| blob | 7b6f9f760043621223281cde32a6d76c17e49763 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="small">
4 <title>Small Office Networking</title>
6 <para>
7 <link linkend="simple"/> focused on the basics of simple yet effective
8 network solutions. Network administrators who take pride in their work
9 (that's most of us, right?) take care to deliver what our users want,
10 but not too much more. If we make things too complex, we confound our users
11 and increase costs of network ownership. A professional network manager
12 avoids the temptation to put too much pizazz into the way that the network
13 operates. Some creativity is helpful, but keep it under control &smbmdash;
14 good advice that the following two scenarios illustrate.
15 </para>
17 <para>
18 <indexterm><primary>Netware</primary></indexterm>
19 In one case the network administrator of a mid-sized company spent three
20 months building a new network to replace an old Netware server. What he
21 delivered had all the bells and whistles he could muster. There were a
22 few teething problems during the changeover, nothing serious but a little
23 disruptive all the same. Users were exposed to many changes at once. The
24 network administrator was asked to resign two months after implementing
25 the new system because so many staff complained they had lost time and
26 were not happy with the new network. Everything was automated, and he
27 delivered more features than any advanced user could think of. He was
28 just too smart for his own good.
29 </para>
31 <para>
32 In the case of the other company, a new network manager was appointed
33 to oversee the replacement of a LanTastic network with an MS Windows
34 NT 4.0 network. He had the replacement installed and operational within
35 two weeks. Before installation and changeover, he called a meeting to
36 explain to all users what was going to happen, how it would affect them,
37 and that he would be available 24 hours a day to help them transition.
38 One week after conversion, he held another meeting asking for cooperation
39 in the introduction of a few new features that would help to make life
40 easier. Network users were thrilled with the help he provided. The network
41 he implemented was nowhere near as complex as in the first example, had fewer
42 features, and yet he had happy users. Months later he was still adding
43 new innovations. He always asked the users if a
44 particular feature was what they wanted. He asked his boss for a raise
45 and got it. He often told me, <quote>Always keep a few new tricks up your
46 sleeves for when you need them.</quote> Was he smart? You decide. Let's
47 get on with our next exercise.
48 </para>
50 <sect1>
51 <title>Introduction</title>
53 <para>
54 Abmas Accounting has grown. Mr. Meany likes you and says he knew you
55 were the right person for the job. That's why he asked you to install the
56 new server. The past few months have been hard work. You advised Mr. Meany
57 that it is time for a change. Abmas now has 52 users, having acquired an
58 investment consulting business recently. The new users were added to the
59 network without any problems.
60 </para>
62 <para>
63 Some of the Windows clients are nearly past their use-by date.
64 You found damaged and unusable software on some of the workstations
65 that came with the acquired business and found some machines
66 in need of both hardware and software maintenance.
67 </para>
69 <sect2>
70 <title>Assignment Tasks</title>
72 <para>
73 <indexterm><primary>Windows XP</primary></indexterm>
74 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
75 that the business is running efficiently. Many of the new staff want notebook
76 computers. They visit customer business premises and need to use local network
77 facilities; these users are technically competent. The company uses a
78 business application that requires Windows XP Professional. In short, a complete
79 client upgrade is about to happen. Mr. Meany told you that he is working
80 on another business acquisition and that by the time he retires there will be
81 80 to 100 users.
82 </para>
84 <para>
85 Mr. Meany is not concerned about security. He wants to make it easier for
86 staff to do their work. He has hired you to help him appoint a full-time
87 network manager before he retires. Above all, he says he is investing in
88 the ability to grow. He is determined to live his lifelong dream and
89 hand the business over to a bright and capable executive who can make
90 things happen. This means your network design must cope well with
91 growth.
92 </para>
94 <para>
95 In a few months, Abmas will require an Internet connection for email and so
96 that staff can easily obtain software updates. Mr. Meany is warming up to
97 the installation of antivirus software but is not yet ready to approve
98 this expense. He told you to spend the money a virus scanner costs
99 on better quality notebook computers for mobile users.
100 </para>
102 <para>
103 One of Mr. Meany's golfing partners convinced him to buy new laser
104 printers, one black only, the other a color laser printer. Staff support
105 the need for a color printer so they can present more attractive proposals
106 and reports.
107 </para>
109 <para>
110 Mr. Meany also asked if it would be possible for one of the staff to manage
111 user accounts from the Windows desktop. That person will be responsible for
112 basic operations.
113 </para>
115 </sect2>
116 </sect1>
118 <sect1>
119 <title>Dissection and Discussion</title>
121 <para>
122 What are the key requirements in this business example? A quick review indicates
123 a need for
124 </para>
126 <itemizedlist>
127 <listitem><para>
128 Scalability, from 52 to over 100 users in 12 months
129 </para></listitem>
131 <listitem><para>
132 Mobile computing capability
133 <indexterm><primary>mobile computing</primary></indexterm>
134 </para></listitem>
136 <listitem><para>
137 Improved reliability and usability
138 </para></listitem>
140 <listitem><para>
141 Easier administration
142 </para></listitem>
143 </itemizedlist>
145 <para>
146 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
147 (as in <link linkend="AccountingOffice"/>).
