From e37c703c0d6f7c637444c637badf33064086aec4 Mon Sep 17 00:00:00 2001 From: cvs2svn Import User Date: Wed, 27 Nov 2002 02:58:10 +0000 Subject: [PATCH] This commit was manufactured by cvs2svn to create tag 'release-3-0alpha21'. --- docs/htmldocs/ads.html | 423 ---- docs/htmldocs/appendixes.html | 391 ---- docs/htmldocs/introduction.html | 438 ---- docs/htmldocs/oplocks.html | 208 -- docs/htmldocs/optional.html | 955 -------- docs/htmldocs/p1346.html | 917 -------- docs/htmldocs/p18.html | 438 ---- docs/htmldocs/p3106.html | 391 ---- docs/htmldocs/p544.html | 388 ---- docs/htmldocs/pdb-mysql.html | 286 --- docs/htmldocs/pdb-xml.html | 189 -- docs/htmldocs/pwencrypt.html | 445 ---- docs/htmldocs/samba-howto-collection.html | 1132 --------- docs/htmldocs/samba-pdc.html | 2649 ---------------------- docs/htmldocs/type.html | 392 ---- docs/htmldocs/vfs.html | 403 ---- packaging/Mandrake/samba-3.0-smbmount-sbin.patch | 11 - source/include/libsmb_internal.h | 67 - source/libsmb/trustdom_cache.c | 215 -- 19 files changed, 10338 deletions(-) delete mode 100644 docs/htmldocs/ads.html delete mode 100644 docs/htmldocs/appendixes.html delete mode 100644 docs/htmldocs/introduction.html delete mode 100644 docs/htmldocs/oplocks.html delete mode 100644 docs/htmldocs/optional.html delete mode 100644 docs/htmldocs/p1346.html delete mode 100644 docs/htmldocs/p18.html delete mode 100644 docs/htmldocs/p3106.html delete mode 100644 docs/htmldocs/p544.html delete mode 100644 docs/htmldocs/pdb-mysql.html delete mode 100644 docs/htmldocs/pdb-xml.html delete mode 100644 docs/htmldocs/pwencrypt.html delete mode 100644 docs/htmldocs/samba-howto-collection.html delete mode 100644 docs/htmldocs/samba-pdc.html delete mode 100644 docs/htmldocs/type.html delete mode 100644 docs/htmldocs/vfs.html delete mode 100644 packaging/Mandrake/samba-3.0-smbmount-sbin.patch delete mode 100644 source/include/libsmb_internal.h delete mode 100644 source/libsmb/trustdom_cache.c diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html deleted file mode 100644 index 49345be2c08..00000000000 --- a/docs/htmldocs/ads.html +++ /dev/null @@ -1,423 +0,0 @@ - -Samba as a ADS domain member
SAMBA Project Documentation
PrevNext

Chapter 9. Samba as a ADS domain member

This is a VERY ROUGH guide to setting up the current (November 2001) -pre-alpha version of Samba 3.0 with kerberos authentication against a -Windows2000 KDC. The procedures listed here are likely to change as -the code develops.

Pieces you need before you begin: -

a Windows 2000 server.
samba 3.0 or higher.
the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

9.1. Installing the required packages for Debian

On Debian you need to install the following packages: -

libkrb5-dev
krb5-user

9.2. Installing the required packages for RedHat

On RedHat this means you should have at least: -

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need -to get them off CD2.

9.3. Compile Samba

If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h contains - lines like this:

#define HAVE_KRB5 1
-#define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf:

  realm = YOUR.KERBEROS.REALM
-  ads server = your.kerberos.server
-  security = ADS
-  encrypt passwords = yes

Strictly speaking, you can omit the realm name and you can use an IP - address for the ads server. In that case Samba will auto-detect these.

You do *not* need a smbpasswd file, although it won't do any harm - and if you have one then Samba will be able to fall back to normal - password security for older clients. I expect that the above - required options will change soon when we get better active - directory integration.

9.4. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

	[realms]
-    YOUR.KERBEROS.REALM = {
-	kdc = your.kerberos.server
-    }

Test your config by doing a "kinit USERNAME@REALM" and making sure that - your password is accepted by the Win2000 KDC.

NOTE: The realm must be uppercase.

You also must ensure that you can do a reverse DNS lookup on the IP -address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name -followed by the realm.

The easiest way to ensure you get this right is to add a /etc/hosts -entry mapping the IP address of your KDC to its netbios name. If you -don't get this right then you will get a "local error" when you try -to join the realm.

If all you want is kerberos support in smbclient then you can skip -straight to step 5 now. Step 3 is only needed if you want kerberos -support in smbd.

9.5. Create the computer account

Do a "kinit" as a user that has authority to change arbitrary -passwords on the KDC ("Administrator" is a good choice). Then as a -user that has write permission on the Samba private directory -(usually root) run: -net ads join

9.5.1. Possible errors

"bash: kinit: command not found"

kinit is in the krb5-workstation RPM on RedHat systems, and is in /usr/kerberos/bin, so it won't be in the path until you log in again (or open a new terminal)

"ADS support not compiled in"

Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.

9.6. Test your server setup

On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ?

9.7. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba -server using smbclient and kerberos. Use smbclient as usual, but -specify the -k option to choose kerberos authentication.

9.8. Notes

You must change administrator password at least once after DC install, - to create the right encoding types

w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in - their defaults DNS setup. Maybe fixed in service packs?

PrevHomeNext
How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainUpSamba as a NT4 domain member
\ No newline at end of file diff --git a/docs/htmldocs/appendixes.html b/docs/htmldocs/appendixes.html deleted file mode 100644 index 49242c65545..00000000000 --- a/docs/htmldocs/appendixes.html +++ /dev/null @@ -1,391 +0,0 @@ - -Appendixes
SAMBA Project Documentation
PrevNext

IV. Appendixes

Table of Contents
24. Portability
24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
25. Samba and other CIFS clients
25.1. Macintosh clients?
25.2. OS2 Client
25.2.1. How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
25.2.2. How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
25.2.3. Are there any other issues when OS/2 (any version) - is used as a client?
25.2.4. How do I get printer driver download working - for OS/2 clients?
25.3. Windows for Workgroups
25.3.1. Use latest TCP/IP stack from Microsoft
25.3.2. Delete .pwl files after password change
25.3.3. Configure WfW password handling
25.3.4. Case handling of passwords
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26. Reporting Bugs
26.1. Introduction
26.2. General info
26.3. Debug levels
26.4. Internal errors
26.5. Attaching to a running process
26.6. Patches
27. Diagnosing your samba server
27.1. Introduction
27.2. Assumptions
27.3. Tests
27.3.1. Test 1
27.3.2. Test 2
27.3.3. Test 3
27.3.4. Test 4
27.3.5. Test 5
27.3.6. Test 6
27.3.7. Test 7
27.3.8. Test 8
27.3.9. Test 9
27.3.10. Test 10
27.3.11. Test 11
27.4. Still having troubles?
PrevHomeNext
Samba performance issues Portability
\ No newline at end of file diff --git a/docs/htmldocs/introduction.html b/docs/htmldocs/introduction.html deleted file mode 100644 index 581687e8ab6..00000000000 --- a/docs/htmldocs/introduction.html +++ /dev/null @@ -1,438 +0,0 @@ - -General installation
SAMBA Project Documentation
PrevNext

I. General installation

Introduction

This part contains general info on how to install samba -and how to configure the parts of samba you will most likely need. -PLEASE read this.

Table of Contents
1. How to Install and Test SAMBA
1.1. Read the man pages
1.2. Building the Binaries
1.3. The all important step
1.4. Create the smb configuration file.
1.5. Test your config file with - testparm
1.6. Starting the smbd and nmbd
1.6.1. Starting from inetd.conf
1.6.2. Alternative: starting it as a daemon
1.7. Try listing the shares available on your - server
1.8. Try connecting with the unix client
1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
1.10.1. Diagnosing Problems
1.10.2. Scope IDs
1.10.3. Choosing the Protocol Level
1.10.4. Printing from UNIX to a Client PC
1.10.5. Locking
1.10.6. Mapping Usernames
2. Improved browsing in samba
2.1. Overview of browsing
2.2. Browsing support in samba
2.3. Problem resolution
2.4. Browsing across subnets
2.4.1. How does cross subnet browsing work ?
2.5. Setting up a WINS server
2.6. Setting up Browsing in a WORKGROUP
2.7. Setting up Browsing in a DOMAIN
2.8. Forcing samba to be the master
2.9. Making samba the domain master
2.10. Note about broadcast addresses
2.11. Multiple interfaces
3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. Discussion
4.2. Use of the "Remote Announce" parameter
4.3. Use of the "Remote Browse Sync" parameter
4.4. Use of WINS
4.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. Name Resolution Order
5. LanMan and NT Password Encryption in Samba
5.1. Introduction
5.2. Important Notes About Security
5.2.1. Advantages of SMB Encryption
5.2.2. Advantages of non-encrypted passwords
5.3. The smbpasswd Command
PrevHomeNext
SAMBA Project Documentation How to Install and Test SAMBA
\ No newline at end of file diff --git a/docs/htmldocs/oplocks.html b/docs/htmldocs/oplocks.html deleted file mode 100644 index 6aa91fb17fc..00000000000 --- a/docs/htmldocs/oplocks.html +++ /dev/null @@ -1,208 +0,0 @@ - -Oplocks
SAMBA Project Documentation
PrevNext

Chapter 3. Oplocks

3.1. What are oplocks?

When a client opens a file it can request an "oplock" or file -lease. This is (to simplify a bit) a guarentee that no one else -has the file open simultaneously. It allows the client to not -send any updates on the file to the server, thus reducing a -network file access to local access (once the file is in -client cache). An "oplock break" is when the server sends -a request to the client to flush all its changes back to -the server, so the file is in a consistent state for other -opens to succeed. If a client fails to respond to this -asynchronous request then the file can be corrupted. Hence -the "turn off oplocks" answer if people are having multi-user -file access problems.

