM Packages, Samba-3 PDC Configuration
    Samba Tea, Samba Configuration
    sambaDomainName, NT4 Migration Using LDAP Backend
    sambaGroupMapping, LDAP Server Configuration
    SambaSAMAccount, Regarding LDAP Directories and Windows Computer Accounts
    SambaSamAccount, LDAP Initialization and Creation of User and Group Accounts
    sambaSamAccount, LDAP Server Configuration
    SambaXP conference, Questions and Answers
    SAN, For Scalability, Use SAN-Based Storage on Samba Servers
    SAS, Security Identifiers (SIDs)
    scalability, Introduction
    scalable, Identity Management Needs
    schannel, Technical Issues, Key Points Learned, Questions and Answers
    schema, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Questions and Answers, Samba-2.x with LDAP Support, Updating from Samba Versions between 3.0.6 and 3.0.10
    scripts, The LDAP Account Manager
    secondary group, Samba Domain with Samba Domain Member Server Using NSS LDAP
    secret, Kerberos Exposed
    secrets.tdb, Technical Issues, Samba-3 PDC Configuration, Security Identifiers (SIDs), Location of config files
    secure, Introduction
    secure account password, Questions and Answers
    secure connections, The LDAP Account Manager
    secure networking, Technical Issues
    secure networking protocols, Technical Issues
    security, Implementation, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Questions and Answers, Security Identifiers (SIDs), Introduction, Technical Issues, Share Point Directory and File Permissions, Questions and Answers, NSS Configuration
    identifier, Security Identifiers (SIDs)
    share mode, Dissection and Discussion
    user mode, Dissection and Discussion
    Security, Technical Issues, Using the MMC Computer Management Interface
    Security Account Manager (see SAM)
    security controls, Technical Issues
    security descriptors, Dissection and Discussion
    security fixes, Technical Issues
    security updates, Technical Issues
    SerNet, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    server
    domain member, Security Identifiers (SIDs)
    stand-alone, Security Identifiers (SIDs)
    server string, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, LDAP Server Configuration
    service, Implementation
    smb
    start, Configuration Specific to Domain Member Servers: BLDG1, BLDG2
    Service Packs, Application Share Configuration
    services, Key Points Learned
    services provided, Samba Support
    session setup, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    Session Setup, Simple Windows Client Connection Characteristics
    SessionSetUpAndX, Security Identifiers (SIDs)
    set primary group script, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    setfacl, Setting Posix ACLs in UNIX/Linux
    severely degrade, Samba Configuration
    SFU, IDMAP, Active Directory, and MS Services for UNIX 3.5
    SGID, Dissection and Discussion, Share Point Directory and File Permissions, Effect of Setting File and Directory SUID/SGID Permissions Explained
    shadow-utils, Questions and Answers
    share, Questions and Answers
    Share Access Controls, Share Access Controls
    share ACLs, Questions and Answers
    share definition, Technical Issues
    Share Definition
    Controls, Share Definition Controls
    share definition controls, Share Definition Controls, Checkpoint Controls, Share Point Directory and File Permissions, Questions and Answers
    share level access controls, Questions and Answers
    share level ACL, Questions and Answers
    Share Permissions, Share Access Controls
    shared resource, Technical Issues, Setting Posix ACLs in UNIX/Linux
    shares, Technical Issues
    show add printer wizard, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, LDAP Server Configuration
    shutdown script, Samba Configuration, Implementation, Implementation
    SID, Windows Client Configuration, Regarding LDAP Directories and Windows Computer Accounts, Identity Management Needs, Technical Issues, IDMAP_RID with Winbind, Security Identifiers (SIDs), Change of Workgroup (Domain) Name, Questions and Answers, Initialization of the LDAP Database
    side effects, Managing Windows 200x ACLs
    Sign'n'seal, Key Points Learned, Questions and Answers
    silent return, Active Directory Domain with Samba Domain Member Server
    simple, Dissection and Discussion
    Single Sign-On (see SSO)
    slapcat, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using NSS LDAP, LDAP Server Configuration
    slapd, Debugging LDAP
    slapd.conf, NT4 Migration Using LDAP Backend
    slave, Dissection and Discussion
    slow logon, Making Happy Users
    slow network, Hardware Problems
    slurpd, Implementation, Questions and Answers