149 </para>
152 <sect2>
153 <title>Technical Issues</title>
155 <para>
156 <indexterm><primary>smbpasswd</primary></indexterm>
157 <indexterm><primary>DHCP</primary></indexterm>
158 <indexterm><primary>DNS</primary></indexterm>
159 <indexterm><primary>WINS</primary></indexterm>
160 <indexterm><primary>Domain</primary></indexterm>
161 It is time to implement a domain security environment. You will use the <constant>
162 smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
163 run DNS at this time, but the system will use WINS. The domain name will be <constant>
164 BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
165 </para>
167 <para>
168 All printers will be configured as DHCP clients. The DHCP server will assign
169 the printer a fixed IP address by way of its Ethernet interface (MAC) address.
170 See <link linkend="dhcp01"/>.
171 </para>
173 <note><para>
174 The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
175 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
176 possible to start with the installation that you have created here, migrate it
177 to a Samba-3 configuration, and then secure the system further. Configurations following
178 this one utilize features that may not be supported in Samba-2.2.x releases.
179 However, you should note that the examples in each chapter start with the assumption
180 that a fresh new installation is being effected.
181 </para></note>
183 <para>
184 Later on, when the Internet connection is implemented, you will add DNS as well as
185 other enhancements. It is important that you plan accordingly.
186 </para>
188 <para>
189 <indexterm><primary>Ethernet switch</primary></indexterm>
190 You have split the network into two separate areas. Each has its own Ethernet switch.
191 There are 20 users on the accounting network and 32 users on the financial services
192 network. The server has two network interfaces, one serving each network. The
193 network printers will be located in a central area. You plan to install the new
194 printers and keep the old printer in use also.
195 </para>
197 <para>
198 You will provide separate file storage areas for each business entity. The old system
199 will go away, accounting files will be handled under a single directory, and files will
200 be stored under customer name, not under a personal work area. Staff will be made
201 responsible for file location, so the old share point must be maintained.
202 </para>
204 <para>
205 Given that DNS will not be used, you will configure WINS name resolution for UNIX
206 hostname name resolution.
207 </para>
209 <para>
210 <indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
211 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
212 It is necessary to map Windows Domain Groups to UNIX groups. It is
213 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
214 key staff groups in the firm are accounting staff and financial services staff.
215 For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
216 </para>
218 <para>
219 In the sample &smb.conf; file, you have configured Samba to call the UNIX
220 <command>groupadd</command> to add group entries. This utility does not permit
221 the addition of group names that contain uppercase characters or spaces. This
222 is considered a bug. The <command>groupadd</command> is part of the
223 <command>shadow-utils</command> open source software package. A later release
224 of this package may have been patched to resolve this bug. If your operating
225 platform has this bug, it means that attempts to add a Windows Domain Group that
226 has either a space or uppercase characters in it will fail. See
227 <emphasis>TOSHARG</emphasis>, Chapter 11, Section 11.3.1, Example 11.1, for
228 more information.
229 </para>
231 <para>
232 <indexterm><primary>CUPS</primary></indexterm>
233 Vendor-supplied printer drivers will be installed on each client. The CUPS print
234 spooler on the UNIX host will be operated in <constant>raw</constant> mode.
235 </para>
237 </sect2>
239 <sect2>
240 <title>Political Issues</title>
242 <para>
243 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
244 He is willing to spend money on things he believes are of value. You need more
245 time to convince him of real priorities.
246 </para>
248 <para>
249 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
250 supplied with antivirus software? Above all, demonstrate good purchase value and remember
251 to make your users happy.
252 </para>
254 </sect2>
256 </sect1>
258 <sect1>
259 <title>Implementation</title>
261 <para>
262 <indexterm><primary>migration</primary></indexterm>
263 In this example, the assumption is made that this server is being configured from a clean start.
264 The alternate approach could be to demonstrate the migration of the system that is documented
265 in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
266 future examples, as a new installation is based on the premise that you can determine
267 the migration steps from the information provided in <link linkend="ntmigration"/>.
268 Additionally, a fresh installation makes the example easier to follow.
269 </para>
271 <para>
272 <indexterm><primary>group membership</primary></indexterm>
273 Each user will be given a home directory on the UNIX system, which will be available as a private
274 share. Two additional shares will be created, one for the accounting department and the other for
275 the financial services department. Network users will be given access to these shares by way
276 of group membership.
277 </para>
279 <para>
280 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
281 UNIX group membership is the primary mechanism by which Windows Domain users will be granted
282 rights and privileges within the Windows environment.
283 </para>
285 <para>
286 <indexterm><primary>sticky bit</primary></indexterm>
287 The user <command>alanm</command> will be made the owner of all files. This will be preserved
288 by setting the sticky bit (set UID/GID) on the top-level directories.
