docs/htmldocs/Samba-HOWTO-Collection.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >SAMBA Project Documentation</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="BOOK"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><DIV
  16 CLASS="BOOK"
  17 ><A
  18 NAME="SAMBA-PROJECT-DOCUMENTATION"
  19 ></A
  20 ><DIV
  21 CLASS="TITLEPAGE"
  22 ><H1
  23 CLASS="TITLE"
  24 ><A
  25 NAME="SAMBA-PROJECT-DOCUMENTATION"
  26 >SAMBA Project Documentation</A
  27 ></H1
  28 ><H3
  29 CLASS="AUTHOR"
  30 ><A
  31 NAME="AEN4"
  32 >SAMBA Team</A
  33 ></H3
  34 ><HR></DIV
  35 ><HR><H1
  36 ><A
  37 NAME="AEN9"
  38 >Abstract</A
  39 ></H1
  40 ><P
  41 >This book is a collection of HOWTOs added to Samba documentation over the year.
  42 I try to ensure that all are current, but sometimes the is a larger job
  43 than one person can maintain.  You can always find the later version of this
  44 PDF file at <A
  45 HREF="http://www.samba.org/"
  46 TARGET="_top"
  47 >http://www.samba.org/</A
  48 >
  49 on the "Documentation" page.  Please send updates to <A
  50 HREF="mailto:jerry@samba.org"
  51 TARGET="_top"
  52 >jerry@samba.org</A
  53 >.</P
  54 ><P
  55 >Cheers, jerry</P
  56 ><DIV
  57 CLASS="TOC"
  58 ><DL
  59 ><DT
  60 ><B
  61 >Table of Contents</B
  62 ></DT
  63 ><DT
  64 >1. <A
  65 HREF="#AEN15"
  66 >How to Install and Test SAMBA</A
  67 ></DT
  68 ><DD
  69 ><DL
  70 ><DT
  71 >1.1. <A
  72 HREF="#AEN17"
  73 >Step 0: Read the man pages</A
  74 ></DT
  75 ><DT
  76 >1.2. <A
  77 HREF="#AEN25"
  78 >Step 1: Building the Binaries</A
  79 ></DT
  80 ><DT
  81 >1.3. <A
  82 HREF="#AEN53"
  83 >Step 2: The all important step</A
  84 ></DT
  85 ><DT
  86 >1.4. <A
  87 HREF="#AEN57"
  88 >Step 3: Create the smb configuration file.</A
  89 ></DT
  90 ><DT
  91 >1.5. <A
  92 HREF="#AEN71"
  93 >Step 4: Test your config file with
  94         <B
  95 CLASS="COMMAND"
  96 >testparm</B
  97 ></A
  98 ></DT
  99 ><DT
 100 >1.6. <A
 101 HREF="#AEN77"
 102 >Step 5: Starting the smbd and nmbd</A
 103 ></DT
 104 ><DD
 105 ><DL
 106 ><DT
 107 >1.6.1. <A
 108 HREF="#AEN87"
 109 >Step 5a: Starting from inetd.conf</A
 110 ></DT
 111 ><DT
 112 >1.6.2. <A
 113 HREF="#AEN116"
 114 >Step 5b. Alternative: starting it as a daemon</A
 115 ></DT
 116 ></DL
 117 ></DD
 118 ><DT
 119 >1.7. <A
 120 HREF="#AEN132"
 121 >Step 6: Try listing the shares available on your
 122         server</A
 123 ></DT
 124 ><DT
 125 >1.8. <A
 126 HREF="#AEN141"
 127 >Step 7: Try connecting with the unix client</A
 128 ></DT
 129 ><DT
 130 >1.9. <A
 131 HREF="#AEN157"
 132 >Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT,
 133         Win2k, OS/2, etc... client</A
 134 ></DT
 135 ><DT
 136 >1.10. <A
 137 HREF="#AEN171"
 138 >What If Things Don't Work?</A
 139 ></DT
 140 ><DD
 141 ><DL
 142 ><DT
 143 >1.10.1. <A
 144 HREF="#AEN176"
 145 >Diagnosing Problems</A
 146 ></DT
 147 ><DT
 148 >1.10.2. <A
 149 HREF="#AEN180"
 150 >Scope IDs</A
 151 ></DT
 152 ><DT
 153 >1.10.3. <A
 154 HREF="#AEN183"
 155 >Choosing the Protocol Level</A
 156 ></DT
 157 ><DT
 158 >1.10.4. <A
 159 HREF="#AEN192"
 160 >Printing from UNIX to a Client PC</A
 161 ></DT
 162 ><DT
 163 >1.10.5. <A
 164 HREF="#AEN196"
 165 >Locking</A
 166 ></DT
 167 ><DT
 168 >1.10.6. <A
 169 HREF="#AEN206"
 170 >Mapping Usernames</A
 171 ></DT
 172 ><DT
 173 >1.10.7. <A
 174 HREF="#AEN209"
 175 >Other Character Sets</A
 176 ></DT
 177 ></DL
 178 ></DD
 179 ></DL
 180 ></DD
 181 ><DT
 182 >2. <A
 183 HREF="#AEN212"
 184 >LanMan and NT Password Encryption in Samba 2.x</A
 185 ></DT
 186 ><DD
 187 ><DL
 188 ><DT
 189 >2.1. <A
 190 HREF="#AEN223"
 191 >Introduction</A
 192 ></DT
 193 ><DT
 194 >2.2. <A
 195 HREF="#AEN227"
 196 >How does it work?</A
 197 ></DT
 198 ><DT
 199 >2.3. <A
 200 HREF="#AEN238"
 201 >Important Notes About Security</A
 202 ></DT
 203 ><DD
 204 ><DL
 205 ><DT
 206 >2.3.1. <A
 207 HREF="#AEN257"
 208 >Advantages of SMB Encryption</A
 209 ></DT
 210 ><DT
 211 >2.3.2. <A
 212 HREF="#AEN264"
 213 >Advantages of non-encrypted passwords</A
 214 ></DT
 215 ></DL
 216 ></DD
 217 ><DT
 218 >2.4. <A
 219 HREF="#AEN273"
 220 ><A
 221 NAME="SMBPASSWDFILEFORMAT"
 222 ></A
 223 >The smbpasswd file</A
 224 ></DT
 225 ><DT
 226 >2.5. <A
 227 HREF="#AEN325"
 228 >The smbpasswd Command</A
 229 ></DT
 230 ><DT
 231 >2.6. <A
 232 HREF="#AEN364"
 233 >Setting up Samba to support LanManager Encryption</A
 234 ></DT
 235 ></DL
 236 ></DD
 237 ><DT
 238 >3. <A
 239 HREF="#AEN379"
 240 >Hosting a Microsoft Distributed File System tree on Samba</A
 241 ></DT
 242 ><DD
 243 ><DL
 244 ><DT
 245 >3.1. <A
 246 HREF="#AEN390"
 247 >Instructions</A
 248 ></DT
 249 ><DD
 250 ><DL
 251 ><DT
 252 >3.1.1. <A
 253 HREF="#AEN425"
 254 >Notes</A
 255 ></DT
 256 ></DL
 257 ></DD
 258 ></DL
 259 ></DD
 260 ><DT
 261 >4. <A
 262 HREF="#AEN434"
 263 >Printing Support in Samba 2.2.x</A
 264 ></DT
 265 ><DD
 266 ><DL
 267 ><DT
 268 >4.1. <A
 269 HREF="#AEN445"
 270 >Introduction</A
 271 ></DT
 272 ><DT
 273 >4.2. <A
 274 HREF="#AEN462"
 275 >Configuration</A
 276 ></DT
 277 ><DD
 278 ><DL
 279 ><DT
 280 >4.2.1. <A
 281 HREF="#AEN472"
 282 >Creating [print$]</A
 283 ></DT
 284 ><DT
 285 >4.2.2. <A
 286 HREF="#AEN507"
 287 >Setting Drivers for Existing Printers</A
 288 ></DT
 289 ><DT
 290 >4.2.3. <A
 291 HREF="#AEN520"
 292 >Support a large number of printers</A
 293 ></DT
 294 ><DT
 295 >4.2.4. <A
 296 HREF="#AEN531"
 297 >Adding New Printers via the Windows NT APW</A
 298 ></DT
 299 ><DT
 300 >4.2.5. <A
 301 HREF="#AEN556"
 302 >Samba and Printer Ports</A
 303 ></DT
 304 ></DL
 305 ></DD
 306 ><DT
 307 >4.3. <A
 308 HREF="#AEN564"
 309 >The Imprints Toolset</A
 310 ></DT
 311 ><DD
 312 ><DL
 313 ><DT
 314 >4.3.1. <A
 315 HREF="#AEN568"
 316 >What is Imprints?</A
 317 ></DT
 318 ><DT
 319 >4.3.2. <A
 320 HREF="#AEN578"
 321 >Creating Printer Driver Packages</A
 322 ></DT
 323 ><DT
 324 >4.3.3. <A
 325 HREF="#AEN581"
 326 >The Imprints server</A
 327 ></DT
 328 ><DT
 329 >4.3.4. <A
 330 HREF="#AEN585"
 331 >The Installation Client</A
 332 ></DT
 333 ></DL
 334 ></DD
 335 ><DT
 336 >4.4. <A
 337 HREF="#AEN607"
 338 ><A
 339 NAME="MIGRATION"
 340 ></A
 341 >Migration to from Samba 2.0.x to
 342         2.2.x</A
 343 ></DT
 344 ></DL
 345 ></DD
 346 ><DT
 347 >5. <A
 348 HREF="#AEN639"
 349 >security = domain in Samba 2.x</A
 350 ></DT
 351 ><DD
 352 ><DL
 353 ><DT
 354 >5.1. <A
 355 HREF="#AEN657"
 356 >Joining an NT Domain with Samba 2.2</A
 357 ></DT
 358 ><DT
 359 >5.2. <A
 360 HREF="#AEN721"
 361 >Samba and Windows 2000 Domains</A
 362 ></DT
 363 ><DT
 364 >5.3. <A
 365 HREF="#AEN726"
 366 >Why is this better than security = server?</A
 367 ></DT
 368 ></DL
 369 ></DD
 370 ><DT
 371 >6. <A
 372 HREF="#AEN742"
 373 >How to Configure Samba 2.2.x as a Primary Domain Controller</A
 374 ></DT
 375 ><DD
 376 ><DL
 377 ><DT
 378 >6.1. <A
 379 HREF="#AEN753"
 380 >Background</A
 381 ></DT
 382 ><DT
 383 >6.2. <A
 384 HREF="#AEN790"
 385 >Configuring the Samba Domain Controller</A
 386 ></DT
 387 ><DT
 388 >6.3. <A
 389 HREF="#AEN833"
 390 >Creating Machine Trust Accounts and Joining Clients
 391 to the Domain</A
 392 ></DT
 393 ><DT
 394 >6.4. <A
 395 HREF="#AEN872"
 396 >Common Problems and Errors</A
 397 ></DT
 398 ><DT
 399 >6.5. <A
 400 HREF="#AEN900"
 401 >System Policies and Profiles</A
 402 ></DT
 403 ><DT
 404 >6.6. <A
 405 HREF="#AEN940"
 406 >What other help can I get ?</A
 407 ></DT
 408 ><DD
 409 ><DL
 410 ><DT
 411 >6.6.1. <A
 412 HREF="#AEN987"
 413 >URLs and similar</A
 414 ></DT
 415 ><DT
 416 >6.6.2. <A
 417 HREF="#AEN1011"
 418 >Mailing Lists</A
 419 ></DT
 420 ></DL
 421 ></DD
 422 ><DT
 423 >6.7. <A
 424 HREF="#AEN1050"
 425 >DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
 426 ></DT
 427 ></DL
 428 ></DD
 429 ><DT
 430 >7. <A
 431 HREF="#AEN1074"
 432 >Unifed Logons between Windows NT and UNIX using Winbind</A
 433 ></DT
 434 ><DD
 435 ><DL
 436 ><DT
 437 >7.1. <A
 438 HREF="#AEN1092"
 439 >Abstract</A
 440 ></DT
 441 ><DT
 442 >7.2. <A
 443 HREF="#AEN1096"
 444 >Introduction</A
 445 ></DT
 446 ><DT
 447 >7.3. <A
 448 HREF="#AEN1109"
 449 >What Winbind Provides</A
 450 ></DT
 451 ><DD
 452 ><DL
 453 ><DT
 454 >7.3.1. <A
 455 HREF="#AEN1116"
 456 >Target Uses</A
 457 ></DT
 458 ></DL
 459 ></DD
 460 ><DT
 461 >7.4. <A
 462 HREF="#AEN1120"
 463 >How Winbind Works</A
 464 ></DT
 465 ><DD
 466 ><DL
 467 ><DT
 468 >7.4.1. <A
 469 HREF="#AEN1125"
 470 >Microsoft Remote Procedure Calls</A
 471 ></DT
 472 ><DT
 473 >7.4.2. <A
 474 HREF="#AEN1129"
 475 >Name Service Switch</A
 476 ></DT
 477 ><DT
 478 >7.4.3. <A
 479 HREF="#AEN1145"
 480 >Pluggable Authentication Modules</A
 481 ></DT
 482 ><DT
 483 >7.4.4. <A
 484 HREF="#AEN1153"
 485 >User and Group ID Allocation</A
 486 ></DT
 487 ><DT
 488 >7.4.5. <A
 489 HREF="#AEN1157"
 490 >Result Caching</A
 491 ></DT
 492 ></DL
 493 ></DD
 494 ><DT
 495 >7.5. <A
 496 HREF="#AEN1160"
 497 >Installation and Configuration</A
 498 ></DT
 499 ><DT
 500 >7.6. <A
 501 HREF="#AEN1166"
 502 >Limitations</A
 503 ></DT
 504 ><DT
 505 >7.7. <A
 506 HREF="#AEN1178"
 507 >Conclusion</A
 508 ></DT
 509 ></DL
 510 ></DD
 511 ><DT
 512 >8. <A
 513 HREF="#AEN1181"
 514 >UNIX Permission Bits and WIndows NT Access Control Lists</A
 515 ></DT
 516 ><DD
 517 ><DL
 518 ><DT
 519 >8.1. <A
 520 HREF="#AEN1192"
 521 >Viewing and changing UNIX permissions using the NT
 522         security dialogs</A
 523 ></DT
 524 ><DT
 525 >8.2. <A
 526 HREF="#AEN1201"
 527 >How to view file security on a Samba share</A
 528 ></DT
 529 ><DT
 530 >8.3. <A
 531 HREF="#AEN1212"
 532 >Viewing file ownership</A
 533 ></DT
 534 ><DT
 535 >8.4. <A
 536 HREF="#AEN1232"
 537 >Viewing file or directory permissions</A
 538 ></DT
 539 ><DD
 540 ><DL
 541 ><DT
 542 >8.4.1. <A
 543 HREF="#AEN1247"
 544 >File Permissions</A
 545 ></DT
 546 ><DT
 547 >8.4.2. <A
 548 HREF="#AEN1261"
 549 >Directory Permissions</A
 550 ></DT
 551 ></DL
 552 ></DD
 553 ><DT
 554 >8.5. <A
 555 HREF="#AEN1268"
 556 >Modifying file or directory permissions</A
 557 ></DT
 558 ><DT
 559 >8.6. <A
 560 HREF="#AEN1290"
 561 >Interaction with the standard Samba create mask
 562         parameters</A
 563 ></DT
 564 ><DT
 565 >8.7. <A
 566 HREF="#AEN1354"
 567 >Interaction with the standard Samba file attribute
 568         mapping</A
 569 ></DT
 570 ></DL
 571 ></DD
 572 ><DT
 573 >9. <A
 574 HREF="#AEN1364"
 575 >OS2 Client HOWTO</A
 576 ></DT
 577 ><DD
 578 ><DL
 579 ><DT
 580 >9.1. <A
 581 HREF="#AEN1375"
 582 >FAQs</A
 583 ></DT
 584 ><DD
 585 ><DL
 586 ><DT
 587 >9.1.1. <A
 588 HREF="#AEN1377"
 589 >How can I configure OS/2 Warp Connect or
 590                 OS/2 Warp 4 as a client for Samba?</A
 591 ></DT
 592 ><DT
 593 >9.1.2. <A
 594 HREF="#AEN1392"
 595 >How can I configure OS/2 Warp 3 (not Connect),
 596                 OS/2 1.2, 1.3 or 2.x for Samba?</A
 597 ></DT
 598 ><DT
 599 >9.1.3. <A
 600 HREF="#AEN1401"
 601 >Are there any other issues when OS/2 (any version)
 602                 is used as a client?</A
 603 ></DT
 604 ><DT
 605 >9.1.4. <A
 606 HREF="#AEN1405"
 607 >How do I get printer driver download working
 608                 for OS/2 clients?</A
 609 ></DT
 610 ></DL
 611 ></DD
 612 ></DL
 613 ></DD
 614 ></DL
 615 ></DIV
 616 ><DIV
 617 CLASS="CHAPTER"
 618 ><HR><H1
 619 ><A
 620 NAME="AEN15"
 621 >Chapter 1. How to Install and Test SAMBA</A
 622 ></H1
 623 ><DIV
 624 CLASS="SECT1"
 625 ><H1
 626 CLASS="SECT1"
 627 ><A
 628 NAME="AEN17"
 629 >1.1. Step 0: Read the man pages</A
 630 ></H1
 631 ><P
 632 >The man pages distributed with SAMBA contain
 633         lots of useful info that will help to get you started.
 634         If you don't know how to read man pages then try
 635         something like:</P
 636 ><P
 637 ><TT
 638 CLASS="PROMPT"
 639 >$ </TT
 640 ><TT
 641 CLASS="USERINPUT"
 642 ><B
 643 >nroff -man smbd.8 | more
 644         </B
 645 ></TT
 646 ></P
 647 ><P
 648 >Other sources of information are pointed to
 649         by the Samba web site,<A
 650 HREF="http://www.samba.org/"
 651 TARGET="_top"
 652 >       http://www.samba.org</A
 653 ></P
 654 ></DIV
 655 ><DIV
 656 CLASS="SECT1"
 657 ><HR><H1
 658 CLASS="SECT1"
 659 ><A
 660 NAME="AEN25"
 661 >1.2. Step 1: Building the Binaries</A
 662 ></H1
 663 ><P
 664 >To do this, first run the program <B
 665 CLASS="COMMAND"
 666 >./configure
 667         </B
 668 > in the source directory. This should automatically
 669         configure Samba for your operating system. If you have unusual
 670         needs then you may wish to run</P
 671 ><P
 672 ><TT
 673 CLASS="PROMPT"
 674 >root# </TT
 675 ><TT
 676 CLASS="USERINPUT"
 677 ><B
 678 >./configure --help
 679         </B
 680 ></TT
 681 ></P
 682 ><P
 683 >first to see what special options you can enable.