    smart printing, Dissection and Discussion
    SMB, Security Identifiers (SIDs)
    SMB passwords, Implementation
    smb ports, Samba Configuration, Questions and Answers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, NT4 Migration Using LDAP Backend
    SMB/CIFS, Questions and Answers
    smbclient, Validation, Validation, LDAP Initialization and Creation of User and Group Accounts, Questions and Answers
    smbd, Validation, Implementation, Validation, Validation, Samba-3 PDC Configuration, Technical Issues, Active Directory Domain with Samba Domain Member Server, Security Identifiers (SIDs), Location of config files, Samba 1.9.x and 2.x Versions Without LDAP, Replacing a Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
    location of files, Samba System File Location
    smbfs, Dissection and Discussion
    smbldap-groupadd, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
    smbldap-groupmod, LDAP Server Configuration
    smbldap-passwd, LDAP Initialization and Creation of User and Group Accounts
    smbldap-populate, LDAP Initialization and Creation of User and Group Accounts
    smbldap-tools, NT4 Migration Using LDAP Backend, LDAP Server Configuration, The LDAP Account Manager
    smbldap-tools updating, NT4 Migration Using LDAP Backend
    smbldap-useradd, LDAP Initialization and Creation of User and Group Accounts, Implementation
    smbldap-usermod, LDAP Initialization and Creation of User and Group Accounts, LDAP Server Configuration
    smbmnt, Dissection and Discussion
    smbmount, Dissection and Discussion
    smbpasswd, Implementation, Technical Issues, Implementation, Technical Issues, Samba Configuration, Server Preparation: All Servers, Configuration for Server: MASSIVE, Samba-3 PDC Configuration, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Questions and Answers, Updating Samba-3, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades, Technical Issues, Questions and Answers, Integrating Additional Services
    smbumnt, Dissection and Discussion
    smbumount, Dissection and Discussion
    SMTP, Technical Issues
    snap-shot, Dissection and Discussion
    socket address, Samba Configuration
    socket options, Samba Configuration
    software, Dissection and Discussion
    solve, Dissection and Discussion
    source code, Dissection and Discussion
    SPNEGO, Windows 200x/XP Client Interaction with Samba-3
    SQL, Dissection and Discussion, Questions and Answers
    Squid, Implementation, Removal of Pre-Existing Conflicting RPMs, Samba Configuration, Squid Configuration
    squid, Removal of Pre-Existing Conflicting RPMs, Samba Configuration
    Squid proxy, Technical Issues
    SRVTOOLS.EXE, Implementation, Configuring Profile Directories, Questions and Answers, Questions and Answers
    SSL, The LDAP Account Manager
    stand-alone server, Security Identifiers (SIDs)
    starting CUPS, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    starting dhcpd, Implementation, Process Startup Configuration, Process Startup Configuration
    starting samba, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    nmbd, Starting Samba
    smbd, Starting Samba
    winbindd, Starting Samba
    startingCUPS, Implementation
    startup script, Starting Samba
    sticky bit, Implementation
    storage capacity, Hardware Requirements
    strategic, Technical Issues
    strategy, Questions and Answers
    straw-man, Active Directory, Kerberos, and Security
    strict sync, Samba Configuration
    stripped, Samba 1.9.x and 2.x Versions Without LDAP
    strong cryptography, Kerberos Exposed
    subscription, Free Support
    SUID, Dissection and Discussion, Questions and Answers, Effect of Setting File and Directory SUID/SGID Permissions Explained
    Sun ONE Identity Server, Dissection and Discussion
    super daemon, Process Startup Configuration
    support, Dissection and Discussion, Samba Support
    survey, Adding Domain Member Servers and Clients
    SUSE, Migrating NetWare Server to Samba-3
    SUSE Enterprise Linux Server, Charity Administration Office, Basic System Configuration, Implementation
    SUSE Linux, Dissection and Discussion, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Removal of Pre-Existing Conflicting RPMs
    SWAT, Samba System File Location
    sync always, Samba Configuration
    synchronization, Kerberos Configuration, For Scalability, Use SAN-Based Storage on Samba Servers
    synchronize, User Needs, LDAP Server Configuration
    synchronized, Questions and Answers
    syslog, Implementation, Samba Configuration, Implementation, OpenLDAP Server Configuration, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend
    system level logins, Questions and Answers
    system security, Technical Issues