Unless the kernel is "oplock aware" (SGI IRIX and Linux are -the only two UNIXes that are at the moment) then if a local -UNIX process accesses the file simultaneously then Samba -has no way of telling this is occuring, so the guarentee -to the client is broken. This can corrupt the file. Short -answer - it you have UNIX clients accessing the same file -as smbd locally or via NFS and you're not running Linux or -IRIX then turn off oplocks for that file or share.

"Share modes". These are modes of opening a file, that -guarentee an invarient - such as DENY_WRITE - which means -that if any other opens are requested with write access after -this current open has succeeded then they should be denied -with a "sharing violation" error message. Samba handles these -internally inside smbd. UNIX clients accessing the same file -ignore these invarients. Just proving that if you need simultaneous -file access from a Windows and UNIX client you *must* have an -application that is written to lock records correctly on both -sides. Few applications are written like this, and even fewer -are cross platform (UNIX and Windows) so in practice this isn't -much of a problem.

"Locking". This really means "byte range locking" - such as -lock 10 bytes at file offset 24 for write access. This is the -area in which well written UNIX and Windows apps will cooperate. -Windows locks (at least from NT or above) are 64-bit unsigned -offsets. UNIX locks are either 31 bit or 63 bit and are signed -(the top bit is used for the sign). Samba handles these by -first ensuring that all the Windows locks don't conflict (ie. -if other Windows clients have competing locks then just reject -immediately) - this allows us to support 64-bit Windows locks -on 32-bit filesystems. Secondly any locks that are valid are -then mapped onto UNIX fcntl byte range locks. These are the -locks that will be seen by UNIX processes. If there is a conflict -here the lock is rejected.

Note that if a client has an oplock then it "knows" that no -other client can have the file open so usually doesn't bother -to send to lock request to the server - this means once again -if you need to share files between UNIX and Windows processes -either use IRIX or Linux, or turn off oplocks for these -files/shares.

PrevHomeNext
Improved browsing in sambaUpQuick Cross Subnet Browsing / Cross Workgroup Browsing guide
\ No newline at end of file diff --git a/docs/htmldocs/optional.html b/docs/htmldocs/optional.html deleted file mode 100644 index da152ea1cae..00000000000 --- a/docs/htmldocs/optional.html +++ /dev/null @@ -1,955 +0,0 @@ - -Optional configuration
SAMBA Project Documentation
PrevNext

III. Optional configuration

Introduction

Samba has several features that you might want or might not want to use. The chapters in this -part each cover one specific feature.

Table of Contents
11. Integrating MS Windows networks with Samba
11.1. Agenda
11.2. Name Resolution in a pure Unix/Linux world
11.2.1. /etc/hosts
11.2.2. /etc/resolv.conf
11.2.3. /etc/host.conf
11.2.4. /etc/nsswitch.conf
11.3. Name resolution as used within MS Windows networking
11.3.1. The NetBIOS Name Cache
11.3.2. The LMHOSTS file
11.3.3. HOSTS file
11.3.4. DNS Lookup
11.3.5. WINS Lookup
11.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
11.5. MS Windows security options and how to configure -Samba for seemless integration
11.5.1. Use MS Windows NT as an authentication server
11.5.2. Make Samba a member of an MS Windows NT security domain
11.5.3. Configure Samba as an authentication server
11.6. Conclusions
12. UNIX Permission Bits and Windows NT Access Control Lists
12.1. Viewing and changing UNIX permissions using the NT - security dialogs
12.2. How to view file security on a Samba share
12.3. Viewing file ownership
12.4. Viewing file or directory permissions
12.4.1. File Permissions
12.4.2. Directory Permissions
12.5. Modifying file or directory permissions
12.6. Interaction with the standard Samba create mask - parameters
12.7. Interaction with the standard Samba file attribute - mapping
13. Configuring PAM for distributed but centrally -managed authentication
13.1. Samba and PAM
13.2. Distributed Authentication
13.3. PAM Configuration in smb.conf
14. Hosting a Microsoft Distributed File System tree on Samba
14.1. Instructions
14.1.1. Notes
15. Printing Support
15.1. Introduction
15.2. Configuration
15.2.1. Creating [print$]
15.2.2. Setting Drivers for Existing Printers
15.2.3. Support a large number of printers
15.2.4. Adding New Printers via the Windows NT APW
15.2.5. Samba and Printer Ports
15.3. The Imprints Toolset
15.3.1. What is Imprints?
15.3.2. Creating Printer Driver Packages
15.3.3. The Imprints server
15.3.4. The Installation Client
15.4. Diagnosis
15.4.1. Introduction
15.4.2. Debugging printer problems
15.4.3. What printers do I have?
15.4.4. Setting up printcap and print servers
15.4.5. Job sent, no output
15.4.6. Job sent, strange output
15.4.7. Raw PostScript printed
15.4.8. Advanced Printing
15.4.9. Real debugging
16. Unified Logons between Windows NT and UNIX using Winbind
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.3.1. Target Uses
16.4. How Winbind Works
16.4.1. Microsoft Remote Procedure Calls
16.4.2. Name Service Switch
16.4.3. Pluggable Authentication Modules
16.4.4. User and Group ID Allocation
16.4.5. Result Caching
16.5. Installation and Configuration
16.5.1. Introduction
16.5.2. Requirements
16.5.3. Testing Things Out
16.6. Limitations
16.7. Conclusion
17. Passdb MySQL plugin
17.1. Building
17.2. Configuring
17.3. Using plaintext passwords or encrypted password
17.4. Getting non-column data from the table
18. Passdb XML plugin
18.1. Building
18.2. Usage
19. Stackable VFS modules
19.1. Introduction and configuration
19.2. Included modules
19.2.1. audit
19.2.2. recycle
19.2.3. netatalk
19.3. VFS modules available elsewhere
19.3.1. DatabaseFS
19.3.2. vscan
20. Storing Samba's User/Machine Account information in an LDAP Directory
20.1. Purpose
20.2. Introduction
20.3. Supported LDAP Servers
20.4. Schema and Relationship to the RFC 2307 posixAccount
20.5. Configuring Samba with LDAP
20.5.1. OpenLDAP configuration
20.5.2. Configuring Samba
20.6. Accounts and Groups management
20.7. Security and sambaAccount
20.8. LDAP specials attributes for sambaAccounts
20.9. Example LDIF Entries for a sambaAccount
20.10. Comments
21. HOWTO Access Samba source code via CVS
21.1. Introduction
21.2. CVS Access to samba.org
21.2.1. Access via CVSweb
21.2.2. Access via cvs
22. Group mapping HOWTO
23. Samba performance issues
23.1. Comparisons
23.2. Oplocks
23.2.1. Overview
23.2.2. Level2 Oplocks
23.2.3. Old 'fake oplocks' option - deprecated
23.3. Socket options
23.4. Read size
23.5. Max xmit
23.6. Locking
23.7. Share modes
23.8. Log level
23.9. Wide lines
23.10. Read raw
23.11. Write raw
23.12. Read prediction
23.13. Memory mapping
23.14. Slow Clients
23.15. Slow Logins
23.16. Client tuning
23.17. My Results
PrevHomeNext
Samba as a NT4 domain member Integrating MS Windows networks with Samba
\ No newline at end of file diff --git a/docs/htmldocs/p1346.html b/docs/htmldocs/p1346.html deleted file mode 100644 index e5585618005..00000000000 --- a/docs/htmldocs/p1346.html +++ /dev/null @@ -1,917 +0,0 @@ - -Optional configuration
SAMBA Project Documentation
PrevNext

III. Optional configuration

Introduction

Samba has several features that you might want or might not want to use. The chapters in this -part each cover one specific feature.

Table of Contents
10. Integrating MS Windows networks with Samba
10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.2.1. /etc/hosts
10.2.2. /etc/resolv.conf
10.2.3. /etc/host.conf
10.2.4. /etc/nsswitch.conf
10.3. Name resolution as used within MS Windows networking
10.3.1. The NetBIOS Name Cache
10.3.2. The LMHOSTS file
10.3.3. HOSTS file
10.3.4. DNS Lookup
10.3.5. WINS Lookup
10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
10.5. MS Windows security options and how to configure -Samba for seemless integration
10.5.1. Use MS Windows NT as an authentication server
10.5.2. Make Samba a member of an MS Windows NT security domain
10.5.3. Configure Samba as an authentication server
10.6. Conclusions
11. UNIX Permission Bits and Windows NT Access Control Lists
11.1. Viewing and changing UNIX permissions using the NT - security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.4.1. File Permissions
11.4.2. Directory Permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask - parameters
11.7. Interaction with the standard Samba file attribute - mapping
12. Configuring PAM for distributed but centrally -managed authentication
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13. Hosting a Microsoft Distributed File System tree on Samba
13.1. Instructions
13.1.1. Notes
14. Printing Support
14.1. Introduction
14.2. Configuration
14.2.1. Creating [print$]
14.2.2. Setting Drivers for Existing Printers
14.2.3. Support a large number of printers
14.2.4. Adding New Printers via the Windows NT APW
14.2.5. Samba and Printer Ports
14.3. The Imprints Toolset
14.3.1. What is Imprints?
14.3.2. Creating Printer Driver Packages
14.3.3. The Imprints server
14.3.4. The Installation Client
14.4. Diagnosis
14.4.1. Introduction
14.4.2. Debugging printer problems
14.4.3. What printers do I have?
14.4.4. Setting up printcap and print servers
14.4.5. Job sent, no output
14.4.6. Job sent, strange output
14.4.7. Raw PostScript printed
14.4.8. Advanced Printing
14.4.9. Real debugging
15. Security levels
15.1. Introduction
15.2. More complete description of security levels
16. Unified Logons between Windows NT and UNIX using Winbind
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.3.1. Target Uses
16.4. How Winbind Works
16.4.1. Microsoft Remote Procedure Calls
16.4.2. Name Service Switch
16.4.3. Pluggable Authentication Modules
16.4.4. User and Group ID Allocation
16.4.5. Result Caching
16.5. Installation and Configuration
16.5.1. Introduction
16.5.2. Requirements
16.5.3. Testing Things Out
16.6. Limitations
16.7. Conclusion
17. Passdb MySQL plugin
17.1. Building
17.2. Configuring
17.3. Using plaintext passwords or encrypted password
17.4. Getting non-column data from the table
18. Passdb XML plugin
18.1. Building
18.2. Usage
19. Storing Samba's User/Machine Account information in an LDAP Directory
19.1. Purpose
19.2. Introduction
19.3. Supported LDAP Servers
19.4. Schema and Relationship to the RFC 2307 posixAccount
19.5. Configuring Samba with LDAP
19.5.1. OpenLDAP configuration
19.5.2. Configuring Samba
19.6. Accounts and Groups management
19.7. Security and sambaAccount
19.8. LDAP specials attributes for sambaAccounts
19.9. Example LDIF Entries for a sambaAccount
19.10. Comments
20. HOWTO Access Samba source code via CVS
20.1. Introduction
20.2. CVS Access to samba.org
20.2.1. Access via CVSweb
20.2.2. Access via cvs
21. Group mapping HOWTO
22. Samba performance issues
22.1. Comparisons
22.2. Oplocks
22.2.1. Overview
22.2.2. Level2 Oplocks
22.2.3. Old 'fake oplocks' option - deprecated
22.3. Socket options
22.4. Read size
22.5. Max xmit
22.6. Locking
22.7. Share modes
22.8. Log level
22.9. Wide lines
22.10. Read raw
22.11. Write raw
22.12. Read prediction
22.13. Memory mapping
22.14. Slow Clients
22.15. Slow Logins
22.16. Client tuning
22.17. My Results
PrevHomeNext
Samba as a NT4 domain member Integrating MS Windows networks with Samba
\ No newline at end of file diff --git a/docs/htmldocs/p18.html b/docs/htmldocs/p18.html deleted file mode 100644 index a8f2a3c53c8..00000000000 --- a/docs/htmldocs/p18.html +++ /dev/null @@ -1,438 +0,0 @@ - -General installation
SAMBA Project Documentation
PrevNext