 684         Then exectuting</P
 685 ><P
 686 ><TT
 687 CLASS="PROMPT"
 688 >root# </TT
 689 ><TT
 690 CLASS="USERINPUT"
 691 ><B
 692 >make</B
 693 ></TT
 694 ></P
 695 ><P
 696 >will create the binaries. Once it's successfully
 697         compiled you can use </P
 698 ><P
 699 ><TT
 700 CLASS="PROMPT"
 701 >root# </TT
 702 ><TT
 703 CLASS="USERINPUT"
 704 ><B
 705 >make install</B
 706 ></TT
 707 ></P
 708 ><P
 709 >to install the binaries and manual pages. You can
 710         separately install the binaries and/or man pages using</P
 711 ><P
 712 ><TT
 713 CLASS="PROMPT"
 714 >root# </TT
 715 ><TT
 716 CLASS="USERINPUT"
 717 ><B
 718 >make installbin
 719         </B
 720 ></TT
 721 ></P
 722 ><P
 723 >and</P
 724 ><P
 725 ><TT
 726 CLASS="PROMPT"
 727 >root# </TT
 728 ><TT
 729 CLASS="USERINPUT"
 730 ><B
 731 >make installman
 732         </B
 733 ></TT
 734 ></P
 735 ><P
 736 >Note that if you are upgrading for a previous version
 737         of Samba you might like to know that the old versions of
 738         the binaries will be renamed with a ".old" extension. You
 739         can go back to the previous version with</P
 740 ><P
 741 ><TT
 742 CLASS="PROMPT"
 743 >root# </TT
 744 ><TT
 745 CLASS="USERINPUT"
 746 ><B
 747 >make revert
 748         </B
 749 ></TT
 750 ></P
 751 ><P
 752 >if you find this version a disaster!</P
 753 ></DIV
 754 ><DIV
 755 CLASS="SECT1"
 756 ><HR><H1
 757 CLASS="SECT1"
 758 ><A
 759 NAME="AEN53"
 760 >1.3. Step 2: The all important step</A
 761 ></H1
 762 ><P
 763 >At this stage you must fetch yourself a
 764         coffee or other drink you find stimulating. Getting the rest
 765         of the install right can sometimes be tricky, so you will
 766         probably need it.</P
 767 ><P
 768 >If you have installed samba before then you can skip
 769         this step.</P
 770 ></DIV
 771 ><DIV
 772 CLASS="SECT1"
 773 ><HR><H1
 774 CLASS="SECT1"
 775 ><A
 776 NAME="AEN57"
 777 >1.4. Step 3: Create the smb configuration file.</A
 778 ></H1
 779 ><P
 780 >There are sample configuration files in the examples
 781         subdirectory in the distribution. I suggest you read them
 782         carefully so you can see how the options go together in
 783         practice. See the man page for all the options.</P
 784 ><P
 785 >The simplest useful configuration file would be
 786         something like this:</P
 787 ><P
 788 ><TABLE
 789 BORDER="0"
 790 BGCOLOR="#E0E0E0"
 791 WIDTH="100%"
 792 ><TR
 793 ><TD
 794 ><PRE
 795 CLASS="PROGRAMLISTING"
 796 >       [global]
 797            workgroup = MYGROUP
 798
 799            [homes]
 800               guest ok = no
 801               read only = no
 802         </PRE
 803 ></TD
 804 ></TR
 805 ></TABLE
 806 ></P
 807 ><P
 808 >which would allow connections by anyone with an
 809         account on the server, using either their login name or
 810         "homes" as the service name. (Note that I also set the
 811         workgroup that Samba is part of. See BROWSING.txt for defails)</P
 812 ><P
 813 >Note that <B
 814 CLASS="COMMAND"
 815 >make install</B
 816 > will not install
 817         a <TT
 818 CLASS="FILENAME"
 819 >smb.conf</TT
 820 > file. You need to create it
 821         yourself. </P
 822 ><P
 823 >Make sure you put the smb.conf file in the same place
 824         you specified in the<TT
 825 CLASS="FILENAME"
 826 >Makefile</TT
 827 > (the default is to
 828         look for it in <TT
 829 CLASS="FILENAME"
 830 >/usr/local/samba/lib/</TT
 831 >).</P
 832 ><P
 833 >For more information about security settings for the
 834         [homes] share please refer to the document UNIX_SECURITY.txt.</P
 835 ></DIV
 836 ><DIV
 837 CLASS="SECT1"
 838 ><HR><H1
 839 CLASS="SECT1"
 840 ><A
 841 NAME="AEN71"
 842 >1.5. Step 4: Test your config file with
 843         <B
 844 CLASS="COMMAND"
 845 >testparm</B
 846 ></A
 847 ></H1
 848 ><P
 849 >It's important that you test the validity of your
 850         <TT
 851 CLASS="FILENAME"
 852 >smb.conf</TT
 853 > file using the testparm program.
 854         If testparm runs OK then it will list the loaded services. If
 855         not it will give an error message.</P
 856 ><P
 857 >Make sure it runs OK and that the services look
 858         resonable before proceeding. </P
 859 ></DIV
 860 ><DIV
 861 CLASS="SECT1"
 862 ><HR><H1
 863 CLASS="SECT1"
 864 ><A
 865 NAME="AEN77"
 866 >1.6. Step 5: Starting the smbd and nmbd</A
 867 ></H1
 868 ><P
 869 >You must choose to start smbd and nmbd either
 870         as daemons or from <B
 871 CLASS="COMMAND"
 872 >inetd</B
 873 >. Don't try
 874         to do both!  Either you can put them in <TT
 875 CLASS="FILENAME"
 876 >       inetd.conf</TT
 877 > and have them started on demand
 878         by <B
 879 CLASS="COMMAND"
 880 >inetd</B
 881 >, or you can start them as
 882         daemons either from the command line or in <TT
 883 CLASS="FILENAME"
 884 >       /etc/rc.local</TT
 885 >. See the man pages for details
 886         on the command line options. Take particular care to read
 887         the bit about what user you need to be in order to start
 888         Samba.  In many cases you must be root.</P
 889 ><P
 890 >The main advantage of starting <B
 891 CLASS="COMMAND"
 892 >smbd</B
 893 >
 894         and <B
 895 CLASS="COMMAND"
 896 >nmbd</B
 897 > as a daemon is that they will
 898         respond slightly more quickly to an initial connection
 899         request. This is, however, unlikely to be a problem.</P
 900 ><DIV
 901 CLASS="SECT2"
 902 ><HR><H2
 903 CLASS="SECT2"
 904 ><A
 905 NAME="AEN87"
 906 >1.6.1. Step 5a: Starting from inetd.conf</A
 907 ></H2
 908 ><P
 909 >NOTE; The following will be different if
 910                 you use NIS or NIS+ to distributed services maps.</P
 911 ><P
 912 >Look at your <TT
 913 CLASS="FILENAME"
 914 >/etc/services</TT
 915 >.
 916                 What is defined at port 139/tcp. If nothing is defined
 917                 then add a line like this:</P
 918 ><P
 919 ><TT
 920 CLASS="USERINPUT"
 921 ><B
 922 >netbios-ssn     139/tcp</B
 923 ></TT
 924 ></P
 925 ><P
 926 >similarly for 137/udp you should have an entry like:</P
 927 ><P
 928 ><TT
 929 CLASS="USERINPUT"
 930 ><B
 931 >netbios-ns     137/udp</B
 932 ></TT
 933 ></P
 934 ><P
 935 >Next edit your <TT
 936 CLASS="FILENAME"
 937 >/etc/inetd.conf</TT
 938 >
 939                 and add two lines something like this:</P
 940 ><P
 941 ><TABLE
 942 BORDER="0"
 943 BGCOLOR="#E0E0E0"
 944 WIDTH="100%"
 945 ><TR
 946 ><TD
 947 ><PRE
 948 CLASS="PROGRAMLISTING"
 949 >               netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
 950                 netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
 951                 </PRE
 952 ></TD
 953 ></TR
 954 ></TABLE
 955 ></P
 956 ><P
 957 >The exact syntax of <TT
 958 CLASS="FILENAME"
 959 >/etc/inetd.conf</TT
 960 >
 961                 varies between unixes. Look at the other entries in inetd.conf
 962                 for a guide.</P
 963 ><P
 964 >NOTE: Some unixes already have entries like netbios_ns
 965                 (note the underscore) in <TT
 966 CLASS="FILENAME"
 967 >/etc/services</TT
 968 >.
 969                 You must either edit <TT
 970 CLASS="FILENAME"
 971 >/etc/services</TT
 972 > or
 973                 <TT
 974 CLASS="FILENAME"
 975 >/etc/inetd.conf</TT
 976 > to make them consistant.</P
 977 ><P
 978 >NOTE: On many systems you may need to use the
 979                 "interfaces" option in smb.conf to specify the IP address
 980                 and netmask of your interfaces. Run <B
 981 CLASS="COMMAND"
 982 >ifconfig</B
 983 >
 984                 as root if you don't know what the broadcast is for your
 985                 net. <B
 986 CLASS="COMMAND"
 987 >nmbd</B
 988 > tries to determine it at run
 989                 time, but fails on somunixes. See the section on "testing nmbd"
 990                 for a method of finding if you need to do this.</P
 991 ><P
 992 >!!!WARNING!!! Many unixes only accept around 5
 993                 parameters on the command line in <TT
 994 CLASS="FILENAME"
 995 >inetd.conf</TT
 996 >.
 997                 This means you shouldn't use spaces between the options and
 998                 arguments, or you should use a script, and start the script
 999                 from <B
1000 CLASS="COMMAND"
1001 >inetd</B
1002 >.</P
1003 ><P
1004 >Restart <B
1005 CLASS="COMMAND"
1006 >inetd</B
1007 >, perhaps just send
1008                 it a HUP. If you have installed an earlier version of <B
1009 CLASS="COMMAND"
1010 >               nmbd</B
1011 > then you may need to kill nmbd as well.</P
1012 ></DIV
1013 ><DIV
1014 CLASS="SECT2"
1015 ><HR><H2
1016 CLASS="SECT2"
1017 ><A
1018 NAME="AEN116"
1019 >1.6.2. Step 5b. Alternative: starting it as a daemon</A
1020 ></H2
1021 ><P
1022 >To start the server as a daemon you should create
1023                 a script something like this one, perhaps calling
1024                 it <TT
1025 CLASS="FILENAME"
1026 >startsmb</TT
1027 >.</P
1028 ><P
1029 ><TABLE
1030 BORDER="0"
1031 BGCOLOR="#E0E0E0"
1032 WIDTH="100%"
1033 ><TR
1034 ><TD
1035 ><PRE
1036 CLASS="PROGRAMLISTING"
1037 >               #!/bin/sh
1038                 /usr/local/samba/bin/smbd -D
1039                 /usr/local/samba/bin/nmbd -D
1040                 </PRE
1041 ></TD
1042 ></TR
1043 ></TABLE
1044 ></P
1045 ><P
1046 >then make it executable with <B
1047 CLASS="COMMAND"
1048 >chmod
1049                 +x startsmb</B
1050 ></P
1051 ><P
1052 >You can then run <B
1053 CLASS="COMMAND"
1054 >startsmb</B
1055 > by
1056                 hand or execute it from <TT
1057 CLASS="FILENAME"
1058 >/etc/rc.local</TT
1059 >
1060                 </P
1061 ><P
1062 >To kill it send a kill signal to the processes
1063                 <B
1064 CLASS="COMMAND"
1065 >nmbd</B
1066 > and <B
1067 CLASS="COMMAND"
1068 >smbd</B
1069 >.</P
1070 ><P
1071 >NOTE: If you use the SVR4 style init system then
1072                 you may like to look at the <TT
1073 CLASS="FILENAME"
1074 >examples/svr4-startup</TT
1075 >
1076                 script to make Samba fit into that system.</P
1077 ></DIV
1078 ></DIV
1079 ><DIV
1080 CLASS="SECT1"
1081 ><HR><H1
1082 CLASS="SECT1"
1083 ><A
1084 NAME="AEN132"
1085 >1.7. Step 6: Try listing the shares available on your
1086         server</A
1087 ></H1
1088 ><P
1089 ><TT
1090 CLASS="PROMPT"
1091 >$ </TT
1092 ><TT
1093 CLASS="USERINPUT"
1094 ><B
1095 >smbclient -L
1096         <TT
1097 CLASS="REPLACEABLE"
1098 ><I
1099 >yourhostname</I
1100 ></TT
1101 ></B
1102 ></TT
1103 ></P
1104 ><P
1105 >Your should get back a list of shares available on
1106         your server. If you don't then something is incorrectly setup.
1107         Note that this method can also be used to see what shares
1108         are available on other LanManager clients (such as WfWg).</P
1109 ><P
1110 >If you choose user level security then you may find
1111         that Samba requests a password before it will list the shares.
1112         See the <B
1113 CLASS="COMMAND"
1114 >smbclient</B
1115 > man page for details. (you
1116         can force it to list the shares without a password by
1117         adding the option -U% to the command line. This will not work
1118         with non-Samba servers)</P
1119 ></DIV
1120 ><DIV
1121 CLASS="SECT1"
1122 ><HR><H1
1123 CLASS="SECT1"
1124 ><A
1125 NAME="AEN141"
1126 >1.8. Step 7: Try connecting with the unix client</A
1127 ></H1
1128 ><P
1129 ><TT
1130 CLASS="PROMPT"
1131 >$ </TT
1132 ><TT
1133 CLASS="USERINPUT"
1134 ><B
1135 >smbclient <TT
1136 CLASS="REPLACEABLE"
1137 ><I
1138 >       //yourhostname/aservice</I
1139 ></TT
1140 ></B
1141 ></TT
1142 ></P
1143 ><P
1144 >Typically the <TT
1145 CLASS="REPLACEABLE"
1146 ><I
1147 >yourhostname</I
1148 ></TT
1149 >
1150         would be the name of the host where you installed <B
1151 CLASS="COMMAND"
1152 >       smbd</B
1153 >. The <TT
1154 CLASS="REPLACEABLE"
1155 ><I
1156 >aservice</I
1157 ></TT
1158 > is
1159         any service you have defined in the <TT
1160 CLASS="FILENAME"
1161 >smb.conf</TT
1162 >
1163         file. Try your user name if you just have a [homes] section
1164         in <TT
1165 CLASS="FILENAME"
1166 >smb.conf</TT
1167 >.</P
1168 ><P
1169 >For example if your unix host is bambi and your login
1170         name is fred you would type:</P
1171 ><P
1172 ><TT
1173 CLASS="PROMPT"
1174 >$ </TT
1175 ><TT
1176 CLASS="USERINPUT"
1177 ><B
1178 >smbclient //bambi/fred
1179         </B
1180 ></TT
1181 ></P
1182 ></DIV
1183 ><DIV
1184 CLASS="SECT1"
1185 ><HR><H1
1186 CLASS="SECT1"
1187 ><A
1188 NAME="AEN157"
1189 >1.9. Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT,
1190         Win2k, OS/2, etc... client</A
1191 ></H1
1192 ><P
1193 >Try mounting disks. eg:</P
1194 ><P
1195 ><TT
1196 CLASS="PROMPT"
1197 >C:\WINDOWS\&#62; </TT
1198 ><TT
1199 CLASS="USERINPUT"
1200 ><B
1201 >net use d: \\servername\service
1202         </B
1203 ></TT
1204 ></P
1205 ><P
1206 >Try printing. eg:</P
1207 ><P
1208 ><TT
1209 CLASS="PROMPT"
1210 >C:\WINDOWS\&#62; </TT
1211 ><TT
1212 CLASS="USERINPUT"
1213 ><B
1214 >net use lpt1:
1215         \\servername\spoolservice</B
1216 ></TT
1217 ></P
1218 ><P
1219 ><TT
1220 CLASS="PROMPT"
1221 >C:\WINDOWS\&#62; </TT
1222 ><TT
1223 CLASS="USERINPUT"
1224 ><B
1225 >print filename
1226         </B
1227 ></TT
1228 ></P
1229 ><P
1230 >Celebrate, or send me a bug report!</P
1231 ></DIV
1232 ><DIV
1233 CLASS="SECT1"
1234 ><HR><H1
1235 CLASS="SECT1"
1236 ><A
1237 NAME="AEN171"
1238 >1.10. What If Things Don't Work?</A
1239 ></H1
1240 ><P
1241 >If nothing works and you start to think "who wrote
1242         this pile of trash" then I suggest you do step 2 again (and
1243         again) till you calm down.</P
1244 ><P
1245 >Then you might read the file DIAGNOSIS.txt and the
1246         FAQ. If you are still stuck then try the mailing list or
1247         newsgroup (look in the README for details). Samba has been
1248         successfully installed at thousands of sites worldwide, so maybe
1249         someone else has hit your problem and has overcome it. You could
1250         also use the WWW site to scan back issues of the samba-digest.</P
1251 ><P
1252 >When you fix the problem PLEASE send me some updates to the
1253         documentation (or source code) so that the next person will find it
1254         easier. </P
1255 ><DIV
1256 CLASS="SECT2"
1257 ><HR><H2
1258 CLASS="SECT2"
1259 ><A
1260 NAME="AEN176"
1261 >1.10.1. Diagnosing Problems</A
1262 ></H2
1263 ><P
1264 >If you have instalation problems then go to
1265                 <TT
1266 CLASS="FILENAME"
1267 >DIAGNOSIS.txt</TT
1268 > to try to find the
1269                 problem.</P
1270 ></DIV
1271 ><DIV
1272 CLASS="SECT2"
1273 ><HR><H2
1274 CLASS="SECT2"
1275 ><A
1276 NAME="AEN180"
1277 >1.10.2. Scope IDs</A
1278 ></H2
1279 ><P
1280 >By default Samba uses a blank scope ID. This means
1281                 all your windows boxes must also have a blank scope ID.
1282                 If you really want to use a non-blank scope ID then you will
1283                 need to use the -i &#60;scope&#62; option to nmbd, smbd, and
1284                 smbclient. All your PCs will need to have the same setting for
1285                 this to work. I do not recommend scope IDs.</P
1286 ></DIV
1287 ><DIV
1288 CLASS="SECT2"
1289 ><HR><H2
1290 CLASS="SECT2"
1291 ><A
1292 NAME="AEN183"
1293 >1.10.3. Choosing the Protocol Level</A
1294 ></H2
1295 ><P
1296 >The SMB protocol has many dialects. Currently
1297                 Samba supports 5, called CORE, COREPLUS, LANMAN1,
1298                 LANMAN2 and NT1.</P
1299 ><P
1300 >You can choose what maximum protocol to support
1301                 in the <TT
1302 CLASS="FILENAME"
1303 >smb.conf</TT
1304 > file. The default is
1305                 NT1 and that is the best for the vast majority of sites.</P
1306 ><P
1307 >In older versions of Samba you may have found it
1308                 necessary to use COREPLUS. The limitations that led to
1309                 this have mostly been fixed. It is now less likely that you
1310                 will want to use less than LANMAN1. The only remaining advantage
1311                 of COREPLUS is that for some obscure reason WfWg preserves
1312                 the case of passwords in this protocol, whereas under LANMAN1,
1313                 LANMAN2 or NT1 it uppercases all passwords before sending them,
1314                 forcing you to use the "password level=" option in some cases.</P
1315 ><P
1316 >The main advantage of LANMAN2 and NT1 is support for
1317                 long filenames with some clients (eg: smbclient, Windows NT
1318                 or Win95). </P
1319 ><P
1320 >See the smb.conf(5) manual page for more details.</P
1321 ><P
1322 >Note: To support print queue reporting you may find
1323                 that you have to use TCP/IP as the default protocol under
1324                 WfWg. For some reason if you leave Netbeui as the default
1325                 it may break the print queue reporting on some systems.
1326                 It is presumably a WfWg bug.</P
1327 ></DIV
1328 ><DIV
1329 CLASS="SECT2"
1330 ><HR><H2
1331 CLASS="SECT2"
1332 ><A
1333 NAME="AEN192"
1334 >1.10.4. Printing from UNIX to a Client PC</A
1335 ></H2
1336 ><P
1337 >To use a printer that is available via a smb-based
1338                 server from a unix host you will need to compile the
1339                 smbclient program. You then need to install the script
1340                 "smbprint". Read the instruction in smbprint for more details.
1341                 </P
1342 ><P
1343 >There is also a SYSV style script that does much
1344                 the same thing called smbprint.sysv. It contains instructions.</P
1345 ></DIV
1346 ><DIV
1347 CLASS="SECT2"
1348 ><HR><H2
1349 CLASS="SECT2"
1350 ><A
1351 NAME="AEN196"
1352 >1.10.5. Locking</A
1353 ></H2
1354 ><P
1355 >One area which sometimes causes trouble is locking.</P
1356 ><P
1357 >There are two types of locking which need to be
1358                 performed by a SMB server. The first is "record locking"
1359                 which allows a client to lock a range of bytes in a open file.
1360                 The second is the "deny modes" that are specified when a file
1361                 is open.</P
1362 ><P
1363 >Samba supports "record locking" using the fcntl() unix system
1364                 call. This is often implemented using rpc calls to a rpc.lockd process
1365                 running on the system that owns the filesystem. Unfortunately many
1366                 rpc.lockd implementations are very buggy, particularly when made to
1367                 talk to versions from other vendors. It is not uncommon for the
1368                 rpc.lockd to crash.</P
1369 ><P
1370 >There is also a problem translating the 32 bit lock
1371                 requests generated by PC clients to 31 bit requests supported
1372                 by most unixes. Unfortunately many PC applications (typically
1373                 OLE2 applications) use byte ranges with the top bit set
1374                 as semaphore sets. Samba attempts translation to support
1375                 these types of applications, and the translation has proved
1376                 to be quite successful.</P
1377 ><P
1378 >Strictly a SMB server should check for locks before
1379                 every read and write call on a file. Unfortunately with the
1380                 way fcntl() works this can be slow and may overstress the
1381                 rpc.lockd. It is also almost always unnecessary as clients
1382                 are supposed to independently make locking calls before reads
1383                 and writes anyway if locking is important to them. By default
1384                 Samba only makes locking calls when explicitly asked
1385                 to by a client, but if you set "strict locking = yes" then it will
1386                 make lock checking calls on every read and write. </P
1387 ><P
1388 >You can also disable by range locking completely
1389                 using "locking = no". This is useful for those shares that
1390                 don't support locking or don't need it (such as cdroms). In
1391                 this case Samba fakes the return codes of locking calls to
1392                 tell clients that everything is OK.</P
1393 ><P
1394 >The second class of locking is the "deny modes". These
1395                 are set by an application when it opens a file to determine
1396                 what types of access should be allowed simultaneously with
1397                 its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE
1398                 or DENY_ALL. There are also special compatability modes called
1399                 DENY_FCB and  DENY_DOS.</P
1400 ><P
1401 >You can disable share modes using "share modes = no".