    T

    tattooing, Questions and Answers
    TCP/IP, Questions and Answers
    tdbdump, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend
    tdbsam, Technical Issues, Implementation, The 500-User Office, Assignment Tasks, Dissection and Discussion, Implementation, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Questions and Answers, Applicable to All Samba 2.x to Samba-3 Upgrades, Updating from Samba Versions between 3.0.6 and 3.0.10, Technical Issues, Questions and Answers
    template primary group, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server
    template shell, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension
    testparm, Validation, Validation, Samba-3 PDC Configuration, Active Directory Domain with Samba Domain Member Server, Samba 1.9.x and 2.x Versions Without LDAP, Samba Configuration
    ticket, Samba Configuration
    time server, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
    Tivoli Directory Server, Dissection and Discussion
    TLS, LDAP Server Configuration
    token, Technical Issues
    tool, Questions and Answers, Dissection and Discussion
    TOSHARG2, Implementation
    track record, Dissection and Discussion
    traffic collisions, Making Happy Users
    transaction processing, Dissection and Discussion
    transactional, Questions and Answers
    transfer, Questions and Answers
    translate, Managing Windows 200x ACLs
    traverse, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    tree, Dissection and Discussion
    Tree Connect, Simple Windows Client Connection Characteristics
    trust account, Regarding LDAP Directories and Windows Computer Accounts
    trusted computing, Introduction
    Trusted Domains, Technical Issues
    trusted domains, Questions and Answers
    trusted third-party, Kerberos Exposed
    trusting, Kerberos Exposed
    turn-around time, Technical Issues

    U

    UDP
    broadcast, Routed Networks
    UID, Dissection and Discussion, Regarding LDAP Directories and Windows Computer Accounts, Technical Issues, Implementation, Questions and Answers, Questions and Answers
    un-join, Questions and Answers
    unauthorized activities, Kerberos Exposed
    UNC name, Questions and Answers
    unencrypted, The LDAP Account Manager
    Unicast, The Nature of Windows Networking Protocols
    unicode, International Language Support
    Universal Naming Convention (see UNC name)
    UNIX, LDAP Server Configuration
    groups, Technical Issues, Implementation
    UNIX account, Questions and Answers
    UNIX accounts, Technical Issues
    unix charset, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server
    unix password sync, Samba Configuration
    UNIX/Linux server, Technical Issues
    unix2dos, Samba Configuration, Configuration for Server: MASSIVE
    unknown, Technical Issues
    unsupported software, Commercial Support
    update, Introduction, Cautions and Notes
    updates, Introduction, Technical Issues
    updating smbldap-tools, NT4 Migration Using LDAP Backend
    upgrade, Introduction, Cautions and Notes, LDAP Server Configuration
    uppercase, Implementation
    use client driver, Implementation, Implementation, Implementation, Samba Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    user
    management, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    user account, Making Happy Users, OpenLDAP Server Configuration
    User and Group Controls, Technical Issues
    user credentials, Identity Management Needs, UNIX/Linux Client Domain Member
    user errors, Questions and Answers
    user groups, Free Support
    user identities, Implementation
    user logins, Questions and Answers
    user management, Implementation
    User Manager, NT4 Migration Using LDAP Backend
    User Mode, Implementation, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    useradd, Implementation, Implementation, Implementation, Samba Configuration, Configuration for Server: MASSIVE, Applicable to All Samba 2.x to Samba-3 Upgrades
    userdel, Applicable to All Samba 2.x to Samba-3 Upgrades
    usermod, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend
    username, Security Identifiers (SIDs)
    username map, Implementation, Samba Configuration, Server Preparation: All Servers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, LDAP Server Configuration
    UTF-8, International Language Support
    utilities, Questions and Answers
    utmp, Samba Configuration, Implementation, Implementation

    V

    valid users, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, Questions and Answers, NT4 Migration Using LDAP Backend, LDAP Server Configuration, Checkpoint Controls, Questions and Answers
    validate, Questions and Answers, Checkpoint Controls
    validated, Identity Management Needs, Active Directory Domain with Samba Domain Member Server, Introduction
    validation, Validation, Validation, Questions and Answers
    vampire, Questions and Answers
    vendor, Dissection and Discussion
    vendors, Updating a Samba-3 Installation
    veto files, Samba Configuration, Implementation, LDAP Server Configuration
    veto oplock files, Samba Configuration, Implementation
    VFS modules, Samba System File Location
    virus, Implementation
    VPN, Assignment Tasks
    vulnerabilities, Introduction