I. General installation

Introduction

This part contains general info on how to install samba -and how to configure the parts of samba you will most likely need. -PLEASE read this.

Table of Contents
1. How to Install and Test SAMBA
1.1. Read the man pages
1.2. Building the Binaries
1.3. The all important step
1.4. Create the smb configuration file.
1.5. Test your config file with - testparm
1.6. Starting the smbd and nmbd
1.6.1. Starting from inetd.conf
1.6.2. Alternative: starting it as a daemon
1.7. Try listing the shares available on your - server
1.8. Try connecting with the unix client
1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
1.10.1. Diagnosing Problems
1.10.2. Scope IDs
1.10.3. Choosing the Protocol Level
1.10.4. Printing from UNIX to a Client PC
1.10.5. Locking
1.10.6. Mapping Usernames
2. Improved browsing in samba
2.1. Overview of browsing
2.2. Browsing support in samba
2.3. Problem resolution
2.4. Browsing across subnets
2.4.1. How does cross subnet browsing work ?
2.5. Setting up a WINS server
2.6. Setting up Browsing in a WORKGROUP
2.7. Setting up Browsing in a DOMAIN
2.8. Forcing samba to be the master
2.9. Making samba the domain master
2.10. Note about broadcast addresses
2.11. Multiple interfaces
3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. Discussion
4.2. Use of the "Remote Announce" parameter
4.3. Use of the "Remote Browse Sync" parameter
4.4. Use of WINS
4.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. Name Resolution Order
5. LanMan and NT Password Encryption in Samba
5.1. Introduction
5.2. Important Notes About Security
5.2.1. Advantages of SMB Encryption
5.2.2. Advantages of non-encrypted passwords
5.3. The smbpasswd Command
PrevHomeNext
SAMBA Project Documentation How to Install and Test SAMBA
\ No newline at end of file diff --git a/docs/htmldocs/p3106.html b/docs/htmldocs/p3106.html deleted file mode 100644 index 9967d8fb594..00000000000 --- a/docs/htmldocs/p3106.html +++ /dev/null @@ -1,391 +0,0 @@ - -Appendixes
SAMBA Project Documentation
PrevNext

IV. Appendixes

Table of Contents
23. Portability
23.1. HPUX
23.2. SCO Unix
23.3. DNIX
23.4. RedHat Linux Rembrandt-II
24. Samba and other CIFS clients
24.1. Macintosh clients?
24.2. OS2 Client
24.2.1. How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
24.2.2. How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
24.2.3. Are there any other issues when OS/2 (any version) - is used as a client?
24.2.4. How do I get printer driver download working - for OS/2 clients?
24.3. Windows for Workgroups
24.3.1. Use latest TCP/IP stack from Microsoft
24.3.2. Delete .pwl files after password change
24.3.3. Configure WfW password handling
24.3.4. Case handling of passwords
24.4. Windows '95/'98
24.5. Windows 2000 Service Pack 2
25. Reporting Bugs
25.1. Introduction
25.2. General info
25.3. Debug levels
25.4. Internal errors
25.5. Attaching to a running process
25.6. Patches
26. Diagnosing your samba server
26.1. Introduction
26.2. Assumptions
26.3. Tests
26.3.1. Test 1
26.3.2. Test 2
26.3.3. Test 3
26.3.4. Test 4
26.3.5. Test 5
26.3.6. Test 6
26.3.7. Test 7
26.3.8. Test 8
26.3.9. Test 9
26.3.10. Test 10
26.3.11. Test 11
26.4. Still having troubles?
PrevHomeNext
Samba performance issues Portability
\ No newline at end of file diff --git a/docs/htmldocs/p544.html b/docs/htmldocs/p544.html deleted file mode 100644 index 502d978b5f8..00000000000 --- a/docs/htmldocs/p544.html +++ /dev/null @@ -1,388 +0,0 @@ - -Type of installation
SAMBA Project Documentation
PrevNext

II. Type of installation

Introduction

This part contains information on using samba in a (NT 4 or ADS) domain. -If you wish to run samba as a domain member or DC, read the appropriate chapter in -this part.

Table of Contents
6. How to Configure Samba as a NT4 Primary Domain Controller
6.1. Prerequisite Reading
6.2. Background
6.3. Configuring the Samba Domain Controller
6.4. Creating Machine Trust Accounts and Joining Clients to the -Domain
6.4.1. Manual Creation of Machine Trust Accounts
6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
6.4.3. Joining the Client to the Domain
6.5. Common Problems and Errors
6.6. System Policies and Profiles
6.7. What other help can I get?
6.8. Domain Control for Windows 9x/ME
6.8.1. Configuration Instructions: Network Logons
6.8.2. Configuration Instructions: Setting up Roaming User Profiles
6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
7.1. Prerequisite Reading
7.2. Background
7.3. What qualifies a Domain Controller on the network?
7.3.1. How does a Workstation find its domain controller?
7.3.2. When is the PDC needed?
7.4. Can Samba be a Backup Domain Controller?
7.5. How do I set up a Samba BDC?
7.5.1. How do I replicate the smbpasswd file?
8. Samba as a ADS domain member
8.1. Installing the required packages for Debian
8.2. Installing the required packages for RedHat
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.5.1. Possible errors
8.6. Test your server setup
8.7. Testing with smbclient
8.8. Notes
9. Samba as a NT4 domain member
9.1. Joining an NT Domain with Samba 2.2
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?
PrevHomeNext
LanMan and NT Password Encryption in Samba How to Configure Samba as a NT4 Primary Domain Controller
\ No newline at end of file diff --git a/docs/htmldocs/pdb-mysql.html b/docs/htmldocs/pdb-mysql.html deleted file mode 100644 index fc5dff85f50..00000000000 --- a/docs/htmldocs/pdb-mysql.html +++ /dev/null @@ -1,286 +0,0 @@ - -Passdb MySQL plugin
SAMBA Project Documentation
PrevNext

Chapter 17. Passdb MySQL plugin

17.1. Building

To build the plugin, run make bin/pdb_mysql.so -in the source/ directory of samba distribution.

Next, copy pdb_mysql.so to any location you want. I -strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/

17.2. Configuring

This plugin lacks some good documentation, but here is some short info:

Add a the following to the passdb backend variable in your smb.conf: -

passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]

The identifier can be any string you like, as long as it doesn't collide with -the identifiers of other plugins or other instances of pdb_mysql. If you -specify multiple pdb_mysql.so entries in 'passdb backend', you also need to -use different identifiers!

Additional options can be given thru the smb.conf file in the [global] section.

identifier:mysql host                     - host name, defaults to 'localhost'
-identifier:mysql password
-identifier:mysql user                     - defaults to 'samba'
-identifier:mysql database                 - defaults to 'samba'
-identifier:mysql port                     - defaults to 3306
-identifier:table                          - Name of the table containing users

Names of the columns in this table(I've added column types those columns should have first):

identifier:logon time column             - int(9)
-identifier:logoff time column            - int(9)
-identifier:kickoff time column           - int(9)
-identifier:pass last set time column     - int(9)
-identifier:pass can change time column   - int(9)
-identifier:pass must change time column  - int(9)
-identifier:username column               - varchar(255) - unix username
-identifier:domain column                 - varchar(255) - NT domain user is part of
-identifier:nt username column            - varchar(255) - NT username
-identifier:fullname column            - varchar(255) - Full name of user
-identifier:home dir column               - varchar(255) - Unix homedir path
-identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
-identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
-identifier:profile path column           - varchar(255) - Path of profile
-identifier:acct desc column              - varchar(255) - Some ASCII NT user data
-identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
-identifier:unknown string column         - varchar(255) - unknown string
-identifier:munged dial column            - varchar(255) - ?
-identifier:uid column                    - int(9) - Unix user ID (uid)
-identifier:gid column                    - int(9) - Unix user group (gid)
-identifier:user sid column               - varchar(255) - NT user SID
-identifier:group sid column              - varchar(255) - NT group ID
-identifier:lanman pass column            - varchar(255) - encrypted lanman password
-identifier:nt pass column                - varchar(255) - encrypted nt passwd
-identifier:plain pass column             - varchar(255) - plaintext password
-identifier:acct control column           - int(9) - nt user data
-identifier:unknown 3 column              - int(9) - unknown
-identifier:logon divs column             - int(9) - ?
-identifier:hours len column              - int(9) - ?
-identifier:unknown 5 column              - int(9) - unknown
-identifier:unknown 6 column              - int(9) - unknown

Eventually, you can put a colon (:) after the name of each column, which -should specify the column to update when updating the table. You can also -specify nothing behind the colon - then the data from the field will not be -updated.