1402                 This may be useful on a heavily loaded server as the share
1403                 modes code is very slow. See also the FAST_SHARE_MODES
1404                 option in the Makefile for a way to do full share modes
1405                 very fast using shared memory (if your OS supports it).</P
1406 ></DIV
1407 ><DIV
1408 CLASS="SECT2"
1409 ><HR><H2
1410 CLASS="SECT2"
1411 ><A
1412 NAME="AEN206"
1413 >1.10.6. Mapping Usernames</A
1414 ></H2
1415 ><P
1416 >If you have different usernames on the PCs and
1417                 the unix server then take a look at the "username map" option.
1418                 See the smb.conf man page for details.</P
1419 ></DIV
1420 ><DIV
1421 CLASS="SECT2"
1422 ><HR><H2
1423 CLASS="SECT2"
1424 ><A
1425 NAME="AEN209"
1426 >1.10.7. Other Character Sets</A
1427 ></H2
1428 ><P
1429 >If you have problems using filenames with accented
1430                 characters in them (like the German, French or Scandinavian
1431                 character sets) then I recommmend you look at the "valid chars"
1432                 option in smb.conf and also take a look at the validchars
1433                 package in the examples directory.</P
1434 ></DIV
1435 ></DIV
1436 ></DIV
1437 ><DIV
1438 CLASS="CHAPTER"
1439 ><HR><H1
1440 ><A
1441 NAME="AEN212"
1442 >Chapter 2. LanMan and NT Password Encryption in Samba 2.x</A
1443 ></H1
1444 ><DIV
1445 CLASS="SECT1"
1446 ><H1
1447 CLASS="SECT1"
1448 ><A
1449 NAME="AEN223"
1450 >2.1. Introduction</A
1451 ></H1
1452 ><P
1453 >With the development of LanManager and Windows NT
1454         compatible password encryption for Samba, it is now able
1455         to validate user connections in exactly the same way as
1456         a LanManager or Windows NT server.</P
1457 ><P
1458 >This document describes how the SMB password encryption
1459         algorithm works and what issues there are in choosing whether
1460         you want to use it. You should read it carefully, especially
1461         the part about security and the "PROS and CONS" section.</P
1462 ></DIV
1463 ><DIV
1464 CLASS="SECT1"
1465 ><HR><H1
1466 CLASS="SECT1"
1467 ><A
1468 NAME="AEN227"
1469 >2.2. How does it work?</A
1470 ></H1
1471 ><P
1472 >LanManager encryption is somewhat similar to UNIX
1473         password encryption. The server uses a file containing a
1474         hashed value of a user's password.  This is created by taking
1475         the user's plaintext password, capitalising it, and either
1476         truncating to 14 bytes or padding to 14 bytes with null bytes.
1477         This 14 byte value is used as two 56 bit DES keys to encrypt
1478         a 'magic' eight byte value, forming a 16 byte value which is
1479         stored by the server and client. Let this value be known as
1480         the "hashed password".</P
1481 ><P
1482 >Windows NT encryption is a higher quality mechanism,
1483         consisting of doing an MD4 hash on a Unicode version of the user's
1484         password. This also produces a 16 byte hash value that is
1485         non-reversible.</P
1486 ><P
1487 >When a client (LanManager, Windows for WorkGroups, Windows
1488         95 or Windows NT) wishes to mount a Samba drive (or use a Samba
1489         resource), it first requests a connection and negotiates the
1490         protocol that the client and server will use. In the reply to this
1491         request the Samba server generates and appends an 8 byte, random
1492         value - this is stored in the Samba server after the reply is sent
1493         and is known as the "challenge".  The challenge is different for
1494         every client connection.</P
1495 ><P
1496 >The client then uses the hashed password (16 byte values
1497         described above), appended with 5 null bytes, as three 56 bit
1498         DES keys, each of which is used to encrypt the challenge 8 byte
1499         value, forming a 24 byte value known as the "response".</P
1500 ><P
1501 >In the SMB call SMBsessionsetupX (when user level security
1502         is selected) or the call SMBtconX (when share level security is
1503         selected), the 24 byte response is returned by the client to the
1504         Samba server.  For Windows NT protocol levels the above calculation
1505         is done on both hashes of the user's password and both responses are
1506         returned in the SMB call, giving two 24 byte values.</P
1507 ><P
1508 >The Samba server then reproduces the above calculation, using
1509         its own stored value of the 16 byte hashed password (read from the
1510         <TT
1511 CLASS="FILENAME"
1512 >smbpasswd</TT
1513 > file - described later) and the challenge
1514         value that it kept from the negotiate protocol reply. It then checks
1515         to see if the 24 byte value it calculates matches the 24 byte value
1516         returned to it from the client.</P
1517 ><P
1518 >If these values match exactly, then the client knew the
1519         correct password (or the 16 byte hashed value - see security note
1520         below) and is thus allowed access. If not, then the client did not
1521         know the correct password and is denied access.</P
1522 ><P
1523 >Note that the Samba server never knows or stores the cleartext
1524         of the user's password - just the 16 byte hashed values derived from
1525         it. Also note that the cleartext password or 16 byte hashed values
1526         are never transmitted over the network - thus increasing security.</P
1527 ></DIV
1528 ><DIV
1529 CLASS="SECT1"
1530 ><HR><H1
1531 CLASS="SECT1"
1532 ><A
1533 NAME="AEN238"
1534 >2.3. Important Notes About Security</A
1535 ></H1
1536 ><P
1537 >The unix and SMB password encryption techniques seem similar
1538         on the surface. This similarity is, however, only skin deep. The unix
1539         scheme typically sends clear text passwords over the nextwork when
1540         logging in. This is bad. The SMB encryption scheme never sends the
1541         cleartext password over the network but it does store the 16 byte
1542         hashed values on disk. This is also bad. Why? Because the 16 byte hashed
1543         values are a "password equivalent". You cannot derive the user's
1544         password from them, but they could potentially be used in a modified
1545         client to gain access to a server. This would require considerable
1546         technical knowledge on behalf of the attacker but is perfectly possible.
1547         You should thus treat the smbpasswd file as though it contained the
1548         cleartext passwords of all your users. Its contents must be kept
1549         secret, and the file should be protected accordingly.</P
1550 ><P
1551 >Ideally we would like a password scheme which neither requires
1552         plain text passwords on the net or on disk. Unfortunately this
1553         is not available as Samba is stuck with being compatible with
1554         other SMB systems (WinNT, WfWg, Win95 etc). </P
1555 ><DIV
1556 CLASS="WARNING"
1557 ><P
1558 ></P
1559 ><TABLE
1560 CLASS="WARNING"
1561 BORDER="1"
1562 WIDTH="100%"
1563 ><TR
1564 ><TD
1565 ALIGN="CENTER"
1566 ><B
1567 >Warning</B
1568 ></TD
1569 ></TR
1570 ><TR
1571 ><TD
1572 ALIGN="LEFT"
1573 ><P
1574 >Note that Windows NT 4.0 Service pack 3 changed the
1575                 default for permissible authentication so that plaintext
1576                 passwords are <EM
1577 >never</EM
1578 > sent over the wire.
1579                 The solution to this is either to switch to encrypted passwords
1580                 with Samba or edit the Windows NT registry to re-enable plaintext
1581                 passwords. See the document WinNT.txt for details on how to do
1582                 this.</P
1583 ><P
1584 >Other Microsoft operating systems which also exhibit
1585                 this behavior includes</P
1586 ><P
1587 ></P
1588 ><UL
1589 ><LI
1590 ><P
1591 >MS DOS Network client 3.0 with
1592                         the basic network redirector installed</P
1593 ></LI
1594 ><LI
1595 ><P
1596 >Windows 95 with the network redirector
1597                         update installed</P
1598 ></LI
1599 ><LI
1600 ><P
1601 >Windows 98 [se]</P
1602 ></LI
1603 ><LI
1604 ><P
1605 >Windows 2000</P
1606 ></LI
1607 ></UL
1608 ><P
1609 ><EM
1610 >Note :</EM
1611 >All current release of
1612                 Microsoft SMB/CIFS clients support authentication via the
1613                 SMB Challenge/Response mechanism described here.  Enabling
1614                 clear text authentication does not disable the ability
1615                 of the client to particpate in encrypted authentication.</P
1616 ></TD
1617 ></TR
1618 ></TABLE
1619 ></DIV
1620 ><DIV
1621 CLASS="SECT2"
1622 ><HR><H2
1623 CLASS="SECT2"
1624 ><A
1625 NAME="AEN257"
1626 >2.3.1. Advantages of SMB Encryption</A
1627 ></H2
1628 ><P
1629 ></P
1630 ><UL
1631 ><LI
1632 ><P
1633 >plain text passwords are not passed across
1634                         the network. Someone using a network sniffer cannot just
1635                         record passwords going to the SMB server.</P
1636 ></LI
1637 ><LI
1638 ><P
1639 >WinNT doesn't like talking to a server
1640                         that isn't using SMB encrypted passwords. It will refuse
1641                         to browse the server if the server is also in user level
1642                         security mode. It will insist on prompting the user for the
1643                         password on each connection, which is very annoying. The
1644                         only things you can do to stop this is to use SMB encryption.
1645                         </P
1646 ></LI
1647 ></UL
1648 ></DIV
1649 ><DIV
1650 CLASS="SECT2"
1651 ><HR><H2
1652 CLASS="SECT2"
1653 ><A
1654 NAME="AEN264"
1655 >2.3.2. Advantages of non-encrypted passwords</A
1656 ></H2
1657 ><P
1658 ></P
1659 ><UL
1660 ><LI
1661 ><P
1662 >plain text passwords are not kept
1663                         on disk. </P
1664 ></LI
1665 ><LI
1666 ><P
1667 >uses same password file as other unix
1668                         services such as login and ftp</P
1669 ></LI
1670 ><LI
1671 ><P
1672 >you are probably already using other
1673                         services (such as telnet and ftp) which send plain text
1674                         passwords over the net, so sending them for SMB isn't
1675                         such a big deal.</P
1676 ></LI
1677 ></UL
1678 ></DIV
1679 ></DIV
1680 ><DIV
1681 CLASS="SECT1"
1682 ><HR><H1
1683 CLASS="SECT1"
1684 ><A
1685 NAME="AEN273"
1686 >2.4. <A
1687 NAME="SMBPASSWDFILEFORMAT"
1688 ></A
1689 >The smbpasswd file</A
1690 ></H1
1691 ><P
1692 >In order for Samba to participate in the above protocol
1693         it must be able to look up the 16 byte hashed values given a user name.
1694         Unfortunately, as the UNIX password value is also a one way hash
1695         function (ie. it is impossible to retrieve the cleartext of the user's
1696         password given the UNIX hash of it), a separate password file
1697         containing this 16 byte value must be kept. To minimise problems with
1698         these two password files, getting out of sync, the UNIX <TT
1699 CLASS="FILENAME"
1700 >       /etc/passwd</TT
1701 > and the <TT
1702 CLASS="FILENAME"
1703 >smbpasswd</TT
1704 > file,
1705         a utility, <B
1706 CLASS="COMMAND"
1707 >mksmbpasswd.sh</B
1708 >, is provided to generate
1709         a smbpasswd file from a UNIX <TT
1710 CLASS="FILENAME"
1711 >/etc/passwd</TT
1712 > file.
1713         </P
1714 ><P
1715 >To generate the smbpasswd file from your <TT
1716 CLASS="FILENAME"
1717 >/etc/passwd
1718         </TT
1719 > file use the following command :</P
1720 ><P
1721 ><TT
1722 CLASS="PROMPT"
1723 >$ </TT
1724 ><TT
1725 CLASS="USERINPUT"
1726 ><B
1727 >cat /etc/passwd | mksmbpasswd.sh
1728         &#62; /usr/local/samba/private/smbpasswd</B
1729 ></TT
1730 ></P
1731 ><P
1732 >If you are running on a system that uses NIS, use</P
1733 ><P
1734 ><TT
1735 CLASS="PROMPT"
1736 >$ </TT
1737 ><TT
1738 CLASS="USERINPUT"
1739 ><B
1740 >ypcat passwd | mksmbpasswd.sh
1741         &#62; /usr/local/samba/private/smbpasswd</B
1742 ></TT
1743 ></P
1744 ><P
1745 >The <B
1746 CLASS="COMMAND"
1747 >mksmbpasswd.sh</B
1748 > program is found in
1749         the Samba source directory. By default, the smbpasswd file is
1750         stored in :</P
1751 ><P
1752 ><TT
1753 CLASS="FILENAME"
1754 >/usr/local/samba/private/smbpasswd</TT
1755 ></P
1756 ><P
1757 >The owner of the <TT
1758 CLASS="FILENAME"
1759 >/usr/local/samba/private/</TT
1760 >
1761         directory should be set to root, and the permissions on it should
1762         be set to 0500 (<B
1763 CLASS="COMMAND"
1764 >chmod 500 /usr/local/samba/private</B
1765 >).
1766         </P
1767 ><P
1768 >Likewise, the smbpasswd file inside the private directory should
1769         be owned by root and the permissions on is should be set to 0600
1770         (<B
1771 CLASS="COMMAND"
1772 >chmod 600 smbpasswd</B
1773 >).</P
1774 ><P
1775 >The format of the smbpasswd file is (The line has been
1776         wrapped here. It should appear as one entry per line in
1777         your smbpasswd file.)</P
1778 ><P
1779 ><TABLE
1780 BORDER="0"
1781 BGCOLOR="#E0E0E0"
1782 WIDTH="100%"
1783 ><TR
1784 ><TD
1785 ><PRE
1786 CLASS="PROGRAMLISTING"
1787 >username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
1788         [Account type]:LCT-&#60;last-change-time&#62;:Long name
1789         </PRE
1790 ></TD
1791 ></TR
1792 ></TABLE
1793 ></P
1794 ><P
1795 >Although only the <TT
1796 CLASS="REPLACEABLE"
1797 ><I
1798 >username</I
1799 ></TT
1800 >,
1801         <TT
1802 CLASS="REPLACEABLE"
1803 ><I
1804 >uid</I
1805 ></TT
1806 >, <TT
1807 CLASS="REPLACEABLE"
1808 ><I
1809 >       XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</I
1810 ></TT
1811 >,
1812         [<TT
1813 CLASS="REPLACEABLE"
1814 ><I
1815 >Account type</I
1816 ></TT
1817 >] and <TT
1818 CLASS="REPLACEABLE"
1819 ><I
1820 >       last-change-time</I
1821 ></TT
1822 > sections are significant
1823         and are looked at in the Samba code.</P
1824 ><P
1825 >It is <EM
1826 >VITALLY</EM
1827 > important that there by 32
1828         'X' characters between the two ':' characters in the XXX sections -
1829         the smbpasswd and Samba code will fail to validate any entries that
1830         do not have 32 characters  between ':' characters. The first XXX
1831         section is for the Lanman password hash, the second is for the
1832         Windows NT version.</P
1833 ><P
1834 >When the password file is created all users have password entries
1835         consisting of 32 'X' characters. By default this disallows any access
1836         as this user. When a user has a password set, the 'X' characters change
1837         to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii
1838         representation of the 16 byte hashed value of a user's password.</P
1839 ><P
1840 >To set a user to have no password (not recommended), edit the file
1841         using vi, and replace the first 11 characters with the ascii text
1842         <TT
1843 CLASS="CONSTANT"
1844 >"NO PASSWORD"</TT
1845 > (minus the quotes).</P
1846 ><P
1847 >For example, to clear the password for user bob, his smbpasswd file
1848         entry would look like :</P
1849 ><P
1850 ><TABLE
1851 BORDER="0"
1852 BGCOLOR="#E0E0E0"
1853 WIDTH="100%"
1854 ><TR
1855 ><TD
1856 ><PRE
1857 CLASS="PROGRAMLISTING"
1858 >       bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U          ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
1859         </PRE
1860 ></TD
1861 ></TR
1862 ></TABLE
1863 ></P
1864 ><P
1865 >If you are allowing users to use the smbpasswd command to set
1866         their own passwords, you may want to give users NO PASSWORD initially
1867         so they do not have to enter a previous password when changing to their
1868         new password (not recommended). In order for you to allow this the
1869         <B
1870 CLASS="COMMAND"
1871 >smbpasswd</B
1872 > program must be able to connect to the
1873         <B
1874 CLASS="COMMAND"
1875 >smbd</B
1876 > daemon as that user with no password. Enable this
1877         by adding the line :</P
1878 ><P
1879 ><B
1880 CLASS="COMMAND"
1881 >null passwords = yes</B
1882 ></P
1883 ><P
1884 >to the [global] section of the smb.conf file (this is why
1885         the above scenario is not recommended). Preferably, allocate your
1886         users a default password to begin with, so you do not have
1887         to enable this on your server.</P
1888 ><P
1889 ><EM
1890 >Note : </EM
1891 >This file should be protected very
1892         carefully. Anyone with access to this file can (with enough knowledge of
1893         the protocols) gain access to your SMB server. The file is thus more
1894         sensitive than a normal unix <TT
1895 CLASS="FILENAME"
1896 >/etc/passwd</TT
1897 > file.</P
1898 ></DIV
1899 ><DIV
1900 CLASS="SECT1"
1901 ><HR><H1
1902 CLASS="SECT1"
1903 ><A
1904 NAME="AEN325"
1905 >2.5. The smbpasswd Command</A
1906 ></H1
1907 ><P
1908 >The smbpasswd command maintains the two 32 byte password fields
1909         in the smbpasswd file. If you wish to make it similar to the unix
1910         <B
1911 CLASS="COMMAND"
1912 >passwd</B
1913 > or <B
1914 CLASS="COMMAND"
1915 >yppasswd</B
1916 > programs,
1917         install it in <TT
1918 CLASS="FILENAME"
1919 >/usr/local/samba/bin/</TT
1920 > (or your
1921         main Samba binary directory).</P
1922 ><P
1923 >Note that as of Samba 1.9.18p4 this program <EM
1924 >MUST NOT
1925         BE INSTALLED</EM
1926 > setuid root (the new <B
1927 CLASS="COMMAND"
1928 >smbpasswd</B
1929 >
1930         code enforces this restriction so it cannot be run this way by
1931         accident).</P
1932 ><P
1933 ><B
1934 CLASS="COMMAND"
1935 >smbpasswd</B
1936 > now works in a client-server mode
1937         where it contacts the local smbd to change the user's password on its
1938         behalf. This has enormous benefits - as follows.</P
1939 ><P
1940 ></P
1941 ><UL
1942 ><LI
1943 ><P
1944 >smbpasswd no longer has to be setuid root -
1945                 an enormous range of potential security problems is
1946                 eliminated.</P
1947 ></LI
1948 ><LI
1949 ><P
1950 ><B
1951 CLASS="COMMAND"
1952 >smbpasswd</B
1953 > now has the capability
1954                 to change passwords on Windows NT servers (this only works when
1955                 the request is sent to the NT Primary Domain Controller if you
1956                 are changing an NT Domain user's password).</P
1957 ></LI
1958 ></UL
1959 ><P
1960 >To run smbpasswd as a normal user just type :</P
1961 ><P
1962 ><TT
1963 CLASS="PROMPT"
1964 >$ </TT
1965 ><TT
1966 CLASS="USERINPUT"
1967 ><B
1968 >smbpasswd</B
1969 ></TT
1970 ></P
1971 ><P
1972 ><TT
1973 CLASS="PROMPT"
1974 >Old SMB password: </TT
1975 ><TT
1976 CLASS="USERINPUT"
1977 ><B
1978 >&#60;type old value here -
1979         or hit return if there was no old password&#62;</B
1980 ></TT
1981 ></P
1982 ><P
1983 ><TT
1984 CLASS="PROMPT"
1985 >New SMB Password: </TT
1986 ><TT
1987 CLASS="USERINPUT"
1988 ><B
1989 >&#60;type new value&#62;
1990         </B
1991 ></TT
1992 ></P
1993 ><P
1994 ><TT
1995 CLASS="PROMPT"
1996 >Repeat New SMB Password: </TT
1997 ><TT
1998 CLASS="USERINPUT"
1999 ><B
2000 >&#60;re-type new value
2001         </B
2002 ></TT
2003 ></P
2004 ><P
2005 >If the old value does not match the current value stored for
2006         that user, or the two new values do not match each other, then the
2007         password will not be changed.</P
2008 ><P
2009 >If invoked by an ordinary user it will only allow the user
2010         to change his or her own Samba password.</P
2011 ><P
2012 >If run by the root user smbpasswd may take an optional
2013         argument, specifying the user name whose SMB password you wish to
2014         change.  Note that when run as root smbpasswd does not prompt for
2015         or check the old password value, thus allowing root to set passwords
2016         for users who have forgotten their passwords.</P
2017 ><P
2018 ><B
2019 CLASS="COMMAND"