    W

    wbinfo, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    weakness, Technical Issues
    web
    caching, Assignment Tasks
    proxying, Assignment Tasks
    Web
    proxy, Questions and Answers
    access, Key Points Learned
    Web browsers, Key Points Learned
    WebClient, Making Happy Users
    WHATSNEW.txt, Samba-2.x with LDAP Support
    white-pages, Technical Issues, LDAP Server Configuration
    wide-area, User Needs, Identity Management Needs, Key Points Learned, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    wide-area network, Use and Location of BDCs, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    winbind, Implementation, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Questions and Answers, Introduction, Technical Issues, Technical Issues, Samba Configuration, NSS Configuration
    Winbind, Questions and Answers, Technical Issues, Key Points Learned
    winbind enable local accounts, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Questions and Answers
    winbind enum groups, IDMAP_RID with Winbind, NSS Configuration
    winbind enum users, IDMAP_RID with Winbind, NSS Configuration
    winbind nested groups, IDMAP_RID with Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, NT4 Migration Using LDAP Backend
    winbind separator, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    winbind trusted domains only, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Questions and Answers
    winbind use default domain, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Checkpoint Controls
    winbind user default domain, NSS Configuration
    winbindd, Validation, Validation, Technical Issues, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, Questions and Answers, Samba 1.9.x and 2.x Versions Without LDAP, Updating from Samba Versions after 3.0.6 to a Current Release, Replacing a Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
    winbindd_cache.tdb, Technical Issues
    winbindd_idmap.tdb, Technical Issues
    Windows, LDAP Server Configuration
    client, Security Identifiers (SIDs)
    NT, Security Identifiers (SIDs)
    Windows 2000 ACLs, Managing Windows 200x ACLs
    Windows 2003 Serve, Introduction
    Windows 200x ACLs, Questions and Answers
    Windows accounts, Technical Issues
    Windows ACLs, Setting Posix ACLs in UNIX/Linux
    Windows Address Book, LDAP Server Configuration
    Windows ADS Domain, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    Windows clients, Questions and Answers
    Windows Explorer, Validation
    Windows explorer, Questions and Answers
    Windows security identifier (see SID)
    Windows Servers, Introduction
    Windows Services for UNIX (see SUS)
    Windows XP, Assignment Tasks
    WINS, Implementation, Technical Issues, Implementation, Windows Client Configuration, Technical Issues, Windows Client Configuration, The Nature of Windows Networking Protocols, Identity Management Needs, Questions and Answers, Questions and Answers
    lookup, Questions and Answers
    name resolution, Routed Networks
    server, Making Happy Users, Routed Networks
    WINS server, The 500-User Office, Questions and Answers
    wins server, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, NT4 Migration Using LDAP Backend
    WINS serving, Implementation
    wins support, Implementation, Implementation, Implementation, Samba Configuration, Validation, Implementation, Samba-3 PDC Configuration, Implementation, LDAP Server Configuration
    wins.dat, Identity Management Needs, Replacing a Domain Member Server
    Word, Share Point Directory and File Permissions
    workgroup, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Security Identifiers (SIDs), Change of Workgroup (Domain) Name, NT4 Migration Using LDAP Backend, LDAP Server Configuration, NSS Configuration
    Workgroup Announcement, Findings
    workstation, Implementation
    wrapper, Questions and Answers
    write list, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, LDAP Server Configuration
    write lock, Opportunistic Locking Controls

    X

    xinetd, Process Startup Configuration
    XML, Dissection and Discussion
    xmlsam, Implementation

    Y

    YaST, PAM and NSS Client Configuration
    Yellow Pages, Identity Management Needs
    yellow pages (see NIS)
    Prev   
    Glossary Home 
    +Index
    Index
    Prev   