289 </para>
291 <figure id="acct2net">
292 <title>Abmas Accounting &smbmdash; 52-User Network Topology</title>
293 <imagefile scale="100">acct2net</imagefile>
294 </figure>
296 <procedure>
297 <title>Server Installation Steps</title>
299 <step><para>
300 Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
301 </para></step>
303 <step><para>
304 <indexterm><primary>/etc/hosts</primary></indexterm>
305 Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
306 The printers are network attached, so there should be entries for the
307 network printers also. An example <filename>/etc/hosts</filename> file is shown here:
308 <screen>
309 192.168.1.1 sleeth sleeth1
310 192.168.2.1 sleeth2
311 192.168.1.10 hplj6
312 192.168.1.11 hplj4
313 192.168.2.10 qms
314 </screen>
315 </para></step>
317 <step><para>
318 Install the Samba-3 binary RPM from the Samba-Team FTP site.
319 </para></step>
321 <step><para>
322 Install the ISC DHCP server using the UNIX/Linux system tools available to you.
323 </para></step>
325 <step><para>
326 <indexterm><primary>/etc/rc.d/rc.local</primary></indexterm>
327 <indexterm><primary>IP forwarding</primary></indexterm>
328 <indexterm><primary>router</primary></indexterm>
329 <indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm>
330 Because Samba will be operating over two network interfaces and clients on each side
331 may want to be able to reach clients on the other side, it is imperative that IP forwarding
332 is enabled. Use the system tool of your choice to enable IP forwarding. In the
333 absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
334 file an entry as follows:
335 <screen>
336 echo 1 > /proc/sys/net/ipv4/ip_forward
337 </screen>
338 This causes the Linux kernel to forward IP packets so that it acts as a router.
339 </para></step>
341 <step><para>
342 Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and
343 <link linkend="acct3conf"/>. Combine these two examples to form a single
344 <filename>/etc/samba/smb.conf</filename> file.
345 </para></step>
347 <step><para>
348 <indexterm><primary>smbpasswd</primary></indexterm>
349 Add the user <command>root</command> to the Samba password backend:
350 <screen>
351 &rootprompt; smbpasswd -a root
352 New SMB password: XXXXXXX
353 Retype new SMB password: XXXXXXX
354 &rootprompt;
355 </screen>
356 <indexterm><primary>administrator</primary></indexterm>
357 This is the Windows Domain Administrator password. Never delete this account from
358 the password backend after Windows Domain Groups have been initialized. If you delete
359 this account, your system is crippled. You cannot restore this account,
360 and your Samba server can no longer be administered.
361 </para></step>
363 <step><para>
364 <indexterm><primary>username map</primary></indexterm>
365 Create the username map file to permit the <constant>root</constant> account to be called
366 <constant>Administrator</constant> from the Windows network environment. To do this, create
367 the file <filename>/etc/samba/smbusers</filename> with the following contents:
368 <screen>
369 ####
370 # User mapping file
371 ####
372 # File Format
373 # -----------
374 # Unix_ID = Windows_ID
375 #
376 # Examples:
377 # root = Administrator
378 # janes = "Jane Smith"
379 # jimbo = Jim Bones
380 #
381 # Note: If the name contains a space it must be double quoted.
382 # In the example above the name 'jimbo' will be mapped to Windows
383 # user names 'Jim' and 'Bones' because the space was not quoted.
384 #######################################################################
385 root = Administrator
386 ####
387 # End of File
388 ####
389 </screen>
390 </para></step>
392 <step><para>
393 <indexterm><primary>initGrps.sh</primary></indexterm>
394 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
395 <link linkend="initGrps"/>. Create a file containing this script. We called ours
396 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
397 and then execute the script. Sample output should be as follows:
399 <example id="initGrps">
400 <title>Script to Map Windows NT Groups to UNIX Groups</title>
401 <indexterm><primary>initGrps.sh</primary></indexterm>
402 <screen>
403 #!/bin/bash
404 #
405 # initGrps.sh
406 #
408 # Create UNIX groups
409 groupadd acctsdep
410 groupadd finsrvcs
412 # Map Windows Domain Groups to UNIX groups
413 net groupmap modify ntgroup="Domain Admins" unixgroup=root
414 net groupmap modify ntgroup="Domain Users" unixgroup=users
415 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
417 # Add Functional Domain Groups
418 net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
419 net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
420 </screen>
421 </example>
423 <screen>
424 &rootprompt; chmod 755 initGrps.sh
425 &rootprompt; cd /etc/samba
426 &rootprompt; ./initGrps.sh
427 Updated mapping entry for Domain Admins
428 Updated mapping entry for Domain Users
429 Updated mapping entry for Domain Guests
430 No rid or sid specified, choosing algorithmic mapping
431 Successfully added group Accounts Dept to the mapping db
432 No rid or sid specified, choosing algorithmic mapping
433 Successfully added group Domain Guests to the mapping db
435 &rootprompt; cd /etc/samba
436 &rootprompt; net groupmap list | sort
437 Account Operators (S-1-5-32-548) -> -1
438 Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
439 Administrators (S-1-5-32-544) -> -1
440 Backup Operators (S-1-5-32-551) -> -1
441 Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
442 Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
443 Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
444 Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
445 Guests (S-1-5-32-546) -> -1
446 Power Users (S-1-5-32-547) -> -1
447 Print Operators (S-1-5-32-550) -> -1
448 Replicators (S-1-5-32-552) -> -1
449 System Operators (S-1-5-32-549) -> -1
450 Users (S-1-5-32-545) -> -1
451 </screen>
452 </para></step>
454 <step><para>
455 <indexterm><primary>/etc/passwd</primary></indexterm>
456 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
457 <indexterm><primary>smbpasswd</primary></indexterm>
458 For each user who needs to be given a Windows Domain account, make an entry in the
459 <filename>/etc/passwd</filename> file as well as in the Samba password backend.