2020 >smbpasswd</B
2021 > is designed to work in the same way
2022         and be familiar to UNIX users who use the <B
2023 CLASS="COMMAND"
2024 >passwd</B
2025 > or
2026         <B
2027 CLASS="COMMAND"
2028 >yppasswd</B
2029 > commands.</P
2030 ><P
2031 >For more details on using <B
2032 CLASS="COMMAND"
2033 >smbpasswd</B
2034 > refer
2035         to the man page which will always be the definitive reference.</P
2036 ></DIV
2037 ><DIV
2038 CLASS="SECT1"
2039 ><HR><H1
2040 CLASS="SECT1"
2041 ><A
2042 NAME="AEN364"
2043 >2.6. Setting up Samba to support LanManager Encryption</A
2044 ></H1
2045 ><P
2046 >This is a very brief description on how to setup samba to
2047         support password encryption. </P
2048 ><P
2049 ></P
2050 ><OL
2051 TYPE="1"
2052 ><LI
2053 ><P
2054 >compile and install samba as usual</P
2055 ></LI
2056 ><LI
2057 ><P
2058 >enable encrypted passwords in <TT
2059 CLASS="FILENAME"
2060 >               smb.conf</TT
2061 > by adding the line <B
2062 CLASS="COMMAND"
2063 >encrypt
2064                 passwords = yes</B
2065 > in the [global] section</P
2066 ></LI
2067 ><LI
2068 ><P
2069 >create the initial <TT
2070 CLASS="FILENAME"
2071 >smbpasswd</TT
2072 >
2073                 password file in the place you specified in the Makefile
2074                 (--prefix=&#60;dir&#62;). See the notes under the <A
2075 HREF="#SMBPASSWDFILEFORMAT"
2076 >The smbpasswd File</A
2077 >
2078                 section earlier in the document for details.</P
2079 ></LI
2080 ></OL
2081 ><P
2082 >Note that you can test things using smbclient.</P
2083 ></DIV
2084 ></DIV
2085 ><DIV
2086 CLASS="CHAPTER"
2087 ><HR><H1
2088 ><A
2089 NAME="AEN379"
2090 >Chapter 3. Hosting a Microsoft Distributed File System tree on Samba</A
2091 ></H1
2092 ><DIV
2093 CLASS="SECT1"
2094 ><H1
2095 CLASS="SECT1"
2096 ><A
2097 NAME="AEN390"
2098 >3.1. Instructions</A
2099 ></H1
2100 ><P
2101 >The Distributed File System (or Dfs) provides a means of
2102         separating the logical view of files and directories that users
2103         see from the actual physical locations of these resources on the
2104         network. It allows for higher availability, smoother storage expansion,
2105         load balancing etc. For more information about Dfs, refer to  <A
2106 HREF="http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp"
2107 TARGET="_top"
2108 >       Microsoft documentation</A
2109 >. </P
2110 ><P
2111 >This document explains how to host a Dfs tree on a Unix
2112         machine (for Dfs-aware clients to browse) using Samba.</P
2113 ><P
2114 >To enable SMB-based DFS for Samba, configure it with the
2115         <TT
2116 CLASS="PARAMETER"
2117 ><I
2118 >--with-msdfs</I
2119 ></TT
2120 > option. Once built, a
2121         Samba server can be made a Dfs server by setting the global
2122         boolean <A
2123 HREF="smb.conf.5.html#HOSTMSDFS"
2124 TARGET="_top"
2125 ><TT
2126 CLASS="PARAMETER"
2127 ><I
2128 >       host msdfs</I
2129 ></TT
2130 ></A
2131 > parameter in the <TT
2132 CLASS="FILENAME"
2133 >smb.conf
2134         </TT
2135 > file. You designate a share as a Dfs root using the share
2136         level boolean <A
2137 HREF="smb.conf.5.html#MSDFSROOT"
2138 TARGET="_top"
2139 ><TT
2140 CLASS="PARAMETER"
2141 ><I
2142 >       msdfs root</I
2143 ></TT
2144 ></A
2145 > parameter. A Dfs root directory on
2146         Samba hosts Dfs links in the form of symbolic links that point
2147         to other servers. For example, a symbolic link
2148         <TT
2149 CLASS="FILENAME"
2150 >junction-&#62;msdfs:storage1\share1</TT
2151 > in
2152         the share directory acts as the Dfs junction. When Dfs-aware
2153         clients attempt to access the junction link, they are redirected
2154         to the storage location (in this case, \\storage1\share1).</P
2155 ><P
2156 >Dfs trees on Samba work with all Dfs-aware clients ranging
2157         from Windows 95 to 2000.</P
2158 ><P
2159 >Here's an example of setting up a Dfs tree on a Samba
2160         server.</P
2161 ><P
2162 ><TABLE
2163 BORDER="0"
2164 BGCOLOR="#E0E0E0"
2165 WIDTH="100%"
2166 ><TR
2167 ><TD
2168 ><PRE
2169 CLASS="PROGRAMLISTING"
2170 ># The smb.conf file:
2171 [global]
2172         netbios name = SAMBA
2173         host msdfs   = yes
2174
2175 [dfs]
2176         path = /export/dfsroot
2177         msdfs root = yes
2178         </PRE
2179 ></TD
2180 ></TR
2181 ></TABLE
2182 ></P
2183 ><P
2184 >In the /export/dfsroot directory we set up our dfs links to
2185         other servers on the network.</P
2186 ><P
2187 ><TT
2188 CLASS="PROMPT"
2189 >root# </TT
2190 ><TT
2191 CLASS="USERINPUT"
2192 ><B
2193 >cd /export/dfsroot</B
2194 ></TT
2195 ></P
2196 ><P
2197 ><TT
2198 CLASS="PROMPT"
2199 >root# </TT
2200 ><TT
2201 CLASS="USERINPUT"
2202 ><B
2203 >chown root /export/dfsroot</B
2204 ></TT
2205 ></P
2206 ><P
2207 ><TT
2208 CLASS="PROMPT"
2209 >root# </TT
2210 ><TT
2211 CLASS="USERINPUT"
2212 ><B
2213 >chmod 755 /export/dfsroot</B
2214 ></TT
2215 ></P
2216 ><P
2217 ><TT
2218 CLASS="PROMPT"
2219 >root# </TT
2220 ><TT
2221 CLASS="USERINPUT"
2222 ><B
2223 >ln -s msdfs:storageA\\shareA linka</B
2224 ></TT
2225 ></P
2226 ><P
2227 ><TT
2228 CLASS="PROMPT"
2229 >root# </TT
2230 ><TT
2231 CLASS="USERINPUT"
2232 ><B
2233 >ln -s msdfs:serverB\\share,serverC\\share linkb</B
2234 ></TT
2235 ></P
2236 ><P
2237 >You should set up the permissions and ownership of
2238         the directory acting as the Dfs root such that only designated
2239         users can create, delete or modify the msdfs links. Also note
2240         that symlink names should be all lowercase. This limitation exists
2241         to have Samba avoid trying all the case combinations to get at
2242         the link name. Finally set up the symbolic links to point to the
2243         network shares you want, and start Samba.</P
2244 ><P
2245 >Users on Dfs-aware clients can now browse the Dfs tree
2246         on the Samba server at \\samba\dfs. Accessing
2247         links linka or linkb (which appear as directories to the client)
2248         takes users directly to the appropriate shares on the network.</P
2249 ><DIV
2250 CLASS="SECT2"
2251 ><HR><H2
2252 CLASS="SECT2"
2253 ><A
2254 NAME="AEN425"
2255 >3.1.1. Notes</A
2256 ></H2
2257 ><P
2258 ></P
2259 ><UL
2260 ><LI
2261 ><P
2262 >Windows clients need to be rebooted
2263                         if a previously mounted non-dfs share is made a dfs
2264                         root or vice versa. A better way is to introduce a
2265                         new share and make it the dfs root.</P
2266 ></LI
2267 ><LI
2268 ><P
2269 >Currently there's a restriction that msdfs
2270                         symlink names should all be lowercase.</P
2271 ></LI
2272 ><LI
2273 ><P
2274 >For security purposes, the directory
2275                         acting as the root of the Dfs tree should have ownership
2276                         and permissions set so that only designated users can
2277                         modify the symbolic links in the directory.</P
2278 ></LI
2279 ></UL
2280 ></DIV
2281 ></DIV
2282 ></DIV
2283 ><DIV
2284 CLASS="CHAPTER"
2285 ><HR><H1
2286 ><A
2287 NAME="AEN434"
2288 >Chapter 4. Printing Support in Samba 2.2.x</A
2289 ></H1
2290 ><DIV
2291 CLASS="SECT1"
2292 ><H1
2293 CLASS="SECT1"
2294 ><A
2295 NAME="AEN445"
2296 >4.1. Introduction</A
2297 ></H1
2298 ><P
2299 >Beginning with the 2.2.0 release, Samba supports
2300 the native Windows NT printing mechanisms implemented via
2301 MS-RPC (i.e. the SPOOLSS named pipe).  Previous versions of
2302 Samba only supported LanMan printing calls.</P
2303 ><P
2304 >The additional functionality provided by the new
2305 SPOOLSS support includes:</P
2306 ><P
2307 ></P
2308 ><UL
2309 ><LI
2310 ><P
2311 >Support for downloading printer driver
2312         files to Windows 95/98/NT/2000 clients upon demand.
2313         </P
2314 ></LI
2315 ><LI
2316 ><P
2317 >Uploading of printer drivers via the
2318         Windows NT Add Printer Wizard (APW) or the
2319         Imprints tool set (refer to <A
2320 HREF="http://imprints.sourceforge.net"
2321 TARGET="_top"
2322 >http://imprints.sourceforge.net</A
2323 >).
2324         </P
2325 ></LI
2326 ><LI
2327 ><P
2328 >Support for the native MS-RPC printing
2329         calls such as StartDocPrinter, EnumJobs(), etc...  (See
2330         the MSDN documentation at <A
2331 HREF="http://msdn.microsoft.com/"
2332 TARGET="_top"
2333 >http://msdn.microsoft.com/</A
2334 >
2335         for more information on the Win32 printing API)
2336         </P
2337 ></LI
2338 ><LI
2339 ><P
2340 >Support for NT Access Control Lists (ACL)
2341         on printer objects</P
2342 ></LI
2343 ><LI
2344 ><P
2345 >Improved support for printer queue manipulation
2346         through the use of an internal databases for spooled job
2347         information</P
2348 ></LI
2349 ></UL
2350 ></DIV
2351 ><DIV
2352 CLASS="SECT1"
2353 ><HR><H1
2354 CLASS="SECT1"
2355 ><A
2356 NAME="AEN462"
2357 >4.2. Configuration</A
2358 ></H1
2359 ><P
2360 ><EM
2361 >WARNING!!!</EM
2362 > Previous versions of Samba
2363 recommended using a share named [printer$].  This name was taken from the
2364 printer$ service created by Windows 9x clients when a
2365 printer was shared.  Windows 9x printer servers always have
2366 a printer$ service which provides read-only access via no
2367 password in order to support printer driver downloads.</P
2368 ><P
2369 >However, the initial implementation allowed for a
2370 parameter named <TT
2371 CLASS="PARAMETER"
2372 ><I
2373 >printer driver location</I
2374 ></TT
2375 >
2376 to be used on a per share basis to specify the location of
2377 the driver files associated with that printer.  Another
2378 parameter named <TT
2379 CLASS="PARAMETER"
2380 ><I
2381 >printer driver</I
2382 ></TT
2383 > provided
2384 a means of defining the printer driver name to be sent to
2385 the client.</P
2386 ><P
2387 >These parameters, including <TT
2388 CLASS="PARAMETER"
2389 ><I
2390 >printer driver
2391 file</I
2392 ></TT
2393 > parameter, are being depreciated and should not
2394 be used in new installations.  For more information on this change,
2395 you should refer to the <A
2396 HREF="#MIGRATION"
2397 >Migration section </A
2398 >of this document.</P
2399 ><DIV
2400 CLASS="SECT2"
2401 ><HR><H2
2402 CLASS="SECT2"
2403 ><A
2404 NAME="AEN472"
2405 >4.2.1. Creating [print$]</A
2406 ></H2
2407 ><P
2408 >In order to support the uploading of printer driver
2409 files, you must first configure a file share named [print$].
2410 The name of this share is hard coded in Samba's internals so
2411 the name is very important (print$ is the service used by
2412 Windows NT print servers to provide support for printer driver
2413 download).</P
2414 ><P
2415 >You should modify the server's smb.conf file to create the
2416 following file share (of course, some of the parameter values,
2417 such as 'path' are arbitrary and should be replaced with
2418 appropriate values for your site):</P
2419 ><P
2420 ><TABLE
2421 BORDER="0"
2422 BGCOLOR="#E0E0E0"
2423 WIDTH="100%"
2424 ><TR
2425 ><TD
2426 ><PRE
2427 CLASS="PROGRAMLISTING"
2428 >[print$]
2429     path = /usr/local/samba/printers
2430     guest ok = yes
2431     browseable = yes
2432     read only = yes
2433     write list = ntadmin</PRE
2434 ></TD
2435 ></TR
2436 ></TABLE
2437 ></P
2438 ><P
2439 >The <A
2440 HREF="smb.conf.5.html#WRITELIST"
2441 TARGET="_top"
2442 ><TT
2443 CLASS="PARAMETER"
2444 ><I
2445 >write list</I
2446 ></TT
2447 ></A
2448 > is used to allow administrative
2449 level user accounts to have write access in order to update files
2450 on the share.  See the <A
2451 HREF="smb./conf.5.html"
2452 TARGET="_top"
2453 >smb.conf(5) man page</A
2454 > for more information on
2455 configuring file shares.</P
2456 ><P
2457 >The requirement for <A
2458 HREF="smb.conf.5.html#GUESTOK"
2459 TARGET="_top"
2460 ><B
2461 CLASS="COMMAND"
2462 >guest ok = yes</B
2463 ></A
2464 > depends upon how your
2465 site is configured.  If users will be guaranteed to have
2466 an account on the Samba host, then this is a non-issue.</P
2467 ><DIV
2468 CLASS="NOTE"
2469 ><BLOCKQUOTE
2470 CLASS="NOTE"
2471 ><P
2472 ><B
2473 >Author's Note: </B
2474 >The non-issue is that if all your Windows NT users are guaranteed to be
2475 authenticated by the Samba server (such as a domain member server and the NT
2476 user has already been validated by the Domain Controller in
2477 order to logon to the Windows NT console), then guest access
2478 is not necessary.  Of course, in a workgroup environment where
2479 you just want to be able to print without worrying about
2480 silly accounts and security, then configure the share for
2481 guest access.  You'll probably want to add <A
2482 HREF="smb.conf.5.html#MAPTOGUEST"
2483 TARGET="_top"
2484 ><B
2485 CLASS="COMMAND"
2486 >map to guest = Bad User</B
2487 ></A
2488 > in the [global] section as well.  Make sure
2489 you understand what this parameter does before using it
2490 though. --jerry</P
2491 ></BLOCKQUOTE
2492 ></DIV
2493 ><P
2494 >In order for a Windows NT print server to support
2495 the downloading of driver files by multiple client architectures,
2496 it must create subdirectories within the [print$] service
2497 which correspond to each of the supported client architectures.
2498 Samba follows this model as well.</P
2499 ><P
2500 >Next create the directory tree below the [print$] share
2501 for each architecture you wish to support.</P
2502 ><P
2503 ><TABLE
2504 BORDER="0"
2505 BGCOLOR="#E0E0E0"
2506 WIDTH="100%"
2507 ><TR
2508 ><TD
2509 ><PRE
2510 CLASS="PROGRAMLISTING"
2511 >[print$]-----
2512         |-W32X86           ; "Windows NT x86"
2513         |-WIN40            ; "Windows 95/98"
2514         |-W32ALPHA         ; "Windows NT Alpha_AXP"
2515         |-W32MIPS          ; "Windows NT R4000"
2516         |-W32PPC           ; "Windows NT PowerPC"</PRE
2517 ></TD
2518 ></TR
2519 ></TABLE
2520 ></P
2521 ><DIV
2522 CLASS="WARNING"
2523 ><P
2524 ></P
2525 ><TABLE
2526 CLASS="WARNING"
2527 BORDER="1"
2528 WIDTH="100%"
2529 ><TR
2530 ><TD
2531 ALIGN="CENTER"
2532 ><B
2533 >ATTENTION!  REQUIRED PERMISSIONS</B
2534 ></TD
2535 ></TR
2536 ><TR
2537 ><TD
2538 ALIGN="LEFT"
2539 ><P
2540 >In order to currently add a new driver to you Samba host,
2541         one of two conditions must hold true:</P
2542 ><P
2543 ></P
2544 ><UL
2545 ><LI
2546 ><P
2547 >The account used to connect to the Samba host
2548                 must have a uid of 0 (i.e. a root account)</P
2549 ></LI
2550 ><LI
2551 ><P
2552 >The account used to connect to the Samba host
2553                 must be a member of the <A
2554 HREF="smb.conf.5.html#PRINTERADMIN"
2555 TARGET="_top"
2556 ><TT
2557 CLASS="PARAMETER"
2558 ><I
2559 >printer
2560                 admin</I
2561 ></TT
2562 ></A
2563 > list.</P
2564 ></LI
2565 ></UL
2566 ><P
2567 >Of course, the connected account must still possess access
2568         to add files to the subdirectories beneath [print$].</P
2569 ></TD
2570 ></TR
2571 ></TABLE
2572 ></DIV
2573 ><P
2574 >Once you have created the required [print$] service and
2575 associated subdirectories, simply log onto the Samba server using
2576 a root (or <TT
2577 CLASS="PARAMETER"
2578 ><I
2579 >printer admin</I
2580 ></TT
2581 >) account
2582 from a Windows NT 4.0 client.  Navigate to the "Printers" folder
2583 on the Samba server.  You should see an initial listing of printers
2584 that matches the printer shares defined on your Samba host.</P
2585 ></DIV
2586 ><DIV
2587 CLASS="SECT2"
2588 ><HR><H2
2589 CLASS="SECT2"
2590 ><A
2591 NAME="AEN507"
2592 >4.2.2. Setting Drivers for Existing Printers</A
2593 ></H2
2594 ><P
2595 >The initial listing of printers in the Samba host's
2596 Printers folder will have no printer driver assigned to them.
2597 The way assign a driver to a printer is to view the Properties
2598 of the printer and either</P
2599 ><P
2600 ></P
2601 ><UL
2602 ><LI
2603 ><P
2604 >Use the "New Driver..." button to install
2605         a new printer driver, or</P
2606 ></LI
2607 ><LI
2608 ><P
2609 >Select a driver from the popup list of
2610         installed drivers.  Initially this list will be empty.</P
2611 ></LI
2612 ></UL
2613 ><P
2614 >If you wish to install printer drivers for client
2615 operating systems other than "Windows NT x86", you will need
2616 to use the "Sharing" tab of the printer properties dialog.</P
2617 ><P
2618 >Assuming you have connected with a root account, you
2619 will also be able modify other printer properties such as
2620 ACLs and device settings using this dialog box.</P
2621 ><P
2622 >A few closing comments for this section, it is possible
2623 on a Windows NT print server to have printers
2624 listed in the Printers folder which are not shared.  Samba does
2625 not make this distinction.  By definition, the only printers of
2626 which Samba is aware are those which are specified as shares in
2627 <TT
2628 CLASS="FILENAME"
2629 >smb.conf</TT
2630 >.</P
2631 ><P
2632 >Another interesting side note is that Windows NT clients do
2633 not use the SMB printer share, but rather can print directly
2634 to any printer on another Windows NT host using MS-RPC.  This
2635 of course assumes that the printing client has the necessary
2636 privileges on the remote host serving the printer.  The default
2637 permissions assigned by Windows NT to a printer gives the "Print"
2638 permissions to the "Everyone" well-known group.</P
2639 ></DIV
2640 ><DIV
2641 CLASS="SECT2"
2642 ><HR><H2
2643 CLASS="SECT2"
2644 ><A
2645 NAME="AEN520"
2646 >4.2.3. Support a large number of printers</A
2647 ></H2
2648 ><P
2649 >One issue that has arisen during the development
2650 phase of Samba 2.2 is the need to support driver downloads for
2651 100's of printers.  Using the Windows NT APW is somewhat
2652 awkward to say the list.  If more than one printer are using the
2653 same driver, the <A
2654 HREF="rpcclient.1.html"
2655 TARGET="_top"
2656 ><B
2657 CLASS="COMMAND"
2658 >rpcclient's
2659 setdriver command</B
2660 ></A
2661 > can be used to set the driver
2662 associated with an installed driver.  The following is example
2663 of how this could be accomplished:</P
2664 ><P
2665 ><TABLE
2666 BORDER="0"
2667 BGCOLOR="#E0E0E0"
2668 WIDTH="100%"
2669 ><TR
2670 ><TD
2671 ><PRE
2672 CLASS="PROGRAMLISTING"
2673 >
2674 <TT
2675 CLASS="PROMPT"
2676 >$ </TT
2677 >rpcclient pogo -U root%secret -c "enumdrivers"
2678 Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
2679
2680 [Windows NT x86]
2681 Printer Driver Info 1:
2682      Driver Name: [HP LaserJet 4000 Series PS]
2683
2684 Printer Driver Info 1:
2685      Driver Name: [HP LaserJet 2100 Series PS]
2686
2687 Printer Driver Info 1:
2688      Driver Name: [HP LaserJet 4Si/4SiMX PS]
2689
2690 <TT
2691 CLASS="PROMPT"
2692 >$ </TT
2693 >rpcclient pogo -U root%secret -c "enumprinters"
2694 Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
2695      flags:[0x800000]
2696      name:[\\POGO\hp-print]
2697      description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
2698      comment:[]
2699
2700 <TT
2701 CLASS="PROMPT"
2702 >$ </TT
2703 >rpcclient pogo -U root%bleaK.er \
2704 <TT
2705 CLASS="PROMPT"
2706 >&#62; </TT
2707 > -c "setdriver hp-print \"HP LaserJet 4000 Series PS\""
2708 Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
2709 Successfully set hp-print to driver HP LaserJet 4000 Series PS.</PRE
2710 ></TD
2711 ></TR
2712 ></TABLE
2713 ></P
2714 ></DIV
2715 ><DIV
2716 CLASS="SECT2"
2717 ><HR><H2
2718 CLASS="SECT2"
2719 ><A
2720 NAME="AEN531"
2721 >4.2.4. Adding New Printers via the Windows NT APW</A
2722 ></H2
2723 ><P
2724 >By default, Samba offers all printer shares defined in <TT
2725 CLASS="FILENAME"
2726 >smb.conf</TT
2727 >
2728 in the "Printers..." folder.  Also existing in this folder is the Windows NT
2729 Add Printer Wizard icon.  The APW will be show only if</P
2730 ><P
2731 ></P
2732 ><UL
2733 ><LI
2734 ><P
2735 >The connected user is able to successfully
2736         execute an OpenPrinterEx(\\server) with administrative
2737         priviledges (i.e. root or <TT
2738 CLASS="PARAMETER"
2739 ><I
2740 >printer admin</I
2741 ></TT
2742 >.