    Index

    Symbols

    #delete group script, NT4 Migration Using LDAP Backend
    #delete user from group script, NT4 Migration Using LDAP Backend
    #delete user script, NT4 Migration Using LDAP Backend
    #wins support, NT4 Migration Using LDAP Backend
    %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
    %USERNAME%, Roaming Profile Background, Profile Changes
    %USERPROFILE%, Configuration of Default Profile with Folder Redirection
    /data/ldap, OpenLDAP Server Configuration
    /etc/cups/mime.convs, Implementation, Implementation
    /etc/cups/mime.types, Implementation, Implementation
    /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
    /etc/exports, Samba-3 PDC Configuration
    /etc/group, Technical Issues, Samba Domain with Samba Domain Member Server Using NSS LDAP, Replacing a Domain Member Server, Questions and Answers, Removal of Pre-Existing Conflicting RPMs
    /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation: All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
    /etc/krb5.conf, IDMAP Storage in LDAP using Winbind, Kerberos Configuration
    /etc/ldap.conf, PAM and NSS Client Configuration, IDMAP Storage in LDAP using Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    /etc/mime.convs, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    /etc/mime.types, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    /etc/named.conf, Configuration of DHCP and DNS Servers
    /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, IDMAP_RID with Winbind, IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension, Questions and Answers, NT4 Migration Using LDAP Backend
    /etc/openldap/slapd.conf, Debugging LDAP, OpenLDAP Server Configuration, Implementation
    /etc/passwd, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Questions and Answers, Replacing a Domain Member Server, Technical Issues, Questions and Answers, Technical Issues, Share Point Directory and File Permissions, Removal of Pre-Existing Conflicting RPMs, Findings and Comments
    /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
    /etc/rc.d/rc.local, Implementation
    /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation: All Servers
    /etc/samba, Samba System File Location
    /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
    /etc/samba/smbusers, Server Preparation: All Servers
    /etc/shadow, Replacing a Domain Member Server, Technical Issues
    /etc/squid/squid.conf, Removal of Pre-Existing Conflicting RPMs
    /etc/syslog.conf, Debugging LDAP
    /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
    /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
    /opt/IDEALX/sbin, NT4 Migration Using LDAP Backend
    /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
    /usr/bin, Samba System File Location
    /usr/lib/samba, Samba System File Location
    /usr/local, Samba System File Location
    /usr/local/samba, Samba System File Location
    /usr/local/samba/var/locks, Samba 1.9.x and 2.x Versions Without LDAP
    /usr/sbin, Samba System File Location
    /usr/share, Samba System File Location
    /usr/share/samba/swat, Samba System File Location
    /usr/share/swat, Samba System File Location
    /var/cache/samba, Samba 1.9.x and 2.x Versions Without LDAP
    /var/lib/samba, Samba 1.9.x and 2.x Versions Without LDAP, Samba System File Location
    /var/log/ldaplogs, Debugging LDAP
    /var/log/samba, Samba System File Location
    8-bit, International Language Support

    , Application Share Configuration, Addition of Machines to the Domain, IDMAP_RID with Winbind, Location of config files
    Domain account, Technical Issues
    liability, Dissection and Discussion
    logon, Implementation
    problem, Dissection and Discussion
    transparent inter-operability, Questions and Answers