17.3. Using plaintext passwords or encrypted password

I strongly discourage the use of plaintext passwords, however, you can use them:

If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords.

If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.

17.4. Getting non-column data from the table

It is possible to have not all data in the database and making some 'constant'.

For example, you can set 'identifier:fullname column' to : -CONCAT(First_name,' ',Sur_name)

Or, set 'identifier:workstations column' to : -NULL

See the MySQL documentation for more language constructs.

PrevHomeNext
Unified Logons between Windows NT and UNIX using WinbindUpPassdb XML plugin
\ No newline at end of file diff --git a/docs/htmldocs/pdb-xml.html b/docs/htmldocs/pdb-xml.html deleted file mode 100644 index 221e51d5b7b..00000000000 --- a/docs/htmldocs/pdb-xml.html +++ /dev/null @@ -1,189 +0,0 @@ - -Passdb XML plugin
SAMBA Project Documentation
PrevNext

Chapter 18. Passdb XML plugin

18.1. Building

This module requires libxml2 to be installed.

To build pdb_xml, run: make bin/pdb_xml.so in -the directory source/.

18.2. Usage

The usage of pdb_xml is pretty straightforward. To export data, use: - -pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filename - -(where filename is the name of the file to put the data in)

To import data, use: -pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdb - -Where filename is the name to read the data from and current-pdb to put it in.

PrevHomeNext
Passdb MySQL pluginUpStackable VFS modules
\ No newline at end of file diff --git a/docs/htmldocs/pwencrypt.html b/docs/htmldocs/pwencrypt.html deleted file mode 100644 index 0ce1bd037e4..00000000000 --- a/docs/htmldocs/pwencrypt.html +++ /dev/null @@ -1,445 +0,0 @@ - -LanMan and NT Password Encryption in Samba
SAMBA Project Documentation
PrevNext

Chapter 5. LanMan and NT Password Encryption in Samba

5.1. Introduction

Newer windows clients send encrypted passwords over - the wire, instead of plain text passwords. The newest clients - will only send encrypted passwords and refuse to send plain text - passwords, unless their registry is tweaked.

These passwords can't be converted to unix style encrypted - passwords. Because of that you can't use the standard unix - user database, and you have to store the Lanman and NT hashes - somewhere else. For more information, see the documentation - about the passdb backend = parameter. -

5.2. Important Notes About Security

The unix and SMB password encryption techniques seem similar - on the surface. This similarity is, however, only skin deep. The unix - scheme typically sends clear text passwords over the network when - logging in. This is bad. The SMB encryption scheme never sends the - cleartext password over the network but it does store the 16 byte - hashed values on disk. This is also bad. Why? Because the 16 byte hashed - values are a "password equivalent". You cannot derive the user's - password from them, but they could potentially be used in a modified - client to gain access to a server. This would require considerable - technical knowledge on behalf of the attacker but is perfectly possible. - You should thus treat the smbpasswd file as though it contained the - cleartext passwords of all your users. Its contents must be kept - secret, and the file should be protected accordingly.

Ideally we would like a password scheme which neither requires - plain text passwords on the net or on disk. Unfortunately this - is not available as Samba is stuck with being compatible with - other SMB systems (WinNT, WfWg, Win95 etc).

Note that Windows NT 4.0 Service pack 3 changed the - default for permissible authentication so that plaintext - passwords are never sent over the wire. - The solution to this is either to switch to encrypted passwords - with Samba or edit the Windows NT registry to re-enable plaintext - passwords. See the document WinNT.txt for details on how to do - this.

Other Microsoft operating systems which also exhibit - this behavior includes

  • MS DOS Network client 3.0 with - the basic network redirector installed

  • Windows 95 with the network redirector - update installed

  • Windows 98 [se]

  • Windows 2000

Note :All current release of - Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling - clear text authentication does not disable the ability - of the client to participate in encrypted authentication.

5.2.1. Advantages of SMB Encryption

  • plain text passwords are not passed across - the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.

  • WinNT doesn't like talking to a server - that isn't using SMB encrypted passwords. It will refuse - to browse the server if the server is also in user level - security mode. It will insist on prompting the user for the - password on each connection, which is very annoying. The - only things you can do to stop this is to use SMB encryption. -

5.2.2. Advantages of non-encrypted passwords

  • plain text passwords are not kept - on disk.

  • uses same password file as other unix - services such as login and ftp

  • you are probably already using other - services (such as telnet and ftp) which send plain text - passwords over the net, so sending them for SMB isn't - such a big deal.

5.3. The smbpasswd Command

The smbpasswd command maintains the two 32 byte password fields - in the smbpasswd file. If you wish to make it similar to the unix - passwd or yppasswd programs, - install it in /usr/local/samba/bin/ (or your - main Samba binary directory).

smbpasswd now works in a client-server mode - where it contacts the local smbd to change the user's password on its - behalf. This has enormous benefits - as follows.

smbpasswd now has the capability - to change passwords on Windows NT servers (this only works when - the request is sent to the NT Primary Domain Controller if you - are changing an NT Domain user's password).

To run smbpasswd as a normal user just type :

$ smbpasswd

Old SMB password: <type old value here - - or hit return if there was no old password>

New SMB Password: <type new value> -

Repeat New SMB Password: <re-type new value -

If the old value does not match the current value stored for - that user, or the two new values do not match each other, then the - password will not be changed.

If invoked by an ordinary user it will only allow the user - to change his or her own Samba password.

If run by the root user smbpasswd may take an optional - argument, specifying the user name whose SMB password you wish to - change. Note that when run as root smbpasswd does not prompt for - or check the old password value, thus allowing root to set passwords - for users who have forgotten their passwords.

smbpasswd is designed to work in the same way - and be familiar to UNIX users who use the passwd or - yppasswd commands.

For more details on using smbpasswd refer - to the man page which will always be the definitive reference.

PrevHomeNext
Quick Cross Subnet Browsing / Cross Workgroup Browsing guideUpType of installation
\ No newline at end of file diff --git a/docs/htmldocs/samba-howto-collection.html b/docs/htmldocs/samba-howto-collection.html deleted file mode 100644 index 3c789a7a456..00000000000 --- a/docs/htmldocs/samba-howto-collection.html +++ /dev/null @@ -1,1132 +0,0 @@ - -SAMBA Project Documentation

SAMBA Project Documentation

SAMBA Team

Abstract

Last Update : $Date: 2002/11/13 15:34:49 $

This book is a collection of HOWTOs added to Samba documentation over the years. -I try to ensure that all are current, but sometimes the is a larger job -than one person can maintain. The most recent version of this document -can be found at http://www.samba.org/ -on the "Documentation" page. Please send updates to jerry@samba.org or -jelmer@samba.org.

This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt

Cheers, jerry

Table of Contents
I. General installation
1. How to Install and Test SAMBA
1.1. Read the man pages
1.2. Building the Binaries
1.3. The all important step
1.4. Create the smb configuration file.
1.5. Test your config file with - testparm
1.6. Starting the smbd and nmbd
1.7. Try listing the shares available on your - server
1.8. Try connecting with the unix client
1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
2. Improved browsing in samba
2.1. Overview of browsing
2.2. Browsing support in samba
2.3. Problem resolution
2.4. Browsing across subnets
2.5. Setting up a WINS server
2.6. Setting up Browsing in a WORKGROUP
2.7. Setting up Browsing in a DOMAIN
2.8. Forcing samba to be the master
2.9. Making samba the domain master
2.10. Note about broadcast addresses
2.11. Multiple interfaces
3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. Discussion
4.2. Use of the "Remote Announce" parameter
4.3. Use of the "Remote Browse Sync" parameter
4.4. Use of WINS
4.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. Name Resolution Order
5. LanMan and NT Password Encryption in Samba
5.1. Introduction
5.2. Important Notes About Security
5.3. The smbpasswd Command
II. Type of installation
6. User and Share security level (for servers not in a domain)
7. How to Configure Samba as a NT4 Primary Domain Controller
7.1. Prerequisite Reading
7.2. Background
7.3. Configuring the Samba Domain Controller
7.4. Creating Machine Trust Accounts and Joining Clients to the -Domain
7.5. Common Problems and Errors
7.6. System Policies and Profiles
7.7. What other help can I get?
7.8. Domain Control for Windows 9x/ME
7.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
8. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
8.1. Prerequisite Reading
8.2. Background
8.3. What qualifies a Domain Controller on the network?
8.4. Can Samba be a Backup Domain Controller?
8.5. How do I set up a Samba BDC?
9. Samba as a ADS domain member
9.1. Installing the required packages for Debian
9.2. Installing the required packages for RedHat
9.3. Compile Samba
9.4. Setup your /etc/krb5.conf
9.5. Create the computer account
9.6. Test your server setup
9.7. Testing with smbclient
9.8. Notes
10. Samba as a NT4 domain member
10.1. Joining an NT Domain with Samba 2.2
10.2. Samba and Windows 2000 Domains
10.3. Why is this better than security = server?
III. Optional configuration
11. Integrating MS Windows networks with Samba
11.1. Agenda
11.2. Name Resolution in a pure Unix/Linux world
11.3. Name resolution as used within MS Windows networking
11.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
11.5. MS Windows security options and how to configure -Samba for seemless integration
11.6. Conclusions
12. UNIX Permission Bits and Windows NT Access Control Lists
12.1. Viewing and changing UNIX permissions using the NT - security dialogs
12.2. How to view file security on a Samba share
12.3. Viewing file ownership
12.4. Viewing file or directory permissions
12.5. Modifying file or directory permissions
12.6. Interaction with the standard Samba create mask - parameters
12.7. Interaction with the standard Samba file attribute - mapping
13. Configuring PAM for distributed but centrally -managed authentication
13.1. Samba and PAM
13.2. Distributed Authentication
13.3. PAM Configuration in smb.conf
14. Hosting a Microsoft Distributed File System tree on Samba
14.1. Instructions
15. Printing Support
15.1. Introduction
15.2. Configuration
15.3. The Imprints Toolset
15.4. Diagnosis
16. Unified Logons between Windows NT and UNIX using Winbind
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.4. How Winbind Works
16.5. Installation and Configuration
16.6. Limitations
16.7. Conclusion
17. Passdb MySQL plugin
17.1. Building
17.2. Configuring
17.3. Using plaintext passwords or encrypted password
17.4. Getting non-column data from the table
18. Passdb XML plugin
18.1. Building
18.2. Usage
19. Stackable VFS modules
19.1. Introduction and configuration
19.2. Included modules
19.3. VFS modules available elsewhere
20. Storing Samba's User/Machine Account information in an LDAP Directory
20.1. Purpose
20.2. Introduction
20.3. Supported LDAP Servers
20.4. Schema and Relationship to the RFC 2307 posixAccount
20.5. Configuring Samba with LDAP
20.6. Accounts and Groups management
20.7. Security and sambaAccount
20.8. LDAP specials attributes for sambaAccounts
20.9. Example LDIF Entries for a sambaAccount
20.10. Comments
21. HOWTO Access Samba source code via CVS
21.1. Introduction
21.2. CVS Access to samba.org
22. Group mapping HOWTO
23. Samba performance issues
23.1. Comparisons
23.2. Oplocks
23.3. Socket options
23.4. Read size
23.5. Max xmit
23.6. Locking
23.7. Share modes
23.8. Log level
23.9. Wide lines
23.10. Read raw
23.11. Write raw
23.12. Read prediction
23.13. Memory mapping
23.14. Slow Clients
23.15. Slow Logins
23.16. Client tuning
23.17. My Results
IV. Appendixes
24. Portability
24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
25. Samba and other CIFS clients
25.1. Macintosh clients?
25.2. OS2 Client
25.3. Windows for Workgroups
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26. Reporting Bugs
26.1. Introduction
26.2. General info
26.3. Debug levels
26.4. Internal errors
26.5. Attaching to a running process
26.6. Patches
27. Diagnosing your samba server
27.1. Introduction
27.2. Assumptions
27.3. Tests
27.4. Still having troubles?
  Next
  General installation
\ No newline at end of file diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html deleted file mode 100644 index daab00fba9f..00000000000 --- a/docs/htmldocs/samba-pdc.html +++ /dev/null @@ -1,2649 +0,0 @@ - -How to Configure Samba as a NT4 Primary Domain Controller
SAMBA Project Documentation
PrevNext