460 Use the system tool of your choice to create the UNIX system accounts, and use the Samba
461 <command>smbpasswd</command> program to create the Domain user accounts.
462 </para>
464 <para>
465 <indexterm><primary>useradd</primary></indexterm>
466 <indexterm><primary>adduser</primary></indexterm>
467 <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
468 There are a number of tools for user management under UNIX, such as
469 <command>useradd</command> and <command>adduser</command>, as well as a plethora of custom
470 tools. With the tool of your choice, create a home directory for each user.
471 </para></step>
473 <step><para>
474 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
475 previously, as necessary. File system access control will be based on UNIX group membership.
476 </para></step>
478 <step><para>
479 Create the directory mount point for the disk subsystem that is mounted to provide
480 data storage for company files. In this case the mount point is indicated in the &smb.conf;
481 file is <filename>/data</filename>. Format the file system as required, mount the formatted
482 file system partition using <command>mount</command>,
483 and make the appropriate changes in <filename>/etc/fstab</filename>.
484 </para></step>
486 <step><para>
487 Create the top-level file storage directories are follows:
488 <screen>
489 &rootprompt; mkdir -p /data/{accounts,finsvcs}
490 &rootprompt; chown -R root:root /data
491 &rootprompt; chown -R alanm:accounts /data/accounts
492 &rootprompt; chown -R alanm:finsvcs /data/finsvcs
493 &rootprompt; chmod -R ug+rwx,o+rx-w /data
494 </screen>
495 Each department is responsible for creating its own directory structure within its
496 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
497 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
498 </para></step>
500 <step><para>
501 Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
502 Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
503 This allows the CUPS spooler to print using raw mode protocols.
504 <indexterm><primary>CUPS</primary></indexterm>
505 <indexterm><primary>raw printing</primary></indexterm>
506 </para></step>
508 <step><para>
509 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
510 <indexterm><primary>lpadmin</primary></indexterm>
511 Configure the CUPS Print Queues as follows:
512 <screen>
513 &rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
514 &rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
515 &rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
516 </screen>
517 <indexterm><primary>print filter</primary></indexterm>
518 This creates the necessary print queues with no assigned print filter.
519 </para></step>
521 <step><para>
522 <indexterm><primary>mime type</primary></indexterm>
523 <indexterm><primary>/etc/mime.convs</primary></indexterm>
524 <indexterm><primary>application/octet-stream</primary></indexterm>
525 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
526 <screen>
527 application/octet-stream application/vnd.cups-raw 0 -
528 </screen>
529 </para></step>
531 <step><para>
532 <indexterm><primary>/etc/mime.types</primary></indexterm>
533 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
534 <screen>
535 application/octet-stream
536 </screen>
537 </para></step>
539 <step><para>
540 <indexterm><primary>DHCP Server</primary></indexterm>
541 Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
542 contents as shown in <link linkend="dhcp01"/>.
543 <example id="dhcp01">
544 <title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
545 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
546 <screen>
547 default-lease-time 86400;
548 max-lease-time 172800;
549 default-lease-time 86400;
551 option ntp-servers 192.168.1.1;
552 option domain-name "abmas.biz";
553 option domain-name-servers 192.168.1.1, 192.168.2.1;
554 option netbios-name-servers 192.168.1.1, 192.168.2.1;
555 option netbios-node-type 8;
556 ### NOTE ###
557 # netbios-node-type=8 means set clients to Hybrid Mode
558 # so they will use Unicast communication with the WINS
559 # server and thus reduce the level of UDP broadcast
560 # traffic by up to 90%.
561 ############
563 subnet 192.168.1.0 netmask 255.255.255.0 {
564 range dynamic-bootp 192.168.1.128 192.168.1.254;
565 option subnet-mask 255.255.255.0;
566 option routers 192.168.1.1;
567 allow unknown-clients;
568 host hplj4 {
569 hardware ethernet 08:00:46:7a:35:e4;
570 fixed-address 192.168.1.10;
571 }
572 host hplj6 {
573 hardware ethernet 00:03:47:cb:81:e0;
574 fixed-address 192.168.1.11;
575 }
576 }
577 subnet 192.168.2.0 netmask 255.255.255.0 {
578 range dynamic-bootp 192.168.2.128 192.168.2.254;
579 option subnet-mask 255.255.255.0;
580 option routers 192.168.2.1;
581 allow unknown-clients;
582 host qms {
583 hardware ethernet 01:04:31:db:e1:c0;
584 fixed-address 192.168.1.10;