    A

    abmas-netfw.sh, Basic System Configuration
    abort shutdown script, Samba Configuration, Implementation, Implementation
    accept, Printer Configuration
    accepts liability, Dissection and Discussion
    access, Technical Issues, Checkpoint Controls
    access control, Kerberos Exposed, Using the MMC Computer Management Interface
    Access Control Lists (see ACLs)
    access control settings, Share Access Controls
    access controls, Technical Issues, Share Definition Controls
    accessible, Share Point Directory and File Permissions
    account, Regarding LDAP Directories and Windows Computer Accounts, Share Access Controls
    ADS Domain, Technical Issues
    account credentials, Findings and Comments
    account information, Questions and Answers
    account names, Questions and Answers
    account policies, The LDAP Account Manager
    accountable, Introduction, Dissection and Discussion
    accounts
    authoritative, Technical Issues
    Domain, Introduction, Questions and Answers
    group, Introduction, Questions and Answers, Introduction
    machine, Introduction, Questions and Answers
    manage, The LDAP Account Manager
    user, Introduction, Questions and Answers, Introduction
    ACL, Security Identifiers (SIDs), Checkpoint Controls
    ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
    acquisitions, Introduction
    Act!, Shared Data Integrity
    ACT! database, Act! Database Sharing
    Act!Diag, Act! Database Sharing
    Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, IDMAP_RID with Winbind, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
    authentication, Squid Configuration
    domain, Samba Configuration
    join, Active Directory Domain with Samba Domain Member Server
    management tools, Technical Issues
    realm, Bad Hostnames
    Replacement, Technical Issues
    server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
    Server, Technical Issues
    tree, Samba Configuration
    active directory, Technical Issues
    AD printer publishing, Uploading Printer Drivers to Samba Servers
    ADAM, Dissection and Discussion, IDMAP Storage in LDAP using Winbind
    add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    Add Printer Wizard
    APW, Uploading Printer Drivers to Samba Servers
    add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    adequate precautions, Introduction
    admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, LDAP Server Configuration
    administrative installation, Application Share Configuration
    administrative rights, Checkpoint Controls
    administrator, Implementation, Samba Configuration, Server Preparation: All Servers
    ADMT, Migration of Samba Accounts to Active Directory
    ADS, IDMAP Storage in LDAP using Winbind, Technical Issues, Kerberos Configuration, Bad Hostnames
    server, Technical Issues
    ADS Domain, Technical Issues
    affordability, The Nature of Windows Networking Protocols
    alarm, Introduction
    algorithm, Technical Issues
    allow trusted domains, IDMAP_RID with Winbind
    alternative, Dissection and Discussion
    analysis, Technical Issues
    anonymous connection, Validation, Validation
    Apache Web server, Questions and Answers
    appliance mode, Technical Issues
    application server, Technical Issues, Application Share Configuration
    application servers, The Nature of Windows Networking Protocols
    application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    APW, Uploading Printer Drivers to Samba Servers
    arp, Validation
    assessment, Introduction
    assistance, Free Support
    assumptions, Key Points Learned
    authconfig, PAM and NSS Client Configuration
    authenticate, LDAP Server Configuration, Samba Configuration
    authenticated, Assignment Tasks
    authenticated connection, Validation, Validation
    authentication, The Nature of Windows Networking Protocols, Questions and Answers, Dissection and Discussion, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
    plain-text, Questions and Answers
    authentication process, Implementation
    authentication protocols, Key Points Learned
    authoritative, Technical Issues
    authorized location, Kerberos Exposed
    auto-generated SID, Questions and Answers
    automatically allocate, Technical Issues
    availability, Performance, Reliability, and Availability

    B

    backends, Integrating Additional Services
    background communication, Questions and Answers
    Backup, Introduction
    Backup Domain Controller (see BDC)
    bandwidth, Assignment Tasks
    requirements, User Needs
    bandwidth calculations, Hardware Requirements
    BDC, Technical Issues, Making Happy Users, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, Technical Issues, Questions and Answers, Security Identifiers (SIDs), NT4 Migration Using tdbsam Backend, Use and Location of BDCs
    benefit, Questions and Answers, Dissection and Discussion
    best practices, Introduction
    bias, Questions and Answers
    binary database, Implementation
    binary files, Updating a Samba-3 Installation
    binary package, Updating a Samba-3 Installation
    bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    broadcast, Routed Networks, Questions and Answers
    directed, The Nature of Windows Networking Protocols
    mailslot, The Nature of Windows Networking Protocols
    broadcast messages, Implementation
    broadcast storms, Network Collisions
    broken, Dissection and Discussion
    broken behavior, Dissection and Discussion
    browse, Technical Issues
    browse master, Findings
    Browse Master, Questions and Answers
    browse.dat, Replacing a Domain Member Server
    browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    Browser Election Service, Questions and Answers
    browsing, Technical Issues, Technical Issues, Assignment Tasks
    budgetted, Introduction
    bug fixes, Introduction
    bug report, Free Support