Chapter 7. How to Configure Samba as a NT4 Primary Domain Controller

7.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure -that you are comfortable with configuring basic files services -in smb.conf and how to enable and administer password -encryption in Samba. Theses two topics are covered in the -smb.conf(5) -manpage and the Encryption chapter -of this HOWTO Collection.

7.2. Background

Author's Note: This document is a combination -of David Bannon's "Samba 2.2 PDC HOWTO" and "Samba NT Domain FAQ". -Both documents are superseded by this one.

Versions of Samba prior to release 2.2 had marginal capabilities to act -as a Windows NT 4.0 Primary Domain Controller - -(PDC). With Samba 2.2.0, we are proud to announce official support for -Windows NT 4.0-style domain logons from Windows NT 4.0 and Windows -2000 clients. This article outlines the steps -necessary for configuring Samba as a PDC. It is necessary to have a -working Samba server prior to implementing the PDC functionality. If -you have not followed the steps outlined in UNIX_INSTALL.html, please make sure -that your server is configured correctly before proceeding. Another -good resource in the smb.conf(5) man -page. The following functionality should work in 2.2:

  • domain logons for Windows NT 4.0/2000 clients. -

  • placing a Windows 9x client in user level security -

  • retrieving a list of users and groups from a Samba PDC to - Windows 9x/NT/2000 clients -

  • roving (roaming) user profiles -

  • Windows NT 4.0-style system policies -

The following pieces of functionality are not included in the 2.2 release:

  • Windows NT 4 domain trusts -

  • SAM replication with Windows NT 4.0 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) -

  • Adding users via the User Manager for Domains -

  • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) -

Please note that Windows 9x clients are not true members of a domain -for reasons outlined in this article. Therefore the protocol for -support Windows 9x-style domain logons is completely different -from NT4 domain logons and has been officially supported for some -time.

Implementing a Samba PDC can basically be divided into 2 broad -steps.

  1. Configuring the Samba PDC -

  2. Creating machine trust accounts and joining clients - to the domain -

There are other minor details such as user profiles, system -policies, etc... However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking -concepts. They will be mentioned only briefly here.

7.3. Configuring the Samba Domain Controller

The first step in creating a working Samba PDC is to -understand the parameters necessary in smb.conf. I will not -attempt to re-explain the parameters here as they are more that -adequately covered in the smb.conf -man page. For convenience, the parameters have been -linked with the actual smb.conf description.

Here is an example smb.conf for acting as a PDC:

[global]
-    ; Basic server settings
-    netbios name = POGO
-    workgroup = NARNIA
-
-    ; we should act as the domain and local master browser
-    os level = 64
-    preferred master = yes
-    domain master = yes
-    local master = yes
-    
-    ; security settings (must user security = user)
-    security = user
-    
-    ; encrypted passwords are a requirement for a PDC
-    encrypt passwords = yes
-    
-    ; support domain logons
-    domain logons = yes
-    
-    ; where to store user profiles?
-    logon path = \\%N\profiles\%u
-    
-    ; where is a user's home directory and where should it
-    ; be mounted at?
-    logon drive = H:
-    logon home = \\homeserver\%u
-    
-    ; specify a generic logon script for all users
-    ; this is a relative **DOS** path to the [netlogon] share
-    logon script = logon.cmd
-
-; necessary share for domain controller
-[netlogon]
-    path = /usr/local/samba/lib/netlogon
-    read only = yes
-    write list = ntadmin
-    
-; share for storing user profiles
-[profiles]
-    path = /export/smb/ntprofile
-    read only = no
-    create mask = 0600
-    directory mask = 0700

There are a couple of points to emphasize in the above configuration.

  • Encrypted passwords must be enabled. For more details on how - to do this, refer to ENCRYPTION.html. -

  • The server must support domain logons and a - [netlogon] share -

  • The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. -

As Samba 2.2 does not offer a complete implementation of group mapping -between Windows NT groups and Unix groups (this is really quite -complicated to explain in a short space), you should refer to the -domain admin -group smb.conf parameter for information of creating "Domain -Admins" style accounts.

7.4. Creating Machine Trust Accounts and Joining Clients to the -Domain

A machine trust account is a Samba account that is used to -authenticate a client machine (rather than a user) to the Samba -server. In Windows terminology, this is known as a "Computer -Account."

The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security -feature to prevent an unauthorized machine with the same NetBIOS name -from joining the domain and gaining access to domain user/group -accounts. Windows NT and 2000 clients use machine trust accounts, but -Windows 9x clients do not. Hence, a Windows 9x client is never a true -member of a domain because it does not possess a machine trust -account, and thus has no shared secret with the domain controller.

A Windows PDC stores each machine trust account in the Windows -Registry. A Samba PDC, however, stores each machine trust account -in two parts, as follows: - -

  • A Samba account, stored in the same location as user - LanMan and NT password hashes (currently - smbpasswd). The Samba account - possesses and uses only the NT password hash.

  • A corresponding Unix account, typically stored in - /etc/passwd. (Future releases will alleviate the need to - create /etc/passwd entries.)

There are two ways to create machine trust accounts:

  • Manual creation. Both the Samba and corresponding - Unix account are created by hand.

  • "On-the-fly" creation. The Samba machine trust - account is automatically created by Samba at the time the client - is joined to the domain. (For security, this is the - recommended method.) The corresponding Unix account may be - created automatically or manually.

7.4.1. Manual Creation of Machine Trust Accounts

The first step in manually creating a machine trust account is to -manually create the corresponding Unix account in -/etc/passwd. This can be done using -vipw or other 'add user' command that is normally -used to create new Unix accounts. The following is an example for a -Linux based Samba server:

root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine -nickname" -s /bin/false machine_name$

root# passwd -l machine_name$

On *BSD systems, this can be done using the 'chpass' utility:

root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"

The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an -/etc/passwd entry like this:

doppy$:x:505:501:machine_nickname:/dev/null:/bin/false

Above, machine_nickname can be any -descriptive name for the client, i.e., BasementComputer. -machine_name absolutely must be the NetBIOS -name of the client to be joined to the domain. The "$" must be -appended to the NetBIOS name of the client or Samba will not recognize -this as a machine trust account.

Now that the corresponding Unix account has been created, the next step is to create -the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command -as shown here:

root# smbpasswd -a -m machine_name

where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of -the corresponding Unix account.

Join the client to the domain immediately
 

Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - the "Server Manager". From the time at which the account is created - to the time which the client joins the domain and changes the password, - your domain is vulnerable to an intruder joining your domain using a - a machine with the same NetBIOS name. A PDC inherently trusts - members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

7.4.2. "On-the-Fly" Creation of Machine Trust Accounts

The second (and recommended) way of creating machine trust accounts is -simply to allow the Samba server to create them as needed when the client -is joined to the domain.

Since each Samba machine trust account requires a corresponding -Unix account, a method for automatically creating the -Unix account is usually supplied; this requires configuration of the -add user script -option in smb.conf. This -method is not required, however; corresponding Unix accounts may also -be created manually.

Below is an example for a RedHat 6.2 Linux system.

[global]
-   # <...remainder of parameters...>
-   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

7.4.3. Joining the Client to the Domain

The procedure for joining a client to the domain varies with the -version of Windows.