2743         </P
2744 ></LI
2745 ><LI
2746 ><P
2747 ><A
2748 HREF="smb.conf.5.html#SHOWADDPRINTERWIZARD"
2749 TARGET="_top"
2750 ><TT
2751 CLASS="PARAMETER"
2752 ><I
2753 >show
2754         add printer wizard = yes</I
2755 ></TT
2756 ></A
2757 > (the default).
2758         </P
2759 ></LI
2760 ></UL
2761 ><P
2762 >In order to be able to use the APW to successfully add a printer to a Samba
2763 server, the <A
2764 HREF="smb.conf.5.html#ADDPRINTERCOMMAND"
2765 TARGET="_top"
2766 ><TT
2767 CLASS="PARAMETER"
2768 ><I
2769 >addprinter
2770 command</I
2771 ></TT
2772 ></A
2773 > must have a defined value.  The program
2774 hook must successfully add the printer to the system (i.e.
2775 <TT
2776 CLASS="FILENAME"
2777 >/etc/printcap</TT
2778 > or appropriate files) and
2779 <TT
2780 CLASS="FILENAME"
2781 >smb.conf</TT
2782 > if necessary.</P
2783 ><P
2784 >When using the APW from a client, if the named printer share does
2785 not exist, <B
2786 CLASS="COMMAND"
2787 >smbd</B
2788 > will execute the <TT
2789 CLASS="PARAMETER"
2790 ><I
2791 >add printer
2792 program</I
2793 ></TT
2794 > and reparse to the <TT
2795 CLASS="FILENAME"
2796 >smb.conf</TT
2797 >
2798 to attempt to locate the new printer share.  If the share is still not defined,
2799 an error of "Access Denied" is returned to the client.  Note that the
2800 <TT
2801 CLASS="PARAMETER"
2802 ><I
2803 >add printer program</I
2804 ></TT
2805 > is executed undet the context
2806 of the connected user, not necessarily a root account.</P
2807 ><P
2808 >There is a complementing <A
2809 HREF="smb.conf.5.html#DELETEPRINTERCOMMAND"
2810 TARGET="_top"
2811 ><TT
2812 CLASS="PARAMETER"
2813 ><I
2814 >deleteprinter
2815 command</I
2816 ></TT
2817 ></A
2818 > for removing entries from the "Printers..."
2819 folder.</P
2820 ></DIV
2821 ><DIV
2822 CLASS="SECT2"
2823 ><HR><H2
2824 CLASS="SECT2"
2825 ><A
2826 NAME="AEN556"
2827 >4.2.5. Samba and Printer Ports</A
2828 ></H2
2829 ><P
2830 >Windows NT/2000 print servers associate a port with each printer.  These normally
2831 take the form of LPT1:, COM1:, FILE:, etc...  Samba must also support the
2832 concept of ports associated with a printer.  By default, only one printer port,
2833 named "Samba Printer Port", exists on a system.  Samba does not really a port in
2834 order to print, rather it is a requirement of Windows clients.  </P
2835 ><P
2836 >Note that Samba does not support the concept of "Printer Pooling" internally
2837 either.  This is when a logical printer is assigned to multiple ports as
2838 a form of load balancing or fail over.</P
2839 ><P
2840 >If you require that multiple ports be defined for some reason,
2841 <TT
2842 CLASS="FILENAME"
2843 >smb.conf</TT
2844 > possesses a <A
2845 HREF="smb.conf.5.html#ENUMPORTSCOMMAND"
2846 TARGET="_top"
2847 ><TT
2848 CLASS="PARAMETER"
2849 ><I
2850 >enumports
2851 command</I
2852 ></TT
2853 ></A
2854 > which can be used to define an external program
2855 that generates a listing of ports on a system.</P
2856 ></DIV
2857 ></DIV
2858 ><DIV
2859 CLASS="SECT1"
2860 ><HR><H1
2861 CLASS="SECT1"
2862 ><A
2863 NAME="AEN564"
2864 >4.3. The Imprints Toolset</A
2865 ></H1
2866 ><P
2867 >The Imprints tool set provides a UNIX equivalent of the
2868         Windows NT Add Printer Wizard.  For complete information, please
2869         refer to the Imprints web site at <A
2870 HREF="http://imprints.sourceforge.net/"
2871 TARGET="_top"
2872 >       http://imprints.sourceforge.net/</A
2873 > as well as the documentation
2874         included with the imprints source distribution.  This section will
2875         only provide a brief introduction to the features of Imprints.</P
2876 ><DIV
2877 CLASS="SECT2"
2878 ><HR><H2
2879 CLASS="SECT2"
2880 ><A
2881 NAME="AEN568"
2882 >4.3.1. What is Imprints?</A
2883 ></H2
2884 ><P
2885 >Imprints is a collection of tools for supporting the goals
2886                 of</P
2887 ><P
2888 ></P
2889 ><UL
2890 ><LI
2891 ><P
2892 >Providing a central repository information
2893                         regarding Windows NT and 95/98 printer driver packages</P
2894 ></LI
2895 ><LI
2896 ><P
2897 >Providing the tools necessary for creating
2898                         the Imprints printer driver packages.</P
2899 ></LI
2900 ><LI
2901 ><P
2902 >Providing an installation client which
2903                         will obtain and install printer drivers on remote Samba
2904                         and Windows NT 4 print servers.</P
2905 ></LI
2906 ></UL
2907 ></DIV
2908 ><DIV
2909 CLASS="SECT2"
2910 ><HR><H2
2911 CLASS="SECT2"
2912 ><A
2913 NAME="AEN578"
2914 >4.3.2. Creating Printer Driver Packages</A
2915 ></H2
2916 ><P
2917 >The process of creating printer driver packages is beyond
2918                 the scope of this document (refer to Imprints.txt also included
2919                 with the Samba distribution for more information).  In short,
2920                 an Imprints driver package is a gzipped tarball containing the
2921                 driver files, related INF files, and a control file needed by the
2922                 installation client.</P
2923 ></DIV
2924 ><DIV
2925 CLASS="SECT2"
2926 ><HR><H2
2927 CLASS="SECT2"
2928 ><A
2929 NAME="AEN581"
2930 >4.3.3. The Imprints server</A
2931 ></H2
2932 ><P
2933 >The Imprints server is really a database server that
2934                 may be queried via standard HTTP mechanisms.  Each printer
2935                 entry in the database has an associated URL for the actual
2936                 downloading of the package.  Each package is digitally signed
2937                 via GnuPG which can be used to verify that package downloaded
2938                 is actually the one referred in the Imprints database.  It is
2939                 <EM
2940 >not</EM
2941 > recommended that this security check
2942                 be disabled.</P
2943 ></DIV
2944 ><DIV
2945 CLASS="SECT2"
2946 ><HR><H2
2947 CLASS="SECT2"
2948 ><A
2949 NAME="AEN585"
2950 >4.3.4. The Installation Client</A
2951 ></H2
2952 ><P
2953 >More information regarding the Imprints installation client
2954                 is available in the <TT
2955 CLASS="FILENAME"
2956 >Imprints-Client-HOWTO.ps</TT
2957 >
2958                 file included with the imprints source package.</P
2959 ><P
2960 >The Imprints installation client comes in two forms.</P
2961 ><P
2962 ></P
2963 ><UL
2964 ><LI
2965 ><P
2966 >a set of command line Perl scripts</P
2967 ></LI
2968 ><LI
2969 ><P
2970 >a GTK+ based graphical interface to
2971                         the command line perl scripts</P
2972 ></LI
2973 ></UL
2974 ><P
2975 >The installation client (in both forms) provides a means
2976                 of querying the Imprints database server for a matching
2977                 list of known printer model names as well as a means to
2978                 download and install the drivers on remote Samba and Windows
2979                 NT print servers.</P
2980 ><P
2981 >The basic installation process is in four steps and
2982                 perl code is wrapped around <B
2983 CLASS="COMMAND"
2984 >smbclient</B
2985 >
2986                 and <B
2987 CLASS="COMMAND"
2988 >rpcclient</B
2989 >.</P
2990 ><P
2991 ><TABLE
2992 BORDER="0"
2993 BGCOLOR="#E0E0E0"
2994 WIDTH="100%"
2995 ><TR
2996 ><TD
2997 ><PRE
2998 CLASS="PROGRAMLISTING"
2999 >
3000 foreach (supported architecture for a given driver)
3001 {
3002      1.  rpcclient: Get the appropriate upload directory
3003          on the remote server
3004      2.  smbclient: Upload the driver files
3005      3.  rpcclient: Issues an AddPrinterDriver() MS-RPC
3006 }
3007
3008 4.  rpcclient: Issue an AddPrinterEx() MS-RPC to actually
3009     create the printer</PRE
3010 ></TD
3011 ></TR
3012 ></TABLE
3013 ></P
3014 ><P
3015 >One of the problems encountered when implementing
3016                 the Imprints tool set was the name space issues between
3017                 various supported client architectures.  For example, Windows
3018                 NT includes a driver named "Apple LaserWriter II NTX v51.8"
3019                 and Windows 95 callsits version of this driver "Apple
3020                 LaserWriter II NTX"</P
3021 ><P
3022 >The problem is how to know what client drivers have
3023                 been uploaded for a printer.  As astute reader will remember
3024                 that the Windows NT Printer Properties dialog only includes
3025                 space for one printer driver name.  A quick look in the
3026                 Windows NT 4.0 system registry at</P
3027 ><P
3028 ><TT
3029 CLASS="FILENAME"
3030 >HKLM\System\CurrentControlSet\Control\Print\Environment
3031                 </TT
3032 ></P
3033 ><P
3034 >will reveal that Windows NT always uses the NT driver
3035                 name.  The is ok as Windows NT always requires that at least
3036                 the Windows NT version of the printer driver is present.
3037                 However, Samba does not have the requirement internally.
3038                 Therefore, how can you use the NT driver name if is has not
3039                 already been installed?</P
3040 ><P
3041 >The way of sidestepping this limitation is to require
3042                 that all Imprints printer driver packages include both the Intel
3043                 Windows NT and 95/98 printer drivers and that NT driver is
3044                 installed first.</P
3045 ></DIV
3046 ></DIV
3047 ><DIV
3048 CLASS="SECT1"
3049 ><HR><H1
3050 CLASS="SECT1"
3051 ><A
3052 NAME="AEN607"
3053 >4.4. <A
3054 NAME="MIGRATION"
3055 ></A
3056 >Migration to from Samba 2.0.x to
3057         2.2.x</A
3058 ></H1
3059 ><P
3060 >Given that printer driver management has changed
3061         (we hope improved :) ) in 2.2.0 over prior releases,
3062         migration from an existing setup to 2.2.0 can follow
3063         several paths.</P
3064 ><DIV
3065 CLASS="WARNING"
3066 ><P
3067 ></P
3068 ><TABLE
3069 CLASS="WARNING"
3070 BORDER="1"
3071 WIDTH="100%"
3072 ><TR
3073 ><TD
3074 ALIGN="CENTER"
3075 ><B
3076 >Achtung!</B
3077 ></TD
3078 ></TR
3079 ><TR
3080 ><TD
3081 ALIGN="LEFT"
3082 ><P
3083 >The following smb.conf parameters are considered to be
3084                 depreciated and will be removed soon.  Do not use them
3085                 in new installations</P
3086 ><P
3087 ></P
3088 ><UL
3089 ><LI
3090 ><P
3091 ><TT
3092 CLASS="PARAMETER"
3093 ><I
3094 >printer driver file (G)</I
3095 ></TT
3096 >
3097                         </P
3098 ></LI
3099 ><LI
3100 ><P
3101 ><TT
3102 CLASS="PARAMETER"
3103 ><I
3104 >printer driver (S)</I
3105 ></TT
3106 >
3107                         </P
3108 ></LI
3109 ><LI
3110 ><P
3111 ><TT
3112 CLASS="PARAMETER"
3113 ><I
3114 >printer driver location (S)</I
3115 ></TT
3116 >
3117                         </P
3118 ></LI
3119 ></UL
3120 ></TD
3121 ></TR
3122 ></TABLE
3123 ></DIV
3124 ><P
3125 >Here are the possible scenarios for supporting migration:</P
3126 ><P
3127 ></P
3128 ><UL
3129 ><LI
3130 ><P
3131 >If you do not desire the new Windows NT
3132                 print driver support, nothing needs to be done.
3133                 All existing parameters work the same.</P
3134 ></LI
3135 ><LI
3136 ><P
3137 >If you want to take advantage of NT printer
3138                 driver support but do not want to migrate the
3139                 9x drivers to the new setup, the leave the existing
3140                 printers.def file.  When smbd attempts to locate a
3141                 9x driver for the printer in the TDB and fails it
3142                 will drop down to using the printers.def (and all
3143                 associated parameters).  The <B
3144 CLASS="COMMAND"
3145 >make_printerdef</B
3146 >
3147                 tool will also remain for backwards compatibility but will
3148                 be moved to the "this tool is the old way of doing it"
3149                 pile.</P
3150 ></LI
3151 ><LI
3152 ><P
3153 >If you install a Windows 9x driver for a printer
3154                 on your Samba host (in the printing TDB), this information will
3155                 take precedence and the three old printing parameters
3156                 will be ignored (including print driver location).</P
3157 ></LI
3158 ><LI
3159 ><P
3160 >If you want to migrate an existing <TT
3161 CLASS="FILENAME"
3162 >printers.def</TT
3163 >
3164                 file into the new setup, the current only
3165                 solution is to use the Windows NT APW to install the NT drivers
3166                 and the 9x  drivers.  This can be scripted using <B
3167 CLASS="COMMAND"
3168 >smbclient</B
3169 >
3170                 and <B
3171 CLASS="COMMAND"
3172 >rpcclient</B
3173 >.  See the
3174                 Imprints installation client at <A
3175 HREF="http://imprints.sourceforge.net/"
3176 TARGET="_top"
3177 >http://imprints.sourceforge.net/</A
3178 >
3179                 for an example.
3180                 </P
3181 ></LI
3182 ></UL
3183 ></DIV
3184 ></DIV
3185 ><DIV
3186 CLASS="CHAPTER"
3187 ><HR><H1
3188 ><A
3189 NAME="AEN639"
3190 >Chapter 5. security = domain in Samba 2.x</A
3191 ></H1
3192 ><DIV
3193 CLASS="SECT1"
3194 ><H1
3195 CLASS="SECT1"
3196 ><A
3197 NAME="AEN657"
3198 >5.1. Joining an NT Domain with Samba 2.2</A
3199 ></H1
3200 ><P
3201 >In order for a Samba-2 server to join an NT domain,
3202         you must first add the NetBIOS name of the Samba server to the
3203         NT domain on the PDC using Server Manager for Domains.  This creates
3204         the machine account in the domain (PDC) SAM. Note that you should
3205         add the Samba server as a "Windows NT Workstation or Server",
3206         <EM
3207 >NOT</EM
3208 > as a Primary or backup domain controller.</P
3209 ><P
3210 >Assume you have a Samba-2 server with a NetBIOS name of
3211         <TT
3212 CLASS="CONSTANT"
3213 >SERV1</TT
3214 > and are joining an NT domain called
3215         <TT
3216 CLASS="CONSTANT"
3217 >DOM</TT
3218 >, which has a PDC with a NetBIOS name
3219         of <TT
3220 CLASS="CONSTANT"
3221 >DOMPDC</TT
3222 > and two backup domain controllers
3223         with NetBIOS names <TT
3224 CLASS="CONSTANT"
3225 >DOMBDC1</TT
3226 > and <TT
3227 CLASS="CONSTANT"
3228 >DOMBDC2
3229         </TT
3230 >.</P
3231 ><P
3232 >In order to join the domain, first stop all Samba daemons
3233         and run the command:</P
3234 ><P
3235 ><TT
3236 CLASS="PROMPT"
3237 >root# </TT
3238 ><TT
3239 CLASS="USERINPUT"
3240 ><B
3241 >smbpasswd -j DOM -r DOMPDC
3242         </B
3243 ></TT
3244 ></P
3245 ><P
3246 >as we are joining the domain DOM and the PDC for that domain
3247         (the only machine that has write access to the domain SAM database)
3248         is DOMPDC. If this is successful you will see the message:</P
3249 ><P
3250 ><TT
3251 CLASS="COMPUTEROUTPUT"
3252 >smbpasswd: Joined domain DOM.</TT
3253 >
3254         </P
3255 ><P
3256 >in your terminal window. See the <A
3257 HREF="smbpasswd.8.html"
3258 TARGET="_top"
3259 >       smbpasswd(8)</A
3260 > man page for more details.</P
3261 ><P
3262 >There is existing development code to join a domain
3263         without having to create the machine trust account on the PDC
3264         beforehand.  This code will hopefully be available soon
3265         in release branches as well.</P
3266 ><P
3267 >This command goes through the machine account password
3268         change protocol, then writes the new (random) machine account
3269         password for this Samba server into a file in the same directory
3270         in which an smbpasswd file would be stored - normally :</P
3271 ><P
3272 ><TT
3273 CLASS="FILENAME"
3274 >/usr/local/samba/private</TT
3275 ></P
3276 ><P
3277 >In Samba 2.0.x, the filename looks like this:</P
3278 ><P
3279 ><TT
3280 CLASS="FILENAME"
3281 ><TT
3282 CLASS="REPLACEABLE"
3283 ><I
3284 >&#60;NT DOMAIN NAME&#62;</I
3285 ></TT
3286 >.<TT
3287 CLASS="REPLACEABLE"
3288 ><I
3289 >&#60;Samba
3290         Server Name&#62;</I
3291 ></TT
3292 >.mac</TT
3293 ></P
3294 ><P
3295 >The <TT
3296 CLASS="FILENAME"
3297 >.mac</TT
3298 > suffix stands for machine account
3299         password file. So in our example above, the file would be called:</P
3300 ><P
3301 ><TT
3302 CLASS="FILENAME"
3303 >DOM.SERV1.mac</TT
3304 ></P
3305 ><P
3306 >In Samba 2.2, this file has been replaced with a TDB
3307         (Trivial Database) file named <TT
3308 CLASS="FILENAME"
3309 >secrets.tdb</TT
3310 >.