585 }
586 }
587 subnet 127.0.0.0 netmask 255.0.0.0 {
588 }
589 </screen>
590 </example>
591 </para></step>
594 <step><para>
595 Use the standard system tool to start Samba and CUPS and configure them to start
596 automatically at every system reboot. For example,
597 </para>
599 <para>
600 <indexterm><primary>chkconfig</primary></indexterm>
601 <indexterm><primary>starting dhcpd</primary></indexterm>
602 <indexterm><primary>starting samba</primary></indexterm>
603 <indexterm><primary>starting CUPS</primary></indexterm>
604 <indexterm><primary>chkconfig</primary></indexterm>
605 <screen>
606 &rootprompt; chkconfig dhcp on
607 &rootprompt; chkconfig smb on
608 &rootprompt; chkconfig cups on
609 &rootprompt; /etc/rc.d/init.d/dhcp restart
610 &rootprompt; /etc/rc.d/init.d/smb restart
611 &rootprompt; /etc/rc.d/init.d/cups restart
612 </screen>
613 </para></step>
615 <step><para>
616 <indexterm><primary>name service switch</primary></indexterm>
617 <indexterm><primary>NSS</primary><see>same service switch</see></indexterm>
618 <indexterm><primary>DNS</primary></indexterm>
619 <indexterm><primary>DNS server</primary></indexterm>
620 <indexterm><primary>WINS</primary></indexterm>
621 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
622 Configure the name service switch (NSS) to handle WINS-based name resolution.
623 Since this system does not use a DNS server, it is safe to remove this option from
624 the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
625 the <constant>hosts:</constant> entry looks like this:
626 <screen>
627 hosts: files wins
628 </screen>
629 </para></step>
631 </procedure>
633 <smbconfexample id="acct2conf">
634 <title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
635 <smbconfcomment>Global parameters</smbconfcomment>
636 <smbconfsection name="[global]"/>
637 <smbconfoption name="workgroup">BILLMORE</smbconfoption>
638 <smbconfoption name="passwd chat"> </smbconfoption>
639 <member><parameter>*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</parameter></member>
640 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
641 <smbconfoption name="syslog">0</smbconfoption>
642 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
643 <smbconfoption name="printcap name">CUPS</smbconfoption>
644 <smbconfoption name="show add printer wizard">No</smbconfoption>
645 <smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
646 <smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
647 <smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
648 <smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
649 <smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
650 <smbconfoption name="add machine script"> </smbconfoption>
651 <member><parameter>/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</parameter></member>
652 <smbconfoption name="logon script">scripts\login.bat</smbconfoption>
653 <smbconfoption name="logon path"> </smbconfoption>
654 <smbconfoption name="logon drive">X:</smbconfoption>
655 <smbconfoption name="domain logons">Yes</smbconfoption>
656 <smbconfoption name="preferred master">Yes</smbconfoption>
657 <smbconfoption name="wins support">Yes</smbconfoption>
658 <smbconfoption name="printing">CUPS</smbconfoption>
659 </smbconfexample>
661 <smbconfexample id="acct3conf">
662 <title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
663 <smbconfsection name="[homes]"/>
664 <smbconfoption name="comment">Home Directories</smbconfoption>
665 <smbconfoption name="valid users">%S</smbconfoption>
666 <smbconfoption name="read only">No</smbconfoption>
667 <smbconfoption name="browseable">No</smbconfoption>
669 <smbconfsection name="[printers]"/>
670 <smbconfoption name="comment">SMB Print Spool</smbconfoption>
671 <smbconfoption name="path">/var/spool/samba</smbconfoption>
672 <smbconfoption name="printable">Yes</smbconfoption>
673 <smbconfoption name="guest ok">Yes</smbconfoption>
674 <smbconfoption name="use client driver">Yes</smbconfoption>
675 <smbconfoption name="browseable">No</smbconfoption>
677 <smbconfsection name="[netlogon]"/>
678 <smbconfoption name="comment">Network Logon Service</smbconfoption>
679 <smbconfoption name="path">/data/%U</smbconfoption>
680 <smbconfoption name="valid users">%S</smbconfoption>
681 <smbconfoption name="read only">No</smbconfoption>
683 <smbconfsection name="[accounts]"/>
684 <smbconfoption name="comment">Accounting Files</smbconfoption>
685 <smbconfoption name="path">/data/accounts</smbconfoption>
686 <smbconfoption name="valid users">%G</smbconfoption>
687 <smbconfoption name="read only">No</smbconfoption>
689 <smbconfsection name="[finsvcs]"/>
690 <smbconfoption name="comment">Financial Service Files</smbconfoption>
691 <smbconfoption name="path">/data/finsvcs</smbconfoption>
692 <smbconfoption name="valid users">%G</smbconfoption>
693 <smbconfoption name="read only">No</smbconfoption>
694 </smbconfexample>
696 <sect2>
697 <title>Validation</title>
699 <para>
700 Does everything function as it ought? That is the key question at this point.
701 Here are some simple steps to validate your Samba server configuration.
702 </para>
704 <procedure>
705 <title>Validation Steps</title>
707 <step><para>
708 <indexterm><primary>testparm</primary></indexterm>
709 If your &smb.conf; file has bogus options or parameters, this may cause Samba
710 to refuse to start. The first step should always be to validate the contents
711 of this file by running:
712 <screen>
713 &rootprompt; testparm -s
714 Load smb config files from smb.conf
715 Processing section "[homes]"
716 Processing section "[printers]"
717 Processing section "[netlogon]"
718 Processing section "[accounts]"
719 Processing section "[service]"
720 Loaded services file OK.
721 # Global parameters
722 [global]
723 workgroup = BILLMORE
724 passwd chat = *New*Password* \
725 %n\n *Re-enter*new*password* %n\n *Password*changed*
726 username map = /etc/samba/smbusers
727 syslog = 0
728 name resolve order = wins bcast hosts
729 printcap name = CUPS
730 show add printer wizard = No
731 add user script = /usr/sbin/useradd -m '%u'
732 delete user script = /usr/sbin/userdel -r '%u'
733 add group script = /usr/sbin/groupadd '%g'
734 delete group script = /usr/sbin/groupdel '%g'
735 add user to group script = /usr/sbin/usermod -G '%g' '%u'
736 add machine script = /usr/sbin/useradd
737 -s /bin/false -d /var/lib/nobody '%u'
738 logon script = scripts\logon.bat
739 logon path =
740 logon drive = X:
741 domain logons = Yes
742 preferred master = Yes
743 wins support = Yes
744 ...
745 ### Remainder cut to save space ###
746 </screen>
747 The inclusion of an invalid parameter (say one called dogbert) would generate an
748 error as follows:
749 <screen>
750 Unknown parameter encountered: "dogbert"
751 Ignoring unknown parameter "dogbert"
752 </screen>
753 Clear away all errors before proceeding, and start or restart samba as necessary.
754 </para></step>
756 <step><para>
757 <indexterm><primary>check samba daemons</primary></indexterm>
758 <indexterm><primary>nmbd</primary></indexterm>
759 <indexterm><primary>smbd</primary></indexterm>
760 <indexterm><primary>winbindd</primary></indexterm>
761 Check that the Samba server is running:
762 <screen>
763 &rootprompt; ps ax | grep mbd
764 14244 ? S 0:00 /usr/sbin/nmbd -D
765 14245 ? S 0:00 /usr/sbin/nmbd -D
766 14290 ? S 0:00 /usr/sbin/smbd -D
768 $rootprompt; ps ax | grep winbind
769 14293 ? S 0:00 /usr/sbin/winbindd -B
770 14295 ? S 0:00 /usr/sbin/winbindd -B
771 </screen>
772 The <command>winbindd</command> daemon is running in split mode (normal), so there are also
773 two instances of it. For more information regarding <command>winbindd</command>, see <emphasis>TOSHARG</emphasis>,
774 Chapter 23, Section 23.3. The single instance of <command>smbd</command> is normal.
775 </para></step>
777 <step><para>
778 <indexterm><primary>anonymous connection</primary></indexterm>
779 Check that an anonymous connection can be made to the Samba server:
780 <screen>
781 &rootprompt; smbclient -L localhost -U%
783 Sharename Type Comment
784 --------- ---- -------
785 netlogon Disk Network Logon Service
786 accounts Disk Accounting Files
787 finsvcs Disk Financial Service Files
788 IPC$ IPC IPC Service (Samba3)
789 ADMIN$ IPC IPC Service (Samba3)
790 hplj4 Printer Hewlett-Packard LaserJet 4
791 hplj6 Printer Hewlett-Packard LaserJet 6
792 qms Printer QMS Magicolor Laser Printer XXXX
794 Server Comment
795 --------- -------
796 SLEETH Samba 3.0.20
798 Workgroup Master
799 --------- -------
800 BILLMORE SLEETH
801 </screen>
802 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
803 of browsing the server from a Windows client to obtain a list of shares on the server.
804 The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and
805 a <constant>NULL</constant> password.
806 </para></step>
808 <step><para>
809 <indexterm><primary>dhcp client validation</primary></indexterm>
810 <indexterm><primary>printer validation</primary></indexterm>
811 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
812 Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
813 The easiest way to do this is to ping the printer name. Immediately after the ping response
814 has been received, execute <command>arp -a</command> to find the MAC address of the printer
815 that has responded. Now you can compare the IP address and the MAC address of the printer
816 with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
817 should, of course, match. For example,
818 <screen>
819 &rootprompt; ping hplj4
820 PING hplj4 (192.168.1.11) 56(84) bytes of data.
821 64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
823 &rootprompt; arp -a
824 hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
825 </screen>
826 The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
827 IP address from which the printer has responded and the entry for it in the
828 <filename>/etc/dhcpd.conf</filename> file.
829 </para></step>
831 <step><para>
832 <indexterm><primary>authenticated connection</primary></indexterm>
833 Make an authenticated connection to the server using the <command>smbclient</command> tool:
834 <screen>
835 &rootprompt; smbclient //sleeth/accounts -U alanm
836 Password: XXXXXXX
837 smb: \> dir
838 . D 0 Sun Nov 9 01:28:34 2003
839 .. D 0 Sat Aug 16 17:24:26 2003
840 .mc DH 0 Sat Nov 8 21:57:38 2003
841 .qt DH 0 Fri Sep 5 00:48:25 2003
842 SMB D 0 Sun Oct 19 23:04:30 2003
843 Documents D 0 Sat Nov 1 00:31:51 2003
844 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
846 65387 blocks of size 65536. 28590 blocks available
847 smb: \> q
848 </screen>
849 </para></step>
851 </procedure>
853 </sect2>
856 <procedure>
857 <title>Windows XP Professional Client Configuration</title>
859 <step><para>
860 Configure clients to the network settings shown in <link linkend="acct2net"/>.
861 All clients use DHCP for TCP/IP protocol stack configuration.
862 <indexterm><primary>WINS</primary></indexterm>
863 <indexterm><primary>DHCP</primary></indexterm>
864 DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
865 </para></step>
867 <step><para>
868 Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
869 username <constant>root</constant> and the SMB password you assigned to this account.