  • Windows 2000

    When the user elects to join the client to a domain, Windows prompts for - an account and password that is privileged to join the domain. A - Samba administrative account (i.e., a Samba account that has root - privileges on the Samba server) must be entered here; the - operation will fail if an ordinary user account is given. - The password for this account should be - set to a different password than the associated - /etc/passwd entry, for security - reasons.

    The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists.

  • Windows NT

    If the machine trust account was created manually, on the - Identification Changes menu enter the domain name, but do not - check the box "Create a Computer Account in the Domain." In this case, - the existing machine trust account is used to join the machine to - the domain.

    If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box "Create a Computer Account in the Domain." In - this case, joining the domain proceeds as above for Windows 2000 - (i.e., you must supply a Samba administrative account when - prompted).

7.5. Common Problems and Errors

  • I cannot include a '$' in a machine name. -

    A 'machine name' in (typically) /etc/passwd - of the machine name with a '$' appended. FreeBSD (and other BSD - systems?) won't create a user with a '$' in their name. -

    The problem is only in the program used to make the entry, once - made, it works perfectly. So create a user without the '$' and - use vipw to edit the entry, adding the '$'. Or create - the whole entry with vipw if you like, make sure you use a - unique User ID ! -

  • I get told "You already have a connection to the Domain...." - or "Cannot join domain, the credentials supplied conflict with an - existing set.." when creating a machine trust account. -

    This happens if you try to create a machine trust account from the - machine itself and already have a connection (e.g. mapped drive) - to a share (or IPC$) on the Samba PDC. The following command - will remove all network drive connections: -

    C:\WINNT\> net use * /d -

    Further, if the machine is a already a 'member of a workgroup' that - is the same name as the domain you are joining (bad idea) you will - get this message. Change the workgroup name to something else, it - does not matter what, reboot, and try again. -

  • The system can not log you on (C000019B).... -

    I joined the domain successfully but after upgrading - to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your - system administrator" when attempting to logon. -

    This occurs when the domain SID stored in - private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. -

  • The machine trust account for this computer either does not - exist or is not accessible. -

    When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessible". What's - wrong? -

    This problem is caused by the PDC not having a suitable machine trust account. - If you are using the add user script method to create - accounts then this would indicate that it has not worked. Ensure the domain - admin user system is working. -

    Alternatively if you are creating account entries manually then they - have not been created correctly. Make sure that you have the entry - correct for the machine trust account in smbpasswd file on the Samba PDC. - If you added the account using an editor rather than using the smbpasswd - utility, make sure that the account name is the machine NetBIOS name - with a '$' appended to it ( i.e. computer_name$ ). There must be an entry - in both /etc/passwd and the smbpasswd file. Some people have reported - that inconsistent subnet masks between the Samba server and the NT - client have caused this problem. Make sure that these are consistent - for both client and server. -

  • When I attempt to login to a Samba Domain from a NT4/W2K workstation, - I get a message about my account being disabled. -

    This problem is caused by a PAM related bug in Samba 2.2.0. This bug is - fixed in 2.2.1. Other symptoms could be unaccessible shares on - NT/W2K member servers in the domain or the following error in your smbd.log: - passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user% -

    At first be ensure to enable the useraccounts with smbpasswd -e - %user%, this is normally done, when you create an account. -

    In order to work around this problem in 2.2.0, configure the - account control flag in - /etc/pam.d/samba file as follows: - 

    	account required        pam_permit.so
-

    If you want to remain backward compatibility to samba 2.0.x use - pam_permit.so, it's also possible to use - pam_pwdb.so. There are some bugs if you try to - use pam_unix.so, if you need this, be ensure to use - the most recent version of this file. -

7.6. System Policies and Profiles

Much of the information necessary to implement System Policies and -Roving User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft.

Here are some additional details:

  • What about Windows NT Policy Editor? -

    To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -

    The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -

  • Can Win95 do Policies? -

    Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -

    If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -

  • How do I get 'User Manager' and 'Server Manager' -

    Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? -

    Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes -

    • Server Manager

    • User Manager for Domains

    • Event Viewer

    Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

    The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

7.7. What other help can I get?

There are many sources of information available in the form -of mailing lists, RFC's and documentation. The docs that come -with the samba distribution contain very good explanations of -general SMB topics such as browsing.

  • What are some diagnostics tools I can use to debug the domain logon - process and where can I find them? -

    One of the best diagnostic tools for debugging problems is Samba itself. - You can use the -d option for both smbd and nmbd to specify what - 'debug level' at which to run. See the man pages on smbd, nmbd and - smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to 10 (100 for debugging passwords). -

    Another helpful method of debugging is to compile samba using the - gcc -g flag. This will include debug - information in the binaries and allow you to attach gdb to the - running smbd / nmbd process. In order to attach gdb to an smbd - process for an NT workstation, first get the workstation to make the - connection. Pressing ctrl-alt-delete and going down to the domain box - is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation - maintains an open connection, and therefore there will be an smbd - process running (assuming that you haven't set a really short smbd - idle timeout) So, in between pressing ctrl alt delete, and actually - typing in your password, you can gdb attach and continue. -

    Some useful samba commands worth investigating: -

    • testparam | more

    • smbclient -L //{netbios name of server}

    An SMB enabled version of tcpdump is available from - http://www.tcpdup.org/. - Ethereal, another good packet sniffer for Unix and Win32 - hosts, can be downloaded from http://www.ethereal.com. -

    For tracing things on the Microsoft Windows NT, Network Monitor - (aka. netmon) is available on the Microsoft Developer Network CD's, - the Windows NT Server install CD and the SMS CD's. The version of - netmon that ships with SMS allows for dumping packets between any two - computers (i.e. placing the network interface in promiscuous mode). - The version on the NT Server install CD will only allow monitoring - of network traffic directed to the local NT box and broadcasts on the - local subnet. Be aware that Ethereal can read and write netmon - formatted files. -

  • How do I install 'Network Monitor' on an NT Workstation - or a Windows 9x box? -

    Installing netmon on an NT workstation requires a couple - of steps. The following are for installing Netmon V4.00.349, which comes - with Microsoft Windows NT Server 4.0, on Microsoft Windows NT - Workstation 4.0. The process should be similar for other version of - Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. -

    Initially you will need to install 'Network Monitor Tools and Agent' - on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Tools and Agent' and - click on 'OK'.

    • Click 'OK' on the Network Control Panel. -

    • Insert the Windows NT Server 4.0 install CD - when prompted.

    At this point the Netmon files should exist in - %SYSTEMROOT%\System32\netmon\*.*. - Two subdirectories exist as well, parsers\ - which contains the necessary DLL's for parsing the netmon packet - dump, and captures\. -

    In order to install the Netmon tools on an NT Workstation, you will - first need to install the 'Network Monitor Agent' from the Workstation - install CD. -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Agent' and click - on 'OK'.

    • Click 'OK' on the Network Control Panel. -

    • Insert the Windows NT Workstation 4.0 install - CD when prompted.

    Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* - to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set - permissions as you deem appropriate for your site. You will need - administrative rights on the NT box to run netmon. -

    To install Netmon on a Windows 9x box install the network monitor agent - from the Windows 9x CD (\admin\nettools\netmon). There is a readme - file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working - Netmon installation. -

  • The following is a list if helpful URLs and other links: -

  • How do I get help from the mailing lists? -

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror - and then click on Support and then click on Samba related mailing lists. -

    For questions relating to Samba TNG go to - http://www.samba-tng.org/ - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists.

    If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. -

    • Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support.

    • In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out.

    • Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html).

    • If you run one of those nifty 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. -

    • Don't cross post. Work out which is the best list to post to - and see what happens, i.e. don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you.

    • You might include partial - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages.

    • (Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory?

  • How do I get off the mailing lists? -

    To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to http://lists.samba.org, - click on your nearest mirror and then click on Support and - then click on Samba related mailing lists. Or perhaps see - here -

    Please don't post messages to the list asking to be removed, you will just - be referred to the above address (unless that process failed in some way...) -

7.8. Domain Control for Windows 9x/ME

The following section contains much of the original -DOMAIN.txt file previously included with Samba. Much of -the material is based on what went into the book Special -Edition, Using Samba, by Richard Sharpe.

A domain and a workgroup are exactly the same thing in terms of network -browsing. The difference is that a distributable authentication -database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they -successfully authenticate against a domain logon server (NT server and -other systems based on NT server support this, as does at least Samba TNG now).

The SMB client logging on to a domain has an expectation that every other -server in the domain should accept the same authentication information. -Network browsing functionality of domains and workgroups is -identical and is explained in BROWSING.txt. It should be noted, that browsing -is totally orthogonal to logon support.

Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients -which will be the focus of this section.

When an SMB client in a domain wishes to logon it broadcast requests for a -logon server. The first one to reply gets the job, and validates its -password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This -demonstrates how authentication is quite different from but closely -involved with domains.

Using these features you can make your clients verify their logon via -the Samba server; make clients run a batch file when they logon to -the network and download their preferences, desktop and start menu.

Before launching into the configuration instructions, it is -worthwhile lookingat how a Windows 9x/ME client performs a logon:

  1. The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the - NetBIOS layer. The client chooses the first response it receives, which - contains the NetBIOS name of the logon server to use in the format of - \\SERVER. -

  2. The client then connects to that server, logs on (does an SMBsessetupX) and - then connects to the IPC$ share (using an SMBtconX). -

  3. The client then does a NetWkstaUserLogon request, which retrieves the name - of the user's logon script. -

  4. The client then connects to the NetLogon share and searches for this - and if it is found and can be read, is retrieved and executed by the client. - After this, the client disconnects from the NetLogon share. -

  5. The client then sends a NetUserGetInfo request to the server, to retrieve - the user's home share, which is used to search for profiles. Since the - response to the NetUserGetInfo request does not contain much more - the user's home share, profiles for Win9X clients MUST reside in the user - home directory. -

  6. The client then connects to the user's home share and searches for the - user's profile. As it turns out, you can specify the user's home share as - a sharename and path. For example, \\server\fred\.profile. - If the profiles are found, they are implemented. -

  7. The client then disconnects from the user's home share, and reconnects to - the NetLogon share and looks for CONFIG.POL, the policies file. If this is - found, it is read and implemented. -

7.8.1. Configuration Instructions: Network Logons

The main difference between a PDC and a Windows 9x logon -server configuration is that

  • Password encryption is not required for a Windows 9x logon server.