    C

    cache, Opportunistic Locking Controls
    cache directories, Removal of Pre-Existing Conflicting RPMs
    caching, Samba Configuration
    case sensitive, Large Directories
    case-sensitive, Kerberos Configuration
    centralized storage, Questions and Answers
    character set, International Language Support
    check samba daemons, Validation, Validation
    check-point, Share Definition Controls
    check-point controls, Checkpoint Controls
    Checkpoint Controls, Checkpoint Controls
    chgrp, Samba Configuration
    chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
    chmod, Samba Configuration
    choice, Dissection and Discussion, Technical Issues
    chown, Removal of Pre-Existing Conflicting RPMs
    CIFS, Security Identifiers (SIDs), Findings
    cifsfs, Dissection and Discussion
    clean database, Questions and Answers
    clients per DC, Making Happy Users
    Clock skew, Kerberos Configuration
    cluster, Introduction
    clustering, Introduction, For Scalability, Use SAN-Based Storage on Samba Servers
    code maintainer, Free Support
    codepage, International Language Support
    collision rates, Network Collisions
    comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using NSS LDAP, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, NT4/Samba Domain with Samba Domain Member Server without NSS Support, Active Directory Domain with Samba Domain Member Server, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    commercial, Dissection and Discussion
    commercial software, Dissection and Discussion
    commercial support, Samba Support, Commercial Support
    Common Internet File System (see CIFS)
    comparison
    Active Directory & OpenLDAP, Dissection and Discussion
    compat, Samba Domain with Samba Domain Member Server Using NSS LDAP
    compatible, Technical Issues
    compile-time, Location of config files
    complexities, Dissection and Discussion
    compromise, Introduction, Introduction, Technical Issues
    computer account, Samba Configuration
    Computer Management, Share Access Controls, Questions and Answers
    computer name, Security Identifiers (SIDs)
    condemns, Technical Issues
    conferences, Technical Issues
    configuration files, Introduction
    configure.pl, NT4 Migration Using LDAP Backend
    connection, Share Access Controls
    connectivity, Questions and Answers
    consequential risk, Technical Issues
    consultant, Drafting Office, Introduction, Dissection and Discussion
    consumer, Dissection and Discussion, Technical Issues
    consumer expects, Samba Support
    contiguous directory, Implementation
    contributions, Updating Samba-3
    control files, Updating a Samba-3 Installation
    convmv, International Language Support
    copy, Questions and Answers, LDAP Server Configuration
    corrective action, Hardware Problems
    cost, Dissection and Discussion
    cost-benefit, Assignment Tasks
    country of origin, Commercial Support
    Courier-IMAP, LDAP Server Configuration
    create mask, LDAP Server Configuration
    credential, Share Definition Controls
    credentials, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind, Technical Issues
    crippled, Dissection and Discussion
    criticism, Active Directory, Kerberos, and Security, Introduction
    Critics, Technical Issues
    Cryptographic, Technical Issues
    CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation: All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
    queue, Implementation, Printer Configuration, Server Preparation: All Servers, Printer Configuration
    cups options, Samba Configuration, LDAP Server Configuration
    cupsd, Basic System Configuration
    customer expected, Samba Support
    customers, Samba Support