870 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
871 a Windows Domain is given in Appendix A, <link linkend="domjoin"/>.
872 Reboot the machine as prompted and then log on using a Domain User account.
873 </para></step>
875 <step><para>
876 Verify on each client that the machine called <constant>SLEETH</constant>
877 is visible in <guimenu>My Network Places</guimenu>, that it is
878 possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
879 and <guimenuitem>finsvcs</guimenuitem>,
880 and that it is possible to open that share to reveal its contents.
881 </para></step>
883 <step><para>
884 Instruct all users to log onto the workstation using their assigned username and password.
885 </para></step>
887 <step><para>
888 Install a printer on each using the following steps:
889 </para>
891 <procedure>
892 <step><para>
893 Click <menuchoice>
894 <guimenu>Start</guimenu>
895 <guimenuitem>Settings</guimenuitem>
896 <guimenuitem>Printers</guimenuitem>
897 <guiicon>Add Printer</guiicon>
898 <guibutton>Next</guibutton>
899 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
900 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
901 </para></step>
903 <step><para>
904 Click <guibutton>Next</guibutton>. In the
905 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
906 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
907 <constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
908 </para></step>
910 <step><para>
911 In the <guimenuitem>Available ports:</guimenuitem> panel, select
912 <constant>FILE:</constant>. Accept the default printer name by clicking
913 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
914 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
915 <guibutton>Finish</guibutton>.
916 </para></step>
918 <step><para>
919 You may be prompted for the name of a file to print to. If so, close the
920 dialog panel. Right-click <menuchoice>
921 <guiicon>HP LaserJet 4</guiicon>
922 <guimenuitem>Properties</guimenuitem>
923 <guisubmenu>Details (Tab)</guisubmenu>
924 <guimenuitem>Add Port</guimenuitem>
925 </menuchoice>.
926 </para></step>
928 <step><para>
929 In the <guimenuitem>Network</guimenuitem> panel, enter the name of
930 the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
931 Click <menuchoice>
932 <guibutton>OK</guibutton>
933 <guibutton>OK</guibutton>
934 </menuchoice> to complete the installation.
935 </para></step>
937 <step><para>
938 Repeat the printer installation steps above for the HP LaserJet 6 printer
939 as well as for the QMS Magicolor XXXX laser printer.
940 </para></step>
941 </procedure>
942 </step>
943 </procedure>
945 <sect2>
946 <title>Notebook Computers: A Special Case</title>
948 <para>
949 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
950 Professional systems. This is the preferred solution to provide continuity of work for notebook users
951 so that absence from the office network environment does not become a barrier to productivity.
952 </para>
954 <para>
955 By creating a local machine account that has the same username and password as you create for that
956 user in the Windows Domain environment, the user can log onto the machine locally and still
957 transparently access network resources as if logged onto the domain itself. There are some trade-offs
958 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
959 configuration somewhat.
960 </para>
962 </sect2>
964 <sect2>
965 <title>Key Points Learned</title>
967 <para>
968 In this network design and implementation exercise, you created a Windows NT4-style Domain
969 Controller using Samba-3.0.20. Following these guidelines, you experienced
970 and implemented several important aspects of Windows networking. In the next chapter,
971 you build on the experience. These are the highlights from this chapter:
972 </para>
974 <itemizedlist>
975 <listitem><para>
976 <indexterm><primary>DHCP</primary></indexterm>
977 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
978 network configuration settings from this server.
979 </para></listitem>
981 <listitem><para>
982 <indexterm><primary>Domain Controller</primary></indexterm>
983 You created a Windows Domain Controller. You were able to use the network logon service
984 and successfully joined Windows 200x/XP Professional clients to the Domain.
985 </para></listitem>
987 <listitem><para>
988 <indexterm><primary>CUPS</primary></indexterm>
989 You created raw print queues in the CUPS printing system. You maintained a simple
990 printing system so that all users can share centrally managed printers. You installed
991 native printer drivers on the Windows clients.
992 </para></listitem>
994 <listitem><para>
995 You experienced the benefits of centrally managed user accounts on the server.
996 </para></listitem>
998 <listitem><para>
999 You offered Mobile notebook users a solution that allows them to continue to work
1000 while away from the office and not connected to the corporate network.
1001 </para></listitem>
1002 </itemizedlist>
1004 </sect2>
1006 </sect1>
1008 <sect1>
1009 <title>Questions and Answers</title>
1011 <para>
1012 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
1013 may help.