  • Windows 9x/ME clients do not possess machine trust accounts.

Therefore, a Samba PDC will also act as a Windows 9x logon -server.

security mode and master browsers
 

There are a few comments to make in order to tie up some -loose ends. There has been much debate over the issue of whether -or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security is really just a variation on SMB user level security.

Actually, this issue is also closely tied to the debate on whether -or not Samba must be the domain master browser for its workgroup -when operating as a DC. While it may technically be possible -to configure a server as such (after all, browsing and domain logons -are two distinctly different functions), it is not a good idea to -so. You should remember that the DC must register the DOMAIN#1b NetBIOS -name. This is the name used by Windows clients to locate the DC. -Windows clients do not distinguish between the DC and the DMB. -For this reason, it is very wise to configure the Samba DC as the DMB.

Now back to the issue of configuring a Samba DC to use a mode other -than "security = user". If a Samba host is configured to use -another SMB server or DC in order to validate user connection -requests, then it is a fact that some other machine on the network -(the "password server") knows more about user than the Samba host. -99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the "workgroup" parameter -must be set to the name of the Windows NT domain (which already -has a domain controller, right?)

Therefore configuring a Samba box as a DC for a domain that -already by definition has a PDC is asking for trouble. -Therefore, you should always configure the Samba DC to be the DMB -for its domain.

7.8.2. Configuration Instructions: Setting up Roaming User Profiles

NOTE! Roaming profiles support is different -for Win9X and WinNT.

Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features.

Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory.

WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT.

7.8.2.1. Windows NT Configuration

To support WinNT clients, in the [global] section of smb.conf set the -following (for example):

logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable.

[lkcl 26aug96 - we have discovered a problem where Windows clients can -maintain a connection to the [homes] share in between logins. The -[homes] share must NOT therefore be used in a profile path.]

7.8.2.2. Windows 9X Configuration

To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use/home" now works as well, and it, too, relies -on the "logon home" parameter.

By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file:

logon home = \\%L\%U\.profiles

then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home".

7.8.2.3. Win9X and WinNT Configuration

You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example:

logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U

I have not checked what 'net use /home' does on NT when "logon home" is -set as above.

7.8.2.4. Windows 9X Profile Setup

When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

  1. On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

  2. On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me.

You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

  1. instead of logging in under the [user, password, domain] dialog, - press escape. -

  2. run the regedit.exe program, and look in: -

    HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

    you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

    [Exit the registry editor]. -

  3. WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). -

    This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

  4. search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

  5. log off the windows 95 client. -

  6. check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports.

If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace.

7.8.2.5. Windows NT Workstation 4.0

When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

[lkcl 10aug97 - i tried setting the path to -\\samba-server\homes\profile, and discovered that this fails because -a background process maintains the connection to the [homes] share -which does _not_ close down in between user logins. you have to -have \\samba-server\%L\profile, where user is the username created -from the [homes] share].

There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter.

The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension) -[lkcl 10aug97 - i found that the creation of the .PDS directory failed, -and had to create these manually for each user, with a shell script. -also, i presume, but have not tested, that the full profile path must -be browseable just as it is for w95, due to the manner in which they -attempt to create the full profile path: test existence of each path -component; create path component].

In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

[lkcl 10aug97 - i notice that NT Workstation tells me that it is -downloading a profile from a slow link. whether this is actually the -case, or whether there is some configuration issue, as yet unknown, -that makes NT Workstation _think_ that the link is a slow one is a -matter to be resolved].

[lkcl 20aug97 - after samba digest correspondence, one user found, and -another confirmed, that profiles cannot be loaded from a samba server -unless "security = user" and "encrypt passwords = yes" (see the file -ENCRYPTION.txt) or "security = server" and "password server = ip.address. -of.yourNTserver" are used. Either of these options will allow the NT -workstation to access the samba server using LAN manager encrypted -passwords, without the user intervention normally required by NT -workstation for clear-text passwords].

[lkcl 25aug97 - more comments received about NT profiles: the case of -the profile _matters_. the file _must_ be called NTuser.DAT or, for -a mandatory profile, NTuser.MAN].

7.8.2.6. Windows NT Server

There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

7.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

Potentially outdated or incorrect material follows
 

I think this is all bogus, but have not deleted it. (Richard Sharpe)

The default logon path is \\%N\%U. NT Workstation will attempt to create -a directory "\\samba-server\username.PDS" if you specify the logon path -as "\\samba-server\username" with the NT User Manager. Therefore, you -will need to specify (for example) "\\samba-server\username\profile". -NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which -is more likely to succeed.

If you then want to share the same Start Menu / Desktop with W95, you will -need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97 -this has its drawbacks: i created a shortcut to telnet.exe, which attempts -to run from the c:\winnt\system32 directory. this directory is obviously -unlikely to exist on a Win95-only host].

If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

[lkcl 25aug97 - there are some issues to resolve with downloading of -NT profiles, probably to do with time/date stamps. i have found that -NTuser.DAT is never updated on the workstation after the first time that -it is copied to the local workstation profile directory. this is in -contrast to w95, where it _does_ transfer / update profiles correctly].

7.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

Possibly Outdated Material
 

This appendix was originally authored by John H Terpstra of - the Samba Team and is included here for posterity. -

NOTE : -The term "Domain Controller" and those related to it refer to one specific -method of authentication that can underly an SMB domain. Domain Controllers -prior to Windows NT Server 3.1 were sold by various companies and based on -private extensions to the LAN Manager 2.1 protocol. Windows NT introduced -Microsoft-specific ways of distributing the user authentication database. -See DOMAIN.txt for examples of how Samba can participate in or create -SMB domains based on shared authentication database schemes other than the -Windows NT SAM.

Windows NT Server can be installed as either a plain file and print server -(WORKGROUP workstation or server) or as a server that participates in Domain -Control (DOMAIN member, Primary Domain controller or Backup Domain controller). -The same is true for OS/2 Warp Server, Digital Pathworks and other similar -products, all of which can participate in Domain Control along with Windows NT.

To many people these terms can be confusing, so let's try to clear the air.

Every Windows NT system (workstation or server) has a registry database. -The registry contains entries that describe the initialization information -for all services (the equivalent of Unix Daemons) that run within the Windows -NT environment. The registry also contains entries that tell application -software where to find dynamically loadable libraries that they depend upon. -In fact, the registry contains entries that describes everything that anything -may need to know to interact with the rest of the system.

The registry files can be located on any Windows NT machine by opening a -command prompt and typing:

C:\WINNT\> dir %SystemRoot%\System32\config

The environment variable %SystemRoot% value can be obtained by typing:

C:\WINNT>echo %SystemRoot%

The active parts of the registry that you may want to be familiar with are -the files called: default, system, software, sam and security.

In a domain environment, Microsoft Windows NT domain controllers participate -in replication of the SAM and SECURITY files so that all controllers within -the domain have an exactly identical copy of each.

The Microsoft Windows NT system is structured within a security model that -says that all applications and services must authenticate themselves before -they can obtain permission from the security manager to do what they set out -to do.

The Windows NT User database also resides within the registry. This part of -the registry contains the user's security identifier, home directory, group -memberships, desktop profile, and so on.

Every Windows NT system (workstation as well as server) will have its own -registry. Windows NT Servers that participate in Domain Security control -have a database that they share in common - thus they do NOT own an -independent full registry database of their own, as do Workstations and -plain Servers.

The User database is called the SAM (Security Access Manager) database and -is used for all user authentication as well as for authentication of inter- -process authentication (i.e. to ensure that the service action a user has -requested is permitted within the limits of that user's privileges).

The Samba team have produced a utility that can dump the Windows NT SAM into -smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and -/pub/samba/pwdump on your nearest Samba mirror for the utility. This -facility is useful but cannot be easily used to implement SAM replication -to Samba systems.

Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers -can participate in a Domain security system that is controlled by Windows NT -servers that have been correctly configured. Almost every domain will have -ONE Primary Domain Controller (PDC). It is desirable that each domain will -have at least one Backup Domain Controller (BDC).

The PDC and BDCs then participate in replication of the SAM database so that -each Domain Controlling participant will have an up to date SAM component -within its registry.

PrevHomeNext
User and Share security level (for servers not in a domain)UpHow to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
\ No newline at end of file diff --git a/docs/htmldocs/type.html b/docs/htmldocs/type.html deleted file mode 100644 index ec6aa6df6c3..00000000000 --- a/docs/htmldocs/type.html +++ /dev/null @@ -1,392 +0,0 @@ - -Type of installation
SAMBA Project Documentation
PrevNext

II. Type of installation

Introduction

Samba can operate in various SMB networks. This part contains information on configuring samba -for various environments.

Table of Contents
6. User and Share security level (for servers not in a domain)
7. How to Configure Samba as a NT4 Primary Domain Controller
7.1. Prerequisite Reading
7.2. Background
7.3. Configuring the Samba Domain Controller
7.4. Creating Machine Trust Accounts and Joining Clients to the -Domain
7.4.1. Manual Creation of Machine Trust Accounts
7.4.2. "On-the-Fly" Creation of Machine Trust Accounts
7.4.3. Joining the Client to the Domain
7.5. Common Problems and Errors
7.6. System Policies and Profiles
7.7. What other help can I get?
7.8. Domain Control for Windows 9x/ME
7.8.1. Configuration Instructions: Network Logons
7.8.2. Configuration Instructions: Setting up Roaming User Profiles
7.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
8. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
8.1. Prerequisite Reading
8.2. Background
8.3. What qualifies a Domain Controller on the network?
8.3.1. How does a Workstation find its domain controller?
8.3.2. When is the PDC needed?
8.4. Can Samba be a Backup Domain Controller?
8.5. How do I set up a Samba BDC?
8.5.1. How do I replicate the smbpasswd file?
9. Samba as a ADS domain member
9.1. Installing the required packages for Debian
9.2. Installing the required packages for RedHat
9.3. Compile Samba
9.4. Setup your /etc/krb5.conf
9.5. Create the computer account
9.5.1. Possible errors
9.6. Test your server setup
9.7. Testing with smbclient
9.8. Notes
10. Samba as a NT4 domain member
10.1. Joining an NT Domain with Samba 2.2
10.2. Samba and Windows 2000 Domains
10.3. Why is this better than security = server?
PrevHomeNext
LanMan and NT Password Encryption in Samba User and Share security level (for servers not in a domain)
\ No newline at end of file diff --git a/docs/htmldocs/vfs.html b/docs/htmldocs/vfs.html deleted file mode 100644 index fb0554e10cd..00000000000 --- a/docs/htmldocs/vfs.html +++ /dev/null @@ -1,403 +0,0 @@ - -Stackable VFS modules
SAMBA Project Documentation
PrevNext

Chapter 19. Stackable VFS modules

19.1. Introduction and configuration

Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to -some external modules.