3311         </P
3312 ><P
3313 >This file is created and owned by root and is not
3314         readable by any other user. It is the key to the domain-level
3315         security for your system, and should be treated as carefully
3316         as a shadow password file.</P
3317 ><P
3318 >Now, before restarting the Samba daemons you must
3319         edit your <A
3320 HREF="smb.conf.5.html"
3321 TARGET="_top"
3322 ><TT
3323 CLASS="FILENAME"
3324 >smb.conf(5)</TT
3325 >
3326         </A
3327 > file to tell Samba it should now use domain security.</P
3328 ><P
3329 >Change (or add) your <A
3330 HREF="smb.conf.5.html#SECURITY"
3331 TARGET="_top"
3332 >       <TT
3333 CLASS="PARAMETER"
3334 ><I
3335 >security =</I
3336 ></TT
3337 ></A
3338 > line in the [global] section
3339         of your smb.conf to read:</P
3340 ><P
3341 ><B
3342 CLASS="COMMAND"
3343 >security = domain</B
3344 ></P
3345 ><P
3346 >Next change the <A
3347 HREF="smb.conf.5.html#WORKGROUP"
3348 TARGET="_top"
3349 ><TT
3350 CLASS="PARAMETER"
3351 ><I
3352 >       workgroup =</I
3353 ></TT
3354 ></A
3355 > line in the [global] section to read: </P
3356 ><P
3357 ><B
3358 CLASS="COMMAND"
3359 >workgroup = DOM</B
3360 ></P
3361 ><P
3362 >as this is the name of the domain we are joining. </P
3363 ><P
3364 >You must also have the parameter <A
3365 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
3366 TARGET="_top"
3367 >       <TT
3368 CLASS="PARAMETER"
3369 ><I
3370 >encrypt passwords</I
3371 ></TT
3372 ></A
3373 > set to <TT
3374 CLASS="CONSTANT"
3375 >yes
3376         </TT
3377 > in order for your users to authenticate to the NT PDC.</P
3378 ><P
3379 >Finally, add (or modify) a <A
3380 HREF="smb.conf.5.html#PASSWORDSERVER"
3381 TARGET="_top"
3382 >       <TT
3383 CLASS="PARAMETER"
3384 ><I
3385 >password server =</I
3386 ></TT
3387 ></A
3388 > line in the [global]
3389         section to read: </P
3390 ><P
3391 ><B
3392 CLASS="COMMAND"
3393 >password server = DOMPDC DOMBDC1 DOMBDC2</B
3394 ></P
3395 ><P
3396 >These are the primary and backup domain controllers Samba
3397         will attempt to contact in order to authenticate users. Samba will
3398         try to contact each of these servers in order, so you may want to
3399         rearrange this list in order to spread out the authentication load
3400         among domain controllers.</P
3401 ><P
3402 >Alternatively, if you want smbd to automatically determine
3403         the list of Domain controllers to use for authentication, you may
3404         set this line to be :</P
3405 ><P
3406 ><B
3407 CLASS="COMMAND"
3408 >password server = *</B
3409 ></P
3410 ><P
3411 >This method, which was introduced in Samba 2.0.6,
3412         allows Samba to use exactly the same mechanism that NT does. This
3413         method either broadcasts or uses a WINS database in order to
3414         find domain controllers to authenticate against.</P
3415 ><P
3416 >Finally, restart your Samba daemons and get ready for
3417         clients to begin using domain security!</P
3418 ></DIV
3419 ><DIV
3420 CLASS="SECT1"
3421 ><HR><H1
3422 CLASS="SECT1"
3423 ><A
3424 NAME="AEN721"
3425 >5.2. Samba and Windows 2000 Domains</A
3426 ></H1
3427 ><P
3428 >Many people have asked regarding the state of Samba's ability to participate in
3429 a Windows 2000 Domain.  Samba 2.2 is able to act as a member server of a Windows
3430 2000 domain operating in mixed or native mode.</P
3431 ><P
3432 >There is much confusion between the circumstances that require a "mixed" mode
3433 Win2k DC and a when this host can be switched to "native" mode.  A "mixed" mode
3434 Win2k domain controller is only needed if Windows NT BDCs must exist in the same
3435 domain.  By default, a Win2k DC in "native" mode will still support
3436 NetBIOS and NTLMv1 for authentication of legacy clients such as Windows 9x and
3437 NT 4.0.  Samba has the same requirements as a Windows NT 4.0 member server.</P
3438 ><P
3439 >The steps for adding a Samba 2.2 host to a Win2k domain are the same as those
3440 for adding a Samba server to a Windows NT 4.0 domain. The only exception is that
3441 the "Server Manager" from NT 4 has been replaced by the "Active Directory Users and
3442 Computers" MMC (Microsoft Management Console) plugin.</P
3443 ></DIV
3444 ><DIV
3445 CLASS="SECT1"
3446 ><HR><H1
3447 CLASS="SECT1"
3448 ><A
3449 NAME="AEN726"
3450 >5.3. Why is this better than security = server?</A
3451 ></H1
3452 ><P
3453 >Currently, domain security in Samba doesn't free you from
3454         having to create local Unix users to represent the users attaching
3455         to your server. This means that if domain user <TT
3456 CLASS="CONSTANT"
3457 >DOM\fred
3458         </TT
3459 > attaches to your domain security Samba server, there needs
3460         to be a local Unix user fred to represent that user in the Unix
3461         filesystem. This is very similar to the older Samba security mode
3462         <A
3463 HREF="smb.conf.5.html#SECURITYEQUALSSERVER"
3464 TARGET="_top"
3465 >security = server</A
3466 >,
3467         where Samba would pass through the authentication request to a Windows
3468         NT server in the same way as a Windows 95 or Windows 98 server would.
3469         </P
3470 ><P
3471 >Please refer to the <A
3472 HREF="winbind.html"
3473 TARGET="_top"
3474 >Winbind
3475         paper</A
3476 > for information on a system to automatically
3477         assign UNIX uids and gids to Windows NT Domain users and groups.
3478         This code is available in development branches only at the moment,
3479         but will be moved to release branches soon.</P
3480 ><P
3481 >The advantage to domain-level security is that the
3482         authentication in domain-level security is passed down the authenticated
3483         RPC channel in exactly the same way that an NT server would do it. This
3484         means Samba servers now participate in domain trust relationships in
3485         exactly the same way NT servers do (i.e., you can add Samba servers into
3486         a resource domain and have the authentication passed on from a resource
3487         domain PDC to an account domain PDC.</P
3488 ><P
3489 >In addition, with <B
3490 CLASS="COMMAND"
3491 >security = server</B
3492 > every Samba
3493         daemon on a server has to keep a connection open to the
3494         authenticating server for as long as that daemon lasts. This can drain
3495         the connection resources on a Microsoft NT server and cause it to run
3496         out of available connections. With <B
3497 CLASS="COMMAND"
3498 >security = domain</B
3499 >,
3500         however, the Samba daemons connect to the PDC/BDC only for as long
3501         as is necessary to authenticate the user, and then drop the connection,
3502         thus conserving PDC connection resources.</P
3503 ><P
3504 >And finally, acting in the same manner as an NT server
3505         authenticating to a PDC means that as part of the authentication
3506         reply, the Samba server gets the user identification information such
3507         as the user SID, the list of NT groups the user belongs to, etc. All
3508         this information will allow Samba to be extended in the future into
3509         a mode the developers currently call appliance mode. In this mode,
3510         no local Unix users will be necessary, and Samba will generate Unix
3511         uids and gids from the information passed back from the PDC when a
3512         user is authenticated, making a Samba server truly plug and play
3513         in an NT domain environment. Watch for this code soon.</P
3514 ><P
3515 ><EM
3516 >NOTE:</EM
3517 > Much of the text of this document
3518         was first published in the Web magazine <A
3519 HREF="http://www.linuxworld.com"
3520 TARGET="_top"
3521 >
3522         LinuxWorld</A
3523 > as the article <A
3524 HREF="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"
3525 TARGET="_top"
3526 >Doing
3527         the NIS/NT Samba</A
3528 >.</P
3529 ></DIV
3530 ></DIV
3531 ><DIV
3532 CLASS="CHAPTER"
3533 ><HR><H1
3534 ><A
3535 NAME="AEN742"
3536 >Chapter 6. How to Configure Samba 2.2.x as a Primary Domain Controller</A
3537 ></H1
3538 ><DIV
3539 CLASS="SECT1"
3540 ><H1
3541 CLASS="SECT1"
3542 ><A
3543 NAME="AEN753"
3544 >6.1. Background</A
3545 ></H1
3546 ><P
3547 ><EM
3548 >Author's Note :</EM
3549 > This document
3550 is a combination of David Bannon's Samba 2.2 PDC HOWTO
3551 and the Samba NT Domain FAQ. Both documents are superceeded by this one.</P
3552 ><P
3553 >Version of Samba prior to release 2.2 had marginal capabilities to
3554 act as a Windows NT 4.0 Primary Domain Controller (PDC).  The following
3555 functionality should work in 2.2.0:</P
3556 ><P
3557 ></P
3558 ><UL
3559 ><LI
3560 ><P
3561 >domain logons for Windows NT 4.0/2000 clients</P
3562 ></LI
3563 ><LI
3564 ><P
3565 >placing a Windows 9x client in user level security</P
3566 ></LI
3567 ><LI
3568 ><P
3569 >retrieving a list of users and groups from a Samba PDC to
3570         Windows 9x/NT/2000 clients </P
3571 ></LI
3572 ><LI
3573 ><P
3574 >roving user profiles</P
3575 ></LI
3576 ><LI
3577 ><P
3578 >Windows NT 4.0 style system policies</P
3579 ></LI
3580 ></UL
3581 ><P
3582 >The following pieces of functionality are not included in the 2.2 release:</P
3583 ><P
3584 ></P
3585 ><UL
3586 ><LI
3587 ><P
3588 >Windows NT 4 domain trusts</P
3589 ></LI
3590 ><LI
3591 ><P
3592 >Sam replication with Windows NT 4.0 Domain Controllers
3593         (i.e. a Samba PDC and a Windows NT BDC or vice versa) </P
3594 ></LI
3595 ><LI
3596 ><P
3597 >Adding users via the User Manager for Domains</P
3598 ></LI
3599 ><LI
3600 ><P
3601 >Acting as a Windows 2000 Domain Controller (i.e. Kerberos
3602         and Active Directory)</P
3603 ></LI
3604 ></UL
3605 ><P
3606 >Please note that Windows 9x clients are not true members of a domain
3607 for reasons outlined in this article.  Therefore the protocol for
3608 support Windows 9x style domain logons is completely different
3609 from NT4 domain logons and has been officially supported for some
3610 time.</P
3611 ><P
3612 >Beginning with Samba 2.2.0, we are proud to announce official
3613 support for Windows NT 4.0 style domain logons from Windows NT
3614 4.0 and Windows 2000 (including SP1) clients.  This article
3615 outlines the steps necessary for configuring Samba as a PDC.
3616 Note that it is necessary to have a working Samba server
3617 prior to implementing the PDC functionality.  If you have not
3618 followed the steps outlined in <A
3619 HREF="UNIX_INSTALL.html"
3620 TARGET="_top"
3621 >UNIX_INSTALL.html</A
3622 >, please make sure that your server
3623 is configured correctly before proceeding.  Another good
3624 resource in the <A
3625 HREF="smb.conf.5.html"
3626 TARGET="_top"
3627 >smb.conf(5) man
3628 page</A
3629 >.</P
3630 ><P
3631 >Implementing a Samba PDC can basically be divided into 2 broad
3632 steps.</P
3633 ><P
3634 ></P
3635 ><OL
3636 TYPE="1"
3637 ><LI
3638 ><P
3639 >Configuring the Samba Domain Controller
3640         </P
3641 ></LI
3642 ><LI
3643 ><P
3644 >Creating machine trust accounts
3645         and joining clients to the domain</P
3646 ></LI
3647 ></OL
3648 ><P
3649 >There are other minor details such as user profiles, system
3650 policies, etc...  However, these are not necessarily specific
3651 to a Samba PDC as much as they are related to Windows NT networking
3652 concepts.  They will be mentioned only briefly here.</P
3653 ></DIV
3654 ><DIV
3655 CLASS="SECT1"
3656 ><HR><H1
3657 CLASS="SECT1"
3658 ><A
3659 NAME="AEN790"
3660 >6.2. Configuring the Samba Domain Controller</A
3661 ></H1
3662 ><P
3663 >The first step in creating a working Samba PDC is to
3664 understand the parameters necessary in smb.conf.  I will not
3665 attempt to re-explain the parameters here as they are more that
3666 adequately covered in <A
3667 HREF="smb.conf.5.html"
3668 TARGET="_top"
3669 > the smb.conf
3670 man page</A
3671 >.  For convenience, the parameters have been
3672 linked with the actual smb.conf description.</P
3673 ><P
3674 >Here is an example smb.conf for acting as a PDC:</P
3675 ><P
3676 ><TABLE
3677 BORDER="0"
3678 BGCOLOR="#E0E0E0"
3679 WIDTH="100%"
3680 ><TR
3681 ><TD
3682 ><PRE
3683 CLASS="PROGRAMLISTING"
3684 >[global]
3685     ; Basic server settings
3686     <A
3687 HREF="smb.conf.5.html#NETBIOSNAME"
3688 TARGET="_top"
3689 >netbios name</A
3690 > = <TT
3691 CLASS="REPLACEABLE"
3692 ><I
3693 >POGO</I
3694 ></TT
3695 >
3696     <A
3697 HREF="smb.conf.5.html#WORKGROUP"
3698 TARGET="_top"
3699 >workgroup</A
3700 > = <TT
3701 CLASS="REPLACEABLE"
3702 ><I
3703 >NARNIA</I
3704 ></TT
3705 >
3706
3707     ; we should act as the domain and local master browser
3708     <A
3709 HREF="smb.conf.5.html#OSLEVEL"
3710 TARGET="_top"
3711 >os level</A
3712 > = 64
3713     <A
3714 HREF="smb.conf.5.html#PERFERREDMASTER"
3715 TARGET="_top"
3716 >preferred master</A
3717 > = yes
3718     <A
3719 HREF="smb.conf.5.html#DOMAINMASTER"
3720 TARGET="_top"
3721 >domain master</A
3722 > = yes
3723     <A
3724 HREF="smb.conf.5.html#LOCALMASTER"
3725 TARGET="_top"
3726 >local master</A
3727 > = yes
3728
3729     ; security settings (must user security = user)
3730     <A
3731 HREF="smb.conf.5.html#SECURITYEQUALSUSER"
3732 TARGET="_top"
3733 >security</A
3734 > = user
3735
3736     ; encrypted passwords are a requirement for a PDC
3737     <A
3738 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
3739 TARGET="_top"
3740 >encrypt passwords</A
3741 > = yes
3742
3743     ; support domain logons
3744     <A
3745 HREF="smb.conf.5.html#DOMAINLOGONS"
3746 TARGET="_top"
3747 >domain logons</A
3748 > = yes
3749
3750     ; where to store user profiles?
3751     <A
3752 HREF="smb.conf.5.html#LOGONPATH"
3753 TARGET="_top"
3754 >logon path</A
3755 > = \\%N\profiles\%u
3756
3757     ; where is a user's home directory and where should it
3758     ; be mounted at?
3759     <A
3760 HREF="smb.conf.5.html#LOGONDRIVE"
3761 TARGET="_top"
3762 >logon drive</A
3763 > = H:
3764     <A
3765 HREF="smb.conf.5.html#LOGONHOME"
3766 TARGET="_top"
3767 >logon home</A
3768 > = \\homeserver\%u
3769
3770     ; specify a generic logon script for all users
3771     ; this is a relative path to the [netlogon] share
3772     <A
3773 HREF="smb.conf.5.html#LOGONSCRIPT"
3774 TARGET="_top"
3775 >logon script</A
3776 > = logon.cmd
3777
3778 ; necessary share for domain controller
3779 [netlogon]
3780     <A
3781 HREF="smb.conf.5.html#PATH"
3782 TARGET="_top"
3783 >path</A
3784 > = /usr/local/samba/lib/netlogon
3785     <A
3786 HREF="smb.conf.5.html#WRITEABLE"
3787 TARGET="_top"
3788 >writeable</A
3789 > = no
3790     <A
3791 HREF="smb.conf.5.html#WRITELIST"
3792 TARGET="_top"
3793 >write list</A
3794 > = <TT
3795 CLASS="REPLACEABLE"
3796 ><I
3797 >ntadmin</I
3798 ></TT
3799 >
3800
3801 ; share for storing user profiles
3802 [profiles]
3803     <A
3804 HREF="smb.conf.5.html#PATH"
3805 TARGET="_top"
3806 >path</A
3807 > = /export/smb/ntprofile
3808     <A
3809 HREF="smb.conf.5.html#WRITEABLE"
3810 TARGET="_top"
3811 >writeable</A
3812 > = yes
3813     <A
3814 HREF="smb.conf.5.html#CREATEMASK"
3815 TARGET="_top"
3816 >create mask</A
3817 > = 0600
3818     <A
3819 HREF="smb.conf.5.html#DIRECTORYMASK"
3820 TARGET="_top"
3821 >directory mask</A
3822 > = 0700</PRE
3823 ></TD
3824 ></TR
3825 ></TABLE
3826 ></P
3827 ><P
3828 >There are a couple of points to emphasize in the above
3829 configuration.</P
3830 ><P
3831 ></P
3832 ><UL
3833 ><LI
3834 ><P
3835 >encrypted passwords must be enabled.
3836         For more details on how to do this, refer to
3837         <A
3838 HREF="ENCRYPTION.html"
3839 TARGET="_top"
3840 >ENCRYPTION.html</A
3841 >.
3842         </P
3843 ></LI
3844 ><LI
3845 ><P
3846 >The server must support domain logons
3847         and a <TT
3848 CLASS="FILENAME"
3849 >[netlogon]</TT
3850 > share</P
3851 ></LI
3852 ><LI
3853 ><P
3854 >The server must be the domain master browser
3855         in order for Windows client to locate the server as a DC.</P
3856 ></LI
3857 ></UL
3858 ><P
3859 >As Samba 2.2 does not offer a complete implementation of group mapping between
3860 Windows NT groups and UNIX groups (this is really quite complicated to explain
3861 in a short space), you should refer to the <A
3862 HREF="smb.conf.5.html#DOMAINADMONUSERS"
3863 TARGET="_top"
3864 >domain
3865 admin users</A
3866 > and <A
3867 HREF="smb.conf.5.html#DOMAINADMINGROUP"
3868 TARGET="_top"
3869 >domain
3870 admin group</A
3871 > smb.conf parameters for information of creating a Domain Admins
3872 style accounts.</P
3873 ></DIV
3874 ><DIV
3875 CLASS="SECT1"
3876 ><HR><H1
3877 CLASS="SECT1"
3878 ><A
3879 NAME="AEN833"
3880 >6.3. Creating Machine Trust Accounts and Joining Clients
3881 to the Domain</A
3882 ></H1
3883 ><P
3884 >First you must understand what a machine trust account is and what
3885 it is used for.</P
3886 ><P
3887 >A machine trust account is a user account owned by a computer.
3888 The account password acts as the shared secret for secure
3889 communication with the Domain Controller.  Hence the reason that
3890 a Windows 9x host is never a true member of a domain because
3891 it does not posses a machine trust account and thus has no shared
3892 secret with the DC.</P
3893 ><P
3894 >On a Windows NT PDC, these machine trust account passwords are stored
3895 in the registry.  A Samba PDC stores these accounts in he same location
3896 as user LanMan and NT password hashes (currently <TT
3897 CLASS="FILENAME"
3898 >smbpasswd</TT
3899 >).
3900 However, machine trust accounts only possess the NT password hash.</P
3901 ><P
3902 >There are two means of creating machine trust accounts.</P
3903 ><P
3904 ></P
3905 ><UL
3906 ><LI
3907 ><P
3908 >Manual creation before joining the client
3909         to the domain.  In this case, the password is set to a known
3910         value -- the lower case of the machine's netbios name.</P
3911 ></LI
3912 ><LI
3913 ><P
3914 >Creation of the account at the time of
3915         joining the domain.  In this case, the session key of the
3916         administrative account used to join the client to the domain acts
3917         as an encryption key for setting the password to a random value.</P
3918 ></LI
3919 ></UL
3920 ><P
3921 >Because Samba requires machine accounts to possess a UNIX uid from
3922 which an Windows NT SID can be generated, all of these accounts
3923 will have an entry in <TT
3924 CLASS="FILENAME"
3925 >/etc/passwd</TT
3926 > and smbpasswd.