1014 </para>
1016 <qandaset>
1017 <qandaentry>
1018 <question>
1020 <para>
1021 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
1022 </para>
1024 </question>
1025 <answer>
1027 <para>
1028 First and foremost, portability. It means that notebook users can move between
1029 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
1030 reconfigure their machines. It also means that when they work from their home environments
1031 either using DHCP assigned addressing or when using dial-up networking, settings such as
1032 default routes and DNS server addresses that apply only to the Abmas office environment do
1033 not interfere with remote operations. This is an extremely important feature of DHCP.
1034 </para>
1036 </answer>
1037 </qandaentry>
1039 <qandaentry>
1040 <question>
1042 <para>
1043 Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
1044 that should be noted in particular?
1045 </para>
1047 </question>
1048 <answer>
1050 <para>
1051 Yes. The configuration you created automatically provides each client with the IP address
1052 of your WINS server. It also configures the client to preferentially register NetBIOS names
1053 with the WINS server, and then instructs the client to first query the WINS server when a
1054 NetBIOS machine name needs to be resolved to an IP Address. This configuration
1055 results in far lower UDP broadcast traffic than would be the case if WINS was not used.
1056 </para>
1058 </answer>
1059 </qandaentry>
1061 <qandaentry>
1062 <question>
1064 <para>
1065 Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
1066 </para>
1068 </question>
1069 <answer>
1071 <para>
1072 You can surely create a Windows Domain account called <constant>Administrator</constant>. It is also
1073 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
1074 necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
1075 account called <constant>root</constant>.
1076 </para>
1078 </answer>
1079 </qandaentry>
1081 <qandaentry>
1082 <question>
1084 <para>
1085 Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
1086 </para>
1088 </question>
1089 <answer>
1091 <para>
1092 The Windows Domain <constant>Administrator</constant> account is the most privileged account that
1093 exists on the Windows platform. This user can change any setting, add, delete, or modify user
1094 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
1095 environment is the <constant>root</constant> account. If you want to permit the Windows Domain
1096 Administrator to manage accounts as well as permissions, privileges, and security
1097 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
1098 achieved with the <constant>root</constant> UID equal to 0.
1099 </para>
1101 </answer>
1102 </qandaentry>
1104 <qandaentry>
1105 <question>
1107 <para>
1108 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
1109 <constant>root</constant> access. How can we do this?
1110 </para>
1112 </question>
1113 <answer>
1115 <para>
1116 Users who are members of the <constant>Domain Admins</constant> group can add machines to the
1117 Domain. This group is mapped to the UNIX group account called <constant>root</constant>
1118 (or the equivalent <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
1119 This must be the primary GID of the account of the user who is a member of the Windows <constant>
1120 Domain Admins</constant> account.
1121 </para>
1123 </answer>
1124 </qandaentry>
1126 <qandaentry>
1127 <question>
1129 <para>
1130 Why must I map Windows Domain Groups to UNIX groups?
1131 </para>
1133 </question>
1134 <answer>
1136 <para>
1137 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
1138 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
1139 <guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>.
1140 </para>
1142 </answer>
1143 </qandaentry>
1145 <qandaentry>
1146 <question>
1148 <para>
1149 I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
1150 </para>
1152 </question>
1153 <answer>
1155 <para>
1156 This is a nasty problem. Fortunately, there is a solution.
1157 </para>
1159 <procedure>
1160 <step><para>
1161 Back up your existing configuration files in case you need to restore them.
1162 </para></step>
1164 <step><para>
1165 Rename the <filename>group_mapping.tdb</filename> file.
1166 </para></step>
1168 <step><para>
1169 Use the <command>smbpasswd</command> to add the root account.
1170 </para></step>
1172 <step><para>
1173 Restore the <filename>group_mapping.tdb</filename> file.
1174 </para></step>
1175 </procedure>
1177 </answer>
1178 </qandaentry>
1180 <qandaentry>
1181 <question>
1183 <para>
1184 When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
1185 as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
1186 </para>
1188 </question>
1189 <answer>
1191 <para>
1192 The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
1193 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
1194 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
1195 may change at some later date. These accounts are provided only so that security objects are correctly shown.
1196 </para>
1198 </answer>
1199 </qandaentry>
1201 <qandaentry>
1202 <question>
1204 <para>
1205 What is the effect of changing the name of a Samba server or of changing the Domain name?
1206 </para>
1208 </question>
1209 <answer>
1211 <para>
1212 If you elect to change the name of the Samba server, on restarting <command>smbd</command>,
1213 Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
1214 the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
1215 (Workgroup name), the Domain SID is changed. This affects all Domain memberships.
1216 </para>
1218 <para>
1219 If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
1220 SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3)
1221 or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
1222 to check the man page for this command for detailed instructions regarding the steps involved.
1223 </para>
1225 </answer>
1226 </qandaentry>
1228 <qandaentry>
1229 <question>
1231 <para>
1232 How can I manage user accounts from my Windows XP Professional workstation?
1233 </para>
1235 </question>
1236 <answer>
1238 <para>
1239 Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
1240 be managed using tools present on a Windows XP Professional installation. You may download from the
1241 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
1242 it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event
1243 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
1244 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
1245 for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
1246 </para>
1248 </answer>
1249 </qandaentry>
1251 </qandaset>
1253 </sect1>
1255 </chapter>