You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -I currently tested them against GNU/linux and IRIX.

To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs object parameter which must point to -the exact pathname of the shared library object. For example, to use audit.so: - -

       [audit]
-                comment = Audited /data directory
-                path = /data
-                vfs object = /path/to/audit.so
-                writeable = yes
-                browseable = yes

Further documentation on writing VFS modules for Samba can be found in -docs directory of the Samba source distribution.

19.2. Included modules

19.2.1. audit

A simple module to audit file access to the syslog -facility. The following operations are logged: -

share
connect/disconnect
directory opens/create/remove
file open/close/rename/unlink/chmod

19.2.2. recycle

A recycle-bin like modules. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of beeing deleted.

Supported options: -

vfs_recycle_bin:repository

FIXME

vfs_recycle_bin:keeptree

FIXME

vfs_recycle_bin:versions

FIXME

vfs_recycle_bin:touch

FIXME

vfs_recycle_bin:maxsize

FIXME

vfs_recycle_bin:exclude

FIXME

vfs_recycle_bin:exclude_dir

FIXME

vfs_recycle_bin:noversions

FIXME

19.2.3. netatalk

A netatalk module, that will ease co-existence of samba and -netatalk file sharing services.

Advantages compared to the old netatalk module: -

it doesn't care about creating of .AppleDouble forks, just keeps ones in sync
if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

19.3. VFS modules available elsewhere

This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason ot another (e.g. it is easy for the maintainer -to have his or her own CVS tree).

No statemets about the stability or functionality any module -should be implied due to its presence here.

19.3.1. DatabaseFS

URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

By Eric Lorimer.

I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run.

Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem.

19.3.2. vscan

URL: http://www.openantivirus.org/

samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link.

PrevHomeNext
Passdb XML pluginUpStoring Samba's User/Machine Account information in an LDAP Directory
\ No newline at end of file diff --git a/packaging/Mandrake/samba-3.0-smbmount-sbin.patch b/packaging/Mandrake/samba-3.0-smbmount-sbin.patch deleted file mode 100644 index 586fb3cff9c..00000000000 --- a/packaging/Mandrake/samba-3.0-smbmount-sbin.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- samba-3.0alpha1/source/client/smbmount.c.orig Fri Nov 30 02:29:22 2001 -+++ samba-3.0alpha1/source/client/smbmount.c Thu Dec 6 00:48:57 2001 -@@ -468,7 +468,7 @@ - if (sys_fork() == 0) { - char *smbmnt_path; - -- asprintf(&smbmnt_path, "%s/smbmnt", dyn_BINDIR); -+ asprintf(&smbmnt_path, "%s/smbmnt", dyn_SBINDIR); - - if (file_exist(smbmnt_path, NULL)) { - execv(smbmnt_path, args); diff --git a/source/include/libsmb_internal.h b/source/include/libsmb_internal.h deleted file mode 100644 index 21fe47d4b29..00000000000 --- a/source/include/libsmb_internal.h +++ /dev/null @@ -1,67 +0,0 @@ -#ifndef _LIBSMB_INTERNAL_H_ -#define _LIBSMB_INTERNAL_H_ - -#define SMBC_MAX_NAME 1023 -#define SMBC_FILE_MODE (S_IFREG | 0444) -#define SMBC_DIR_MODE (S_IFDIR | 0555) - - -#include "../include/libsmbclient.h" - - -struct _SMBCSRV { - struct cli_state cli; - dev_t dev; - BOOL no_pathinfo2; - int server_fd; - - SMBCSRV *next, *prev; - -}; - -/* - * Keep directory entries in a list - */ -struct smbc_dir_list { - struct smbc_dir_list *next; - struct smbc_dirent *dirent; -}; - - -/* - * Structure for open file management - */ -struct _SMBCFILE { - int cli_fd; - char *fname; - off_t offset; - struct _SMBCSRV *srv; - BOOL file; - struct smbc_dir_list *dir_list, *dir_end, *dir_next; - int dir_type, dir_error; - - SMBCFILE *next, *prev; -}; - - -struct smbc_internal_data { - - /** INTERNAL: is this handle initialized ? - */ - int _initialized; - - /** INTERNAL: dirent pointer location - */ - char _dirent[512]; - - /** INTERNAL: server connection list - */ - SMBCSRV * _servers; - - /** INTERNAL: open file/dir list - */ - SMBCFILE * _files; -}; - - -#endif diff --git a/source/libsmb/trustdom_cache.c b/source/libsmb/trustdom_cache.c deleted file mode 100644 index cddbb2daa61..00000000000 --- a/source/libsmb/trustdom_cache.c +++ /dev/null @@ -1,215 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Trusted domain names cache on top of gencache. - - Copyright (C) Rafal Szczesniak 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_ALL /* there's no proper class yet */ - -#define TDOMKEY_FMT "TDOM/%s" - - -/** - * @file trustdom_cache.c - * - * Implementation of trusted domain names cache useful when - * samba acts as domain member server. In such case, caching - * domain names currently trusted gives a performance gain - * because there's no need to query PDC each time we need - * list of trusted domains - **/ - - -/** - * Initialise trustdom name caching system. Call gencache - * initialisation routine to perform necessary activities. - * - * @return true upon successful cache initialisation or - * false if cache init failed - **/ - -BOOL trustdom_cache_enable(void) -{ - /* Init trustdom cache by calling gencache initialisation */ - if (!gencache_init()) { - DEBUG(2, ("trustdomcache_enable: Couldn't initialise trustdom cache on top of gencache.\n")); - return False; - } - - return True; -} - - -/** - * Shutdown trustdom name caching system. Calls gencache - * shutdown function. - * - * @return true upon successful cache close or - * false if it failed - **/ - -BOOL trustdom_cache_shutdown(void) -{ - /* Close trustdom cache by calling gencache shutdown */ - if (!gencache_shutdown()) { - DEBUG(2, ("trustdomcache_shutdown: Couldn't shutdown trustdom cache on top of gencache.\n")); - return False; - } - - return True; -} - - -/** - * Form up trustdom name key. It is based only - * on domain name now. - * - * @param name trusted domain name - * @return cache key for use in gencache mechanism - **/ - -static char* trustdom_cache_key(const char* name) -{ - char* keystr; - asprintf(&keystr, TDOMKEY_FMT, strupper_static(name)); - - return keystr; -} - - -/** - * Store trusted domain in gencache as the domain name (key) - * and ip address of domain controller (value) - * - * @param name trusted domain name - * @param alt_name alternative trusted domain name (used in ADS domains) - * @param sid trusted domain's SID - * @param timeout cache entry expiration time - * @return true upon successful value storing or - * false if store attempt failed - **/ - -BOOL trustdom_cache_store(char* name, char* alt_name, const DOM_SID *sid, - time_t timeout) -{ - char *key, *alt_key; - fstring sid_string; - - /* - * we use gecache call to avoid annoying debug messages - * about initialised trustdom - */ - if (!gencache_init()) return False; - - DEBUG(5, ("trustdom_store: storing SID %s of domain %s\n", - sid_string_static(sid), name)); - - key = trustdom_cache_key(name); - alt_key = alt_name ? trustdom_cache_key(alt_name) : NULL; - - /* Generate string representation domain SID */ - sid_to_string(sid_string, sid); - - /* - * try to put the names in the cache - */ - if (alt_key) { - return (gencache_set(alt_key, sid_string, timeout) - && gencache_set(key, sid_string, timeout)); - } - - return gencache_set(key, sid_string, timeout); -} - - -/** - * Fetch trusted domain's dc from the gencache. - * This routine can also be used to check whether given - * domain is currently trusted one. - * - * @param name trusted domain name - * @param sid trusted domain's SID to be returned - * @return true if entry is found or - * false if has expired/doesn't exist - **/ - -BOOL trustdom_cache_fetch(const char* name, DOM_SID* sid) -{ - char *key, *value; - time_t timeout; - - /* init the cache */ - if (!gencache_init()) return False; - - /* exit now if null pointers were passed as they're required further */ - if (!sid) return False; - - /* prepare a key and get the value */ - key = trustdom_cache_key(name); - - if (!gencache_get(key, &value, &timeout)) { - DEBUG(5, ("no entry for trusted domain %s found.\n", name)); - return False; - } else { - DEBUG(5, ("trusted domain %s found (%s)\n", name, value)); - } - - /* convert ip string representation into in_addr structure */ - if(! string_to_sid(sid, value)) { - sid = NULL; - return False; - } - - return True; -} - - -/** - * Delete single trustdom entry. Look at the - * gencache_iterate definition. - * - **/ - -static void flush_trustdom_name(const char* key, const char *value, time_t timeout, void* dptr) -{ - gencache_del(key); - DEBUG(5, ("Deleting entry %s\n", key)); -} - - -/** - * Flush all the trusted domains entries from the cache. - **/ - -void trustdom_cache_flush(void) -{ - if (!gencache_init()) - return; - - /* - * iterate through each TDOM cache's entry and flush it - * by flush_trustdom_name function - */ - gencache_iterate(flush_trustdom_name, NULL, trustdom_cache_key("*")); - DEBUG(5, ("Trusted domains cache flushed\n")); -} - -- 2.11.4.GIT