    D

    daemon, Validation, Basic System Configuration, Security Identifiers (SIDs), Technical Issues, Questions and Answers, Starting Samba
    daemon control, Process Startup Configuration
    data
    corruption, Making Happy Users
    integrity, Questions and Answers
    data corruption, Hardware Problems, Act! Database Sharing
    data integrity, Hardware Problems, Shared Data Integrity
    data storage, Implementation
    database, Dissection and Discussion, Questions and Answers, Dissection and Discussion
    database applications, Shared Data Integrity
    DB_CONFIG, OpenLDAP Server Configuration
    DCE, Kerberos Exposed
    DDNS (see dynamic DNS)
    Debian, Migrating NetWare Server to Samba-3
    default devmode, Samba Configuration, Implementation
    default installation, Samba System File Location
    default password, The LDAP Account Manager
    default profile, Assignment Tasks, Technical Issues
    Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
    defective
    cables, Hardware Problems
    HUBs, Hardware Problems
    switches, Hardware Problems
    defects, Technical Issues
    defensible standards, Technical Issues
    defragmentation, Windows Client Configuration
    delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades
    delete user from group script, Samba-3 PDC Configuration, Implementation, Applicable to All Samba 2.x to Samba-3 Upgrades, LDAP Server Configuration
    delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delimiter, Checkpoint Controls
    dependability, Technical Issues
    deployment, Free Support
    desired security setting, Setting Posix ACLs in UNIX/Linux
    development, Technical Issues
    DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
    client, Bad Hostnames
    relay, Technical Issues
    Relay Agent, Questions and Answers
    request, Questions and Answers
    requests, Technical Issues
    servers, Questions and Answers
    traffic, Questions and Answers
    dhcp client validation, Validation, Validation
    DHCP Server, Implementation
    DHCP server, Technical Issues
    diagnostic, IDMAP Storage in LDAP using Winbind
    diffusion, Technical Issues
    digital rights, Technical Issues
    digital sign'n'seal, Technical Issues
    digits, Bad Hostnames
    diligence, Technical Issues
    directory, Dissection and Discussion, Political Issues, Location of config files
    Computers container, LDAP Initialization and Creation of User and Group Accounts
    management, Dissection and Discussion
    People container, LDAP Initialization and Creation of User and Group Accounts
    replication, Dissection and Discussion
    schema, Dissection and Discussion
    server, Technical Issues
    synchronization, Dissection and Discussion
    directory mask, LDAP Server Configuration
    directory tree, Setting Posix ACLs in UNIX/Linux
    disable, Introduction
    disable spoolss, Implementation, Implementation
    disaster recovery, Introduction
    disk image, Assignment Tasks
    disruptive, Dissection and Discussion
    distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
    distributed domain, Identity Management Needs
    DMB, Questions and Answers
    DMS, Security Identifiers (SIDs), Replacing a Domain Member Server
    DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, LDAP Server Configuration, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
    configuration, Questions and Answers
    Dynamic, Questions and Answers
    dynamic, Joining a Domain: Windows 200x/XP Professional
    lookup, Questions and Answers, Kerberos Configuration
    name lookup, Bad Hostnames
    SRV records, Kerberos Configuration
    suffix, Joining a Domain: Windows 200x/XP Professional
    DNS server, Implementation, Configuration of DHCP and DNS Servers
    document the settings, Samba Configuration
    documentation, Dissection and Discussion, Technical Issues
    documented, Samba Configuration
    Domain, Technical Issues
    groups, Technical Issues
    domain
    Active Directory, Technical Issues
    controller, Replacing a Domain Controller
    joining, A Collection of Useful Tidbits
    trusted, Questions and Answers
    Domain accounts, Technical Issues
    Domain Administrator, Share Access Controls
    Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
    closest, The Nature of Windows Networking Protocols
    domain controller, Security Identifiers (SIDs), Applicable to All Samba 2.x to Samba-3 Upgrades
    domain controllers, Technical Issues
    Domain Controllers, Questions and Answers
    Domain Groups
    well-known, Initialization of the LDAP Database
    Domain join, Samba Domain with Samba Domain Member Server Using NSS LDAP
    domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, LDAP Server Configuration
    domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    Domain Master Browser (see DMB)
    Domain Member, Use and Location of BDCs
    authoritative
    local accounts, Technical Issues
    client, Implementation
    desktop, Introduction
    server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
    servers, Questions and Answers, Checkpoint Controls
    workstations, Implementation
    domain member
    servers, Technical Issues
    Domain Member server, Technical Issues, Questions and Answers
    Domain Member servers, Questions and Answers
    domain members, Questions and Answers
    domain name space, Identity Management Needs
    domain replication, Questions and Answers
    domain SID, Security Identifiers (SIDs)
    Domain SID, Technical Issues, Questions and Answers
    domain tree, Identity Management Needs
    Domain User Manager, Configuring Profile Directories
    Domain users, Technical Issues
    DOS, Security Identifiers (SIDs)
    dos2unix, Samba Configuration, Configuration for Server: MASSIVE
    down-grade, Introduction
    drive letters, LDAP Server Configuration
    drive mapping, Technical Issues
    dumb printing, Installation of Printer Driver Auto-Download
    dump, Technical Issues, Questions and Answers
    duplicate accounts, NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind
    dynamic DNS, Technical Issues

    E

    e-Directory, Dissection and Discussion
    ea support, NT4 Migration Using LDAP Backend
    Easy Software Products, Installation of Printer Driver Auto-Download
    economically sustainable, Dissection and Discussion
    eDirectory, Dissection and Discussion
    education, Identity Management Needs
    election, Findings
    employment, Introduction, Dissection and Discussion
    enable, Printer Configuration
    enable privileges, Samba-3 PDC Configuration, Samba-3 BDC Configuration
    encrypt passwords, NSS Configuration, Questions and Answers
    encrypted, Findings and Comments
    encrypted password, Windows 200x/XP Client Interaction with Samba-3
    encrypted p