3927 Future releases will alleviate the need to create
3928 <TT
3929 CLASS="FILENAME"
3930 >/etc/passwd</TT
3931 > entries.</P
3932 ><P
3933 >The <TT
3934 CLASS="FILENAME"
3935 >/etc/passwd</TT
3936 > entry will list the machine name
3937 with a $ appended, won't have a passwd, will have a null shell and no
3938 home directory. For example a machine called 'doppy' would have an
3939 <TT
3940 CLASS="FILENAME"
3941 >/etc/passwd</TT
3942 > entry like this :</P
3943 ><P
3944 ><TABLE
3945 BORDER="0"
3946 BGCOLOR="#E0E0E0"
3947 WIDTH="100%"
3948 ><TR
3949 ><TD
3950 ><PRE
3951 CLASS="PROGRAMLISTING"
3952 >doppy$:x:505:501:NTMachine:/dev/null:/bin/false</PRE
3953 ></TD
3954 ></TR
3955 ></TABLE
3956 ></P
3957 ><P
3958 >If you are manually creating the machine accounts, it is necessary
3959 to add the <TT
3960 CLASS="FILENAME"
3961 >/etc/passwd</TT
3962 > (or NIS passwd
3963 map) entry prior to adding the <TT
3964 CLASS="FILENAME"
3965 >smbpasswd</TT
3966 >
3967 entry.  The following command will create a new machine account
3968 ready for use.</P
3969 ><P
3970 ><TT
3971 CLASS="PROMPT"
3972 >root# </TT
3973 > smbpasswd -a -m <TT
3974 CLASS="REPLACEABLE"
3975 ><I
3976 >machine_name</I
3977 ></TT
3978 ></P
3979 ><P
3980 >where <TT
3981 CLASS="REPLACEABLE"
3982 ><I
3983 >machine_name</I
3984 ></TT
3985 > is the machine's netbios
3986 name.</P
3987 ><P
3988 ><EM
3989 >If you manually create a machine account, immediately join
3990 the client to the domain.</EM
3991 >  An open account like this
3992 can allow intruders to gain access to user account information
3993 in your domain.</P
3994 ><P
3995 >The second way of creating machine trust accounts is to add
3996 them on the fly at the time the client is joined to the domain.
3997 You will need to include a value for the
3998 <A
3999 HREF="smb.conf.5.html#ADDUSERSCRIPT"
4000 TARGET="_top"
4001 >add user script</A
4002 >
4003 parameter.  Below is an example I use on a RedHat 6.2 Linux system.</P
4004 ><P
4005 ><TABLE
4006 BORDER="0"
4007 BGCOLOR="#E0E0E0"
4008 WIDTH="100%"
4009 ><TR
4010 ><TD
4011 ><PRE
4012 CLASS="PROGRAMLISTING"
4013 >add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
4014 ></TD
4015 ></TR
4016 ></TABLE
4017 ></P
4018 ><P
4019 >In Samba 2.2.0, <EM
4020 >only the root account</EM
4021 > can be used to create
4022 machine accounts on the fly like this.  Therefore, it is required
4023 to create an entry in smbpasswd for <EM
4024 >root</EM
4025 >.
4026 The password <EM
4027 >SHOULD</EM
4028 > be set to s different
4029 password that the associated <TT
4030 CLASS="FILENAME"
4031 >/etc/passwd</TT
4032 >
4033 entry for security reasons.</P
4034 ></DIV
4035 ><DIV
4036 CLASS="SECT1"
4037 ><HR><H1
4038 CLASS="SECT1"
4039 ><A
4040 NAME="AEN872"
4041 >6.4. Common Problems and Errors</A
4042 ></H1
4043 ><P
4044 ></P
4045 ><P
4046 ><EM
4047 >I cannot include a '$' in a machine name.</EM
4048 ></P
4049 ><P
4050 >A 'machine name' in (typically) <TT
4051 CLASS="FILENAME"
4052 >/etc/passwd</TT
4053 >
4054 of the machine name with a '$' appended. FreeBSD (and other BSD
4055 systems ?) won't create a user with a '$' in their name.</P
4056 ><P
4057 >The problem is only in the program used to make the entry, once
4058 made, it works perfectly. So create a user without the '$' and
4059 use <B
4060 CLASS="COMMAND"
4061 >vipw</B
4062 > to edit the entry, adding the '$'. Or create
4063 the whole entry with vipw if you like, make sure you use a
4064 unique uid !</P
4065 ><P
4066 ><EM
4067 >I get told "You already have a connection to the Domain...."
4068 when creating a machine account.</EM
4069 ></P
4070 ><P
4071 >This happens if you try to create a machine account from the
4072 machine itself and use a user name that does not work (for whatever
4073 reason) and then try another (possibly valid) user name.
4074 Exit out of the network applet to close the initial connection
4075 and try again.</P
4076 ><P
4077 >Further, if the machine is a already a 'member of a workgroup' that
4078 is the same name as the domain you are joining (bad idea) you will
4079 get this message.  Change the workgroup name to something else, it
4080 does not matter what, reboot, and try again.</P
4081 ><P
4082 ><EM
4083 >I get told "Cannot join domain, the credentials supplied
4084 conflict with an existing set.."</EM
4085 ></P
4086 ><P
4087 >This is the same basic problem as mentioned above, "You already
4088 have a connection..."</P
4089 ><P
4090 ><EM
4091 >"The system can not log you on (C000019B)...."</EM
4092 ></P
4093 ><P
4094 >I joined the domain successfully but after upgrading
4095 to a newer version of the Samba code I get the message, "The system
4096 can not log you on (C000019B), Please try a gain or consult your
4097 system administrator" when attempting to logon.</P
4098 ><P
4099 >This occurs when the domain SID stored in
4100 <TT
4101 CLASS="FILENAME"
4102 >private/WORKGROUP.SID</TT
4103 > is
4104 changed.  For example, you remove the file and <B
4105 CLASS="COMMAND"
4106 >smbd</B
4107 > automatically
4108 creates a new one.  Or you are swapping back and forth between
4109 versions 2.0.7, TNG and the HEAD branch code (not recommended).  The
4110 only way to correct the problem is to restore the original domain
4111 SID or  remove the domain client from the domain and rejoin.</P
4112 ><P
4113 ><EM
4114 >"The machine account for this computer either does not
4115 exist or is not accessible."</EM
4116 ></P
4117 ><P
4118 >When I try to join the domain I get the message "The machine account
4119 for this computer either does not exist or is not accessible". Whats
4120 wrong ?</P
4121 ><P
4122 >This problem is caused by the PDC not having a suitable machine account.
4123 If you are using the <B
4124 CLASS="COMMAND"
4125 >add user script =</B
4126 > method to create
4127 accounts then this would indicate that it has not worked. Ensure the domain
4128 admin user system is working.</P
4129 ><P
4130 >Alternatively if you are creating account entries manually then they
4131 have not been created correctly. Make sure that you have the entry
4132 correct for the machine account in smbpasswd file on the Samba PDC.
4133 If you added the account using an editor rather than using the smbpasswd
4134 utility, make sure that the account name is the machine netbios name
4135 with a '$' appended to it ( ie. computer_name$ ). There must be an entry
4136 in both /etc/passwd and the smbpasswd file. Some people have reported
4137 that inconsistent subnet masks between the Samba server and the NT
4138 client have caused this problem.   Make sure that these are consistent
4139 for both client and server.</P
4140 ></DIV
4141 ><DIV
4142 CLASS="SECT1"
4143 ><HR><H1
4144 CLASS="SECT1"
4145 ><A
4146 NAME="AEN900"
4147 >6.5. System Policies and Profiles</A
4148 ></H1
4149 ><P
4150 >Much of the information necessary to implement System Policies and
4151 Roving User Profiles in a Samba domain is the same as that for
4152 implementing these same items in a Windows NT 4.0 domain.
4153 You should read the white paper <A
4154 HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
4155 TARGET="_top"
4156 >Implementing
4157 Profiles and Policies in Windows NT 4.0</A
4158 > available from Microsoft.</P
4159 ><P
4160 >Here are some additional details:</P
4161 ><P
4162 ><EM
4163 >What about Windows NT Policy Editor ?</EM
4164 ></P
4165 ><P
4166 >To create or edit <TT
4167 CLASS="FILENAME"
4168 >ntconfig.pol</TT
4169 > you must use
4170 the NT Server Policy Editor, <B
4171 CLASS="COMMAND"
4172 >poledit.exe</B
4173 >       which
4174 is included with NT Server but <EM
4175 >not NT Workstation</EM
4176 >.
4177 There is a Policy Editor on a NTws
4178 but it is not suitable for creating <EM
4179 >Domain Policies</EM
4180 >.
4181 Further, although the Windows 95
4182 Policy Editor can be installed on an NT Workstation/Server, it will not
4183 work with NT policies because the registry key that are set by the policy templates.
4184 However, the files from the NT Server will run happily enough on an NTws.
4185 You need <TT
4186 CLASS="FILENAME"
4187 >poledit.exe, common.adm</TT
4188 > and <TT
4189 CLASS="FILENAME"
4190 >winnt.adm</TT
4191 >. It is convenient
4192 to put the two *.adm files in <TT
4193 CLASS="FILENAME"
4194 >c:\winnt\inf</TT
4195 > which is where
4196 the binary will look for them unless told otherwise. Note also that that
4197 directory is 'hidden'.</P
4198 ><P
4199 >The Windows NT policy editor is also included with the
4200 Service Pack 3 (and later) for Windows NT 4.0. Extract the files using
4201 <B
4202 CLASS="COMMAND"
4203 >servicepackname /x</B
4204 >, ie thats <B
4205 CLASS="COMMAND"
4206 >Nt4sp6ai.exe
4207 /x</B
4208 > for service pack 6a.  The policy editor, <B
4209 CLASS="COMMAND"
4210 >poledit.exe</B
4211 > and the
4212 associated template files (*.adm) should
4213 be extracted as well.  It is also possible to downloaded the policy template
4214 files for Office97 and get a copy of the policy editor.  Another possible
4215 location is with the Zero Administration Kit available for download from Microsoft.</P
4216 ><P
4217 ><EM
4218 >Can Win95 do Policies ?</EM
4219 ></P
4220 ><P
4221 >Install the group policy handler for Win9x to pick up group
4222 policies.   Look on the Win98 CD in <TT
4223 CLASS="FILENAME"
4224 >\tools\reskit\netadmin\poledit</TT
4225 >.
4226 Install group policies on a Win9x client by double-clicking
4227 <TT
4228 CLASS="FILENAME"
4229 >grouppol.inf</TT
4230 >. Log off and on again a couple of
4231 times and see if Win98 picks up group policies.  Unfortunately this needs
4232 to be done on every Win9x machine that uses group policies....</P
4233 ><P
4234 >If group policies don't work one reports suggests getting the updated
4235 (read: working) grouppol.dll for Windows 9x. The group list is grabbed
4236 from /etc/group.</P
4237 ><P
4238 ><EM
4239 >How do I get 'User Manager' and 'Server Manager'</EM
4240 ></P
4241 ><P
4242 >Since I don't need to buy an NT Server CD now, how do I get
4243 the 'User Manager for Domains', the 'Server Manager' ?</P
4244 ><P
4245 >Microsoft distributes a version of
4246 these tools called nexus for installation on Windows 95 systems.  The
4247 tools set includes</P
4248 ><P
4249 ></P
4250 ><UL
4251 ><LI
4252 ><P
4253 >Server Manager</P
4254 ></LI
4255 ><LI
4256 ><P
4257 >User Manager for Domains</P
4258 ></LI
4259 ><LI
4260 ><P
4261 >Event Viewer</P
4262 ></LI
4263 ></UL
4264 ><P
4265 >Click here to download the archived file <A
4266 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
4267 TARGET="_top"
4268 >ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
4269 ></P
4270 ><P
4271 >The Windows NT 4.0 version of the 'User Manager for
4272 Domains' and 'Server Manager' are available from Microsoft via ftp
4273 from <A
4274 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
4275 TARGET="_top"
4276 >ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
4277 ></P
4278 ></DIV
4279 ><DIV
4280 CLASS="SECT1"
4281 ><HR><H1
4282 CLASS="SECT1"
4283 ><A
4284 NAME="AEN940"
4285 >6.6. What other help can I get ?</A
4286 ></H1
4287 ><P
4288 >There are many sources of information available in the form
4289 of mailing lists, RFC's and documentation.  The docs that come
4290 with the samba distribution contain very good explanations of
4291 general SMB topics such as browsing.</P
4292 ><P
4293 ><EM
4294 >What are some diagnostics tools I can use to debug the domain logon
4295 process and where can I find them?</EM
4296 ></P
4297 ><P
4298 >       One of the best diagnostic tools for debugging problems is Samba itself.
4299         You can use the -d option for both smbd and nmbd to specifiy what
4300         'debug level' at which to run.  See the man pages on smbd, nmbd  and
4301         smb.conf for more information on debugging options.  The debug
4302         level can range from 1 (the default) to 10 (100 for debugging passwords).
4303         </P
4304 ><P
4305 >       Another helpful method of debugging is to compile samba using the
4306         <B
4307 CLASS="COMMAND"
4308 >gcc -g </B
4309 > flag.   This will include debug
4310         information in the binaries and allow you to attach gdb to the
4311         running smbd / nmbd process.  In order to attach gdb to an smbd
4312         process for an NT workstation, first get the workstation to make the
4313         connection. Pressing ctrl-alt-delete and going down to the domain box
4314         is sufficient (at least, on the first time you join the domain) to
4315         generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
4316         maintains an open connection, and therefore there will be an smbd
4317         process running (assuming that you haven't set a really short smbd
4318         idle timeout)  So, in between pressing ctrl alt delete, and actually
4319         typing in your password, you can gdb attach and continue.
4320         </P
4321 ><P
4322 >       Some useful samba commands worth investigating:
4323         </P
4324 ><P
4325 ></P
4326 ><UL
4327 ><LI
4328 ><P
4329 >testparam | more</P
4330 ></LI
4331 ><LI
4332 ><P
4333 >smbclient -L //{netbios name of server}</P
4334 ></LI
4335 ></UL
4336 ><P
4337 >       An SMB enabled version of tcpdump is available from
4338     <A
4339 HREF="http://www.tcpdump.org/"
4340 TARGET="_top"
4341 >http://www.tcpdup.org/</A
4342 >.
4343         Ethereal, another good packet sniffer for UNIX and Win32
4344         hosts, can be downloaded from <A
4345 HREF="http://www.ethereal.com/"
4346 TARGET="_top"
4347 >http://www.ethereal.com</A
4348 >.
4349         </P
4350 ><P
4351 >       For tracing things on the Microsoft Windows NT, Network Monitor
4352         (aka. netmon) is available on the Microsoft Developer Network CD's,
4353         the Windows NT Server install CD and the SMS CD's.  The version of
4354         netmon that ships with SMS allows for dumping packets between any two
4355         computers (ie. placing the network interface in promiscuous mode).
4356         The version on the NT Server install CD will only allow monitoring
4357         of network traffic directed to the local NT box and broadcasts on the
4358         local subnet.  Be aware that Ethereal can read and write netmon
4359         formatted files.
4360         </P
4361 ><P
4362 ><EM
4363 >How do I install 'Network Monitor' on an NT Workstation
4364 or a Windows 9x box?</EM
4365 ></P
4366 ><P
4367 >       Installing netmon on an NT workstation requires a couple
4368         of steps.  The following are for installing Netmon V4.00.349, which comes
4369         with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
4370         Workstation 4.0.  The process should be similar for other version of
4371         Windows NT / Netmon.  You will need both the Microsoft Windows
4372         NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
4373         </P
4374 ><P
4375 >       Initially you will need to install 'Network Monitor Tools and Agent'
4376         on the NT Server.  To do this
4377         </P
4378 ><P
4379 ></P
4380 ><UL
4381 ><LI
4382 ><P
4383 >Goto Start - Settings - Control Panel -
4384                 Network - Services - Add </P
4385 ></LI
4386 ><LI
4387 ><P
4388 >Select the 'Network Monitor Tools and Agent' and
4389                 click on 'OK'.</P
4390 ></LI
4391 ><LI
4392 ><P
4393 >Click 'OK' on the Network Control Panel.
4394                 </P
4395 ></LI
4396 ><LI
4397 ><P
4398 >Insert the Windows NT Server 4.0 install CD
4399                 when prompted.</P
4400 ></LI
4401 ></UL
4402 ><P
4403 >       At this point the Netmon files should exist in
4404         <TT
4405 CLASS="FILENAME"
4406 >%SYSTEMROOT%\System32\netmon\*.*</TT
4407 >.
4408         Two subdirectories exist as well, <TT
4409 CLASS="FILENAME"
4410 >parsers\</TT
4411 >
4412         which contains the necessary DLL's for parsing the netmon packet
4413         dump, and <TT
4414 CLASS="FILENAME"
4415 >captures\</TT
4416 >.
4417         </P
4418 ><P
4419 >       In order to install the Netmon tools on an NT Workstation, you will
4420         first need to install the 'Network  Monitor Agent' from the Workstation
4421         install CD.
4422         </P
4423 ><P
4424 ></P
4425 ><UL
4426 ><LI
4427 ><P
4428 >Goto Start - Settings - Control Panel -
4429                 Network - Services - Add</P
4430 ></LI
4431 ><LI
4432 ><P
4433 >Select the 'Network Monitor Agent' and click
4434                 on 'OK'.</P
4435 ></LI
4436 ><LI
4437 ><P
4438 >Click 'OK' on the Network Control Panel.
4439                 </P
4440 ></LI
4441 ><LI
4442 ><P
4443 >Insert the Windows NT Workstation 4.0 install
4444                 CD when prompted.</P
4445 ></LI
4446 ></UL
4447 ><P
4448 >       Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
4449         to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
4450         permissions as  you deem appropriate for your site. You will need
4451         administrative rights on the NT box to run netmon.
4452         </P
4453 ><P
4454 >       To install Netmon on a Windows 9x box install the network monitor agent
4455         from the Windows 9x CD (\admin\nettools\netmon).  There is a readme
4456         file located with the netmon driver files on the CD if you need
4457         information on how to do this.  Copy the files from a working
4458         Netmon installation.
4459         </P
4460 ><DIV
4461 CLASS="SECT2"
4462 ><HR><H2
4463 CLASS="SECT2"
4464 ><A
4465 NAME="AEN987"
4466 >6.6.1. URLs and similar</A
4467 ></H2
4468 ><P
4469 ></P
4470 ><UL
4471 ><LI
4472 ><P
4473 >Home of Samba site <A
4474 HREF="http://samba.org"
4475 TARGET="_top"
4476 >        http://samba.org</A
4477 >. We have a mirror near you !</P
4478 ></LI
4479 ><LI
4480 ><P
4481 > The <EM
4482 >Development</EM
4483 > document
4484         on the Samba mirrors might mention your problem. If so,
4485         it might mean that the developers are working on it.</P
4486 ></LI
4487 ><LI
4488 ><P
4489 >See how Scott Merrill simulates a BDC behavior at
4490         <A
4491 HREF="http://www.skippy.net/linux/smb-howto.html"
4492 TARGET="_top"
4493 >        http://www.skippy.net/linux/smb-howto.html</A
4494 >. </P
4495 ></LI
4496 ><LI
4497 ><P
4498 >Although 2.0.7 has almost had its day as a PDC, David Bannon will
4499         keep the 2.0.7 PDC pages at <A
4500 HREF="http://bioserve.latrobe.edu.au/samba"
4501 TARGET="_top"
4502 >        http://bioserve.latrobe.edu.au/samba</A
4503 > going for a while yet.</P
4504 ></LI
4505 ><LI
4506 ><P
4507 >Misc links to CIFS information
4508         <A
4509 HREF="http://samba.org/cifs/"
4510 TARGET="_top"
4511 >http://samba.org/cifs/</A
4512 ></P
4513 ></LI
4514 ><LI
4515 ><P
4516 >NT Domains for Unix <A
4517 HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
4518 TARGET="_top"
4519 >        http://mailhost.cb1.com/~lkcl/ntdom/</A
4520 ></P
4521 ></LI
4522 ><LI
4523 ><P
4524 >FTP site for older SMB specs:
4525         <A
4526 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
4527 TARGET="_top"
4528 >        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
4529 ></P
4530 ></LI
4531 ></UL
4532 ></DIV
4533 ><DIV
4534 CLASS="SECT2"
4535 ><HR><H2
4536 CLASS="SECT2"
4537 ><A
4538 NAME="AEN1011"
4539 >6.6.2. Mailing Lists</A
4540 ></H2
4541 ><P
4542 ><EM
4543 >How do I get help from the mailing lists ?</EM
4544 ></P
4545 ><P
4546 >There are a number of Samba related mailing lists. Go to <A
4547 HREF="http://samba.org"
4548 TARGET="_top"
4549 >http://samba.org</A
4550 >, click on your nearest mirror
4551 and then click on <B
4552 CLASS="COMMAND"
4553 >Support</B
4554 > and then click on <B
4555 CLASS="COMMAND"
4556 >Samba related mailing lists</B
4557 >.</P
4558 ><P
4559 >For questions relating to Samba TNG go to
4560 <A
4561 HREF="http://www.samba-tng.org/"
4562 TARGET="_top"
4563 >http://www.samba-tng.org/</A
4564 >
4565 It has been requested that you don't post questions about Samba-TNG to the
4566 main stream Samba lists.</P
4567 ><P
4568 >If you post a message to one of the lists please observe the following guide lines :</P
4569 ><P
4570 ></P
4571 ><UL
4572 ><LI
4573 ><P
4574 > Always remember that the developers are volunteers, they are
4575                 not paid and they never guarantee to produce a particular feature at
4576                 a particular time. Any time lines are 'best guess' and nothing more.
4577                 </P
4578 ></LI
4579 ><LI
4580 ><P
4581 > Always mention what version of samba you are using and what
4582                 operating system its running under. You should probably list the
4583         relevant sections of your smb.conf file, at least the options
4584         in [global] that affect PDC support.</P
4585 ></LI
4586 ><LI
4587 ><P
4588 >In addition to the version, if you obtained Samba via
4589         CVS mention the date when you last checked it out.</P
4590 ></LI
4591 ><LI
4592 ><P
4593 > Try and make your question clear and brief, lots of long,
4594                 convoluted questions get deleted before they are completely read !
4595                 Don't post html encoded messages (if you can select colour or font
4596                 size its html).</P
4597 ></LI
4598 ><LI
4599 ><P
4600 > If you run one of those nifty 'I'm on holidays' things when
4601                 you are away, make sure its configured  to not answer mailing lists.
4602                 </P
4603 ></LI
4604 ><LI
4605 ><P
4606 > Don't cross post. Work out which is the best list to post to
4607                 and see what happens, ie don't post to both samba-ntdom and samba-technical.
4608         Many people active on the lists subscribe to more
4609                 than one list and get annoyed to see the same message two or more times.
4610                 Often someone will see a message and thinking it would be better dealt
4611                 with on another, will forward it on for you.</P
4612 ></LI
4613 ><LI
4614 ><P
4615 >You might include <EM
4616 >partial</EM
4617 >
4618         log files written at a debug level set to as much as 20.
4619         Please don't send the entire log but enough to give the context of the
4620         error messages.</P
4621 ></LI
4622 ><LI
4623 ><P
4624 >(Possibly) If you have a complete netmon trace ( from the opening of
4625         the pipe to the error ) you can send the *.CAP file as well.</P
4626 ></LI
4627 ><LI
4628 ><P
4629 >Please think carefully before attaching a document to an email.
4630         Consider pasting the relevant parts into the body of the message. The samba
4631         mailing lists go to a huge number of people, do they all need a copy of your
4632         smb.conf in their attach directory ?</P
4633 ></LI
4634 ></UL
4635 ><P
4636 ><EM
4637 >How do I get off the mailing lists ?</EM
4638 ></P
4639 ><P
4640 >To have your name removed from a samba mailing list, go to the
4641         same place you went to to get on it. Go to <A
4642 HREF="http://lists.samba.org/"
4643 TARGET="_top"
4644 >http://lists.samba.org</A
4645 >, click
4646                 on your nearest mirror and then click on <B
4647 CLASS="COMMAND"
4648 >Support</B
4649 > and
4650                 then click on <B
4651 CLASS="COMMAND"
4652 > Samba related mailing lists</B
4653 >. Or perhaps see
4654         <A
4655 HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
4656 TARGET="_top"
4657 >here</A
4658 ></P
4659 ><P
4660 >       Please don't post messages to the list asking to be removed, you will just
4661         be referred to the above address (unless that process failed in some way...)
4662     </P
4663 ></DIV
4664 ></DIV
4665 ><DIV
4666 CLASS="SECT1"
4667 ><HR><H1
4668 CLASS="SECT1"
4669 ><A
4670 NAME="AEN1050"
4671 >6.7. DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
4672 ></H1
4673 ><P
4674 >This appendix was originally authored by John H Terpstra of the Samba Team
4675 and is included here for posterity.</P
4676 ><P
4677 ><EM
4678 >NOTE :</EM
4679 >
4680 The term "Domain Controller" and those related to it refer to one specific
4681 method of authentication that can underly an SMB domain. Domain Controllers
4682 prior to Windows NT Server 3.1 were sold by various companies and based on
4683 private extensions to the LAN Manager 2.1 protocol. Windows NT introduced
4684 Microsoft-specific ways of distributing the user authentication database.
4685 See DOMAIN.txt for examples of how Samba can participate in or create
4686 SMB domains based on shared authentication database schemes other than the
4687 Windows NT SAM.</P
4688 ><P
4689 >Windows NT Server can be installed as either a plain file and print server
4690 (WORKGROUP workstation or server) or as a server that participates in Domain
4691 Control (DOMAIN member, Primary Domain controller or Backup Domain controller).</P
4692 ><P
4693 >The same is true for OS/2 Warp Server, Digital Pathworks and other similar
4694 products, all of which can participate in Domain Control along with Windows NT.
4695 However only those servers which have licensed Windows NT code in them can be
4696 a primary Domain Controller (eg Windows NT Server, Advanced Server for Unix.)</P
4697 ><P
4698 >To many people these terms can be confusing, so let's try to clear the air.</P
4699 ><P
4700 >Every Windows NT system (workstation or server) has a registry database.
4701 The registry contains entries that describe the initialization information
4702 for all services (the equivalent of Unix Daemons) that run within the Windows
4703 NT environment. The registry also contains entries that tell application
4704 software where to find dynamically loadable libraries that they depend upon.
4705 In fact, the registry contains entries that describes everything that anything
4706 may need to know to interact with the rest of the system.</P
4707 ><P
4708 >The registry files can be located on any Windows NT machine by opening a
4709 command prompt and typing:</P
4710 ><P
4711 ><TT
4712 CLASS="PROMPT"
4713 >C:\WINNT\&#62;</TT
4714 > dir %SystemRoot%\System32\config</P
4715 ><P
4716 >The environment variable %SystemRoot% value can be obtained by typing:</P
4717 ><P
4718 ><TT
4719 CLASS="PROMPT"
4720 >C:\WINNT&#62;</TT
4721 >echo %SystemRoot%</P
4722 ><P
4723 >The active parts of the registry that you may want to be familiar with are
4724 the files called: default, system, software, sam and security.</P
4725 ><P
4726 >In a domain environment, Microsoft Windows NT domain controllers participate
4727 in replication of the SAM and SECURITY files so that all controllers within
4728 the domain have an exactly identical copy of each.</P
4729 ><P
4730 >The Microsoft Windows NT system is structured within a security model that
4731 says that all applications and services must authenticate themselves before
4732 they can obtain permission from the security manager to do what they set out
4733 to do.</P
4734 ><P
4735 >The Windows NT User database also resides within the registry. This part of
4736 the registry contains the user's security identifier, home directory, group
4737 memberships, desktop profile, and so on.</P
4738 ><P
4739 >Every Windows NT system (workstation as well as server) will have its own
4740 registry. Windows NT Servers that participate in Domain Security control
4741 have a database that they share in common - thus they do NOT own an
4742 independent full registry database of their own, as do Workstations and
4743 plain Servers.</P
4744 ><P
4745 >The User database is called the SAM (Security Access Manager) database and
4746 is used for all user authentication as well as for authentication of inter-
4747 process authentication (ie: to ensure that the service action a user has
4748 requested is permitted within the limits of that user's privileges).</P
4749 ><P
4750 >The Samba team have produced a utility that can dump the Windows NT SAM into
4751 smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and
4752 /pub/samba/pwdump on your nearest Samba mirror for the utility. This
4753 facility is useful but cannot be easily used to implement SAM replication
4754 to Samba systems.</P
4755 ><P
4756 >Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers
4757 can participate in a Domain security system that is controlled by Windows NT
4758 servers that have been correctly configured. At most every domain will have
4759 ONE Primary Domain Controller (PDC). It is desirable that each domain will
4760 have at least one Backup Domain Controller (BDC).</P
4761 ><P
4762 >The PDC and BDCs then participate in replication of the SAM database so that
4763 each Domain Controlling participant will have an up to date SAM component
4764 within its registry.</P
4765 ></DIV
4766 ></DIV
4767 ><DIV
4768 CLASS="CHAPTER"
4769 ><HR><H1
4770 ><A
4771 NAME="AEN1074"
4772 >Chapter 7. Unifed Logons between Windows NT and UNIX using Winbind</A
4773 ></H1
4774 ><DIV
4775 CLASS="SECT1"
4776 ><H1
4777 CLASS="SECT1"
4778 ><A
4779 NAME="AEN1092"
4780 >7.1. Abstract</A
4781 ></H1
4782 ><P
4783 >Integration of UNIX and Microsoft Windows NT through
4784         a unified logon has been considered a "holy grail" in heterogeneous
4785         computing environments for a long time. We present <EM
4786 >winbind
4787         </EM
4788 >, a component of the Samba suite of programs as a
4789         solution to the unied logon problem. Winbind uses a UNIX implementation
4790         of Microsoft RPC calls, Pluggable Authentication Modules, and the Name
4791         Service Switch to allow Windows NT domain users to appear and operate
4792         as UNIX users on a UNIX machine. This paper describes the winbind
4793         system, explaining the functionality it provides, how it is configured,
4794         and how it works internally.</P
4795 ></DIV
4796 ><DIV
4797 CLASS="SECT1"
4798 ><HR><H1
4799 CLASS="SECT1"
4800 ><A
4801 NAME="AEN1096"
4802 >7.2. Introduction</A
4803 ></H1
4804 ><P
4805 >It is well known that UNIX and Microsoft Windows NT have
4806         different models for representing user and group information and
4807         use different technologies for implementing them. This fact has
4808         made it difficult to integrate the two systems in a satisfactory
4809         manner.</P
4810 ><P
4811 >One common solution in use today has been to create
4812         identically named user accounts on both the UNIX and Windows systems
4813         and use the Samba suite of programs to provide file and print services
4814         between the two. This solution is far from perfect however, as
4815         adding and deleting users on both sets of machines becomes a chore
4816         and two sets of passwords are required both of which which
4817         can lead to synchronization problems between the UNIX and Windows
4818         systems and confusion for users.</P
4819 ><P
4820 >We divide the unifed logon problem for UNIX machines into
4821         three smaller problems:</P
4822 ><P
4823 ></P
4824 ><UL
4825 ><LI
4826 ><P
4827 >Obtaining Windows NT user and group information
4828                 </P
4829 ></LI
4830 ><LI
4831 ><P
4832 >Authenticating Windows NT users
4833                 </P
4834 ></LI
4835 ><LI
4836 ><P
4837 >Password changing for Windows NT users
4838                 </P
4839 ></LI
4840 ></UL
4841 ><P
4842 >Ideally, a prospective solution to the unified logon problem
4843         would satisfy all the above components without duplication of
4844         information on the UNIX machines and without creating additional
4845         tasks for the system administrator when maintaining users and
4846         groups on either system. The winbind system provides a simple
4847         and elegant solution to all three components of the unifed logon
4848         problem.</P
4849 ></DIV
4850 ><DIV
4851 CLASS="SECT1"
4852 ><HR><H1
4853 CLASS="SECT1"
4854 ><A
4855 NAME="AEN1109"
4856 >7.3. What Winbind Provides</A
4857 ></H1
4858 ><P
4859 >Winbind unifies UNIX and Windows NT account management by
4860         allowing a UNIX box to become a full member of a NT domain. Once
4861         this is done the UNIX box will see NT users and groups as if
4862         they were native UNIX users and groups, allowing the NT domain
4863         to be used in much the same manner that NIS+ is used within
4864         UNIX-only environments.</P
4865 ><P
4866 >The end result is that whenever any
4867         program on the UNIX machine asks the operating system to lookup
4868         a user or group name, the query will be resolved by asking the
4869         NT domain controller for the specied domain to do the lookup.
4870         Because Winbind hooks into the operating system at a low level
4871         (via the NSS name resolution modules in the C library) this
4872         redirection to the NT domain controller is completely
4873         transparent.</P
4874 ><P
4875 >Users on the UNIX machine can then use NT user and group
4876         names as they would use "native" UNIX names. They can chown files
4877         so that they are owned by NT domain users or even login to the
4878         UNIX machine and run a UNIX X-Window session as a domain user.</P
4879 ><P
4880 >The only obvious indication that Winbind is being used is
4881         that user and group names take the form DOMAIN\user and
4882         DOMAIN\group. This is necessary as it allows Winbind to determine
4883         that redirection to a domain controller is wanted for a particular
4884         lookup and which trusted domain is being referenced.</P
4885 ><P
4886 >Additionally, Winbind provides a authentication service
4887         that hooks into the Pluggable Authentication Modules (PAM) system
4888         to provide authentication via a NT domain to any PAM enabled
4889         applications. This capability solves the problem of synchronizing
4890         passwords between systems as all passwords are stored in a single
4891         location (on the domain controller).</P
4892 ><DIV
4893 CLASS="SECT2"
4894 ><HR><H2
4895 CLASS="SECT2"
4896 ><A
4897 NAME="AEN1116"
4898 >7.3.1. Target Uses</A
4899 ></H2
4900 ><P
4901 >Winbind is targeted at organizations that have an
4902                 existing NT based domain infrastructure into which they wish
4903                 to put UNIX workstations or servers. Winbind will allow these
4904                 organizations to deploy UNIX workstations without having to
4905                 maintain a separate account infrastructure. This greatly simplies
4906                 the administrative overhead of deploying UNIX workstations into
4907                 a NT based organization.</P
4908 ><P
4909 >Another interesting way in which we expect Winbind to
4910                 be used is as a central part of UNIX based appliances. Appliances
4911                 that provide file and print services to Microsoft based networks
4912                 will be able to use Winbind to provide seamless integration of
4913                 the appliance into the domain.</P
4914 ></DIV
4915 ></DIV
4916 ><DIV
4917 CLASS="SECT1"
4918 ><HR><H1
4919 CLASS="SECT1"
4920 ><A
4921 NAME="AEN1120"
4922 >7.4. How Winbind Works</A
4923 ></H1
4924 ><P
4925 >The winbind system is designed around a client/server
4926         architecture. A long running <B
4927 CLASS="COMMAND"
4928 >winbindd</B
4929 > daemon
4930         listens on a UNIX domain socket waiting for requests
4931         to arrive. These requests are generated by the NSS and PAM
4932         clients and processed sequentially.</P
4933 ><P
4934 >The technologies used to implement winbind are described
4935         in detail below.</P
4936 ><DIV
4937 CLASS="SECT2"
4938 ><HR><H2
4939 CLASS="SECT2"
4940 ><A
4941 NAME="AEN1125"
4942 >7.4.1. Microsoft Remote Procedure Calls</A
4943 ></H2
4944 ><P
4945 >Over the last two years, efforts have been underway
4946                 by various Samba Team members to decode various aspects of
4947                 the Microsoft Remote Procedure Call (MSRPC) system. This
4948                 system is used for most network related operations between
4949                 Windows NT machines including remote management, user authentication
4950                 and print spooling. Although initially this work was done
4951                 to aid the implementation of Primary Domain Controller (PDC)
4952                 functionality in Samba, it has also yielded a body of code which
4953                 can be used for other purposes.</P
4954 ><P
4955 >Winbind uses various MSRPC calls to enumerate domain users
4956                 and groups and to obtain detailed information about individual
4957                 users or groups. Other MSRPC calls can be used to authenticate
4958                 NT domain users and to change user passwords. By directly querying
4959                 a Windows PDC for user and group information, winbind maps the
4960                 NT account information onto UNIX user and group names.</P
4961 ></DIV
4962 ><DIV
4963 CLASS="SECT2"
4964 ><HR><H2
4965 CLASS="SECT2"
4966 ><A
4967 NAME="AEN1129"
4968 >7.4.2. Name Service Switch</A
4969 ></H2
4970 ><P
4971 >The Name Service Switch, or NSS, is a feature that is
4972                 present in many UNIX operating systems. It allows system
4973                 information such as hostnames, mail aliases and user information
4974                 to be resolved from dierent sources. For example, a standalone
4975                 UNIX workstation may resolve system information from a series of
4976                 flat files stored on the local lesystem. A networked workstation
4977                 may first attempt to resolve system information from local files,
4978                 then consult a NIS database for user information or a DNS server
4979                 for hostname information.</P
4980 ><P
4981 >The NSS application programming interface allows winbind
4982                 to present itself as a source of system information when
4983                 resolving UNIX usernames and groups.  Winbind uses this interface,
4984                 and information obtained from a Windows NT server using MSRPC
4985                 calls to provide a new source of account enumeration.  Using standard
4986                 UNIX library calls, one can enumerate the users and groups on
4987                 a UNIX machine running winbind and see all users and groups in
4988                 a NT domain plus any trusted domain as though they were local
4989                 users and groups.</P
4990 ><P
4991 >The primary control le for NSS is <TT
4992 CLASS="FILENAME"
4993 >/etc/nsswitch.conf
4994                 </TT
4995 >. When a UNIX application makes a request to do a lookup
4996                 the C library looks in <TT
4997 CLASS="FILENAME"
4998 >/etc/nsswitch.conf</TT
4999 >
5000                 for a line which matches the service type being requested, for
5001                 example the "passwd" service type is used when user or group names
5002                 are looked up. This     config line species which implementations
5003                 of that service should be tried andin what order. If the passwd
5004                 config line is:</P
5005 ><P
5006 ><B
5007 CLASS="COMMAND"
5008 >passwd: files example</B
5009 ></P
5010 ><P
5011 >then the C library will first load a module called
5012                 <TT
5013 CLASS="FILENAME"
5014 >/lib/libnss_files.so</TT
5015 > followed by
5016                 the module <TT
5017 CLASS="FILENAME"
5018 >/lib/libnss_example.so</TT
5019 >. The
5020                 C library will dynamically load each of these modules in turn
5021                 and call resolver functions within the modules to try to resolve
5022                 the request. Once the request is resolved the C library returns the
5023                 result to the application.</P
5024 ><P
5025 >This NSS interface provides a very easy way for Winbind
5026                 to hook into the operating system. All that needs to be done
5027                 is to put <TT
5028 CLASS="FILENAME"
5029 >libnss_winbind.so</TT
5030 > in <TT
5031 CLASS="FILENAME"
5032 >/lib/</TT
5033 >
5034                 then add "winbind" into <TT
5035 CLASS="FILENAME"
5036 >/etc/nsswitch.conf</TT
5037 > at
5038                 the appropriate place. The C library will then call Winbind to
5039                 resolve user and group names.</P
5040 ></DIV
5041 ><DIV
5042 CLASS="SECT2"
5043 ><HR><H2
5044 CLASS="SECT2"
5045 ><A
5046 NAME="AEN1145"
5047 >7.4.3. Pluggable Authentication Modules</A
5048 ></H2
5049 ><P
5050 >Pluggable Authentication Modules, also known as PAM,
5051                 is a system for abstracting authentication and authorization
5052                 technologies. With a PAM module it is possible to specify different
5053                 authentication methods for dierent system applications without
5054                 having to recompile these applications. PAM is also useful
5055                 for implementing a particular policy for authorization. For example,
5056                 a system administrator may only allow console logins from users
5057                 stored in the local password file but only allow users resolved from
5058                 a NIS database to log in over the network.</P
5059 ><P
5060 >Winbind uses the authentication management and password
5061                 management PAM interface to integrate Windows NT users into a
5062                 UNIX system. This allows Windows NT users to log in to a UNIX
5063                 machine and be authenticated against a suitable Primary Domain
5064                 Controller. These users can also change their passwords and have
5065                 this change take eect directly on the Primary Domain Controller.
5066                 </P
5067 ><P
5068 >PAM is congured by providing control files in the directory
5069                 <TT
5070 CLASS="FILENAME"
5071 >/etc/pam.d/</TT
5072 > for each of the services that
5073                 require authentication. When an authentication request is made
5074                 by an application the PAM code in the C library looks up this
5075                 control file to determine what modules to load to do the
5076                 authentication check and in what order. This interface makes adding
5077                 a new authentication service for Winbind very easy, all that needs
5078                 to be done is that the <TT
5079 CLASS="FILENAME"
5080 >pam_winbind.so</TT
5081 > module
5082                 is copied to <TT
5083 CLASS="FILENAME"
5084 >/lib/security/</TT
5085 > and the pam
5086                 control files for relevant services are updated to allow
5087                 authentication via winbind. See the PAM documentation
5088                 for more details.</P
5089 ></DIV
5090 ><DIV
5091 CLASS="SECT2"
5092 ><HR><H2
5093 CLASS="SECT2"
5094 ><A
5095 NAME="AEN1153"
5096 >7.4.4. User and Group ID Allocation</A
5097 ></H2
5098 ><P
5099 >When a user or group is created under Windows NT
5100                 is it allocated a numerical relative identier (RID). This is
5101                 slightly dierent to UNIX which has a range of numbers which are
5102                 used to identify users, and the same range in which to identify
5103                 groups. It is winbind's job to convert RIDs to UNIX id numbers and
5104                 vice versa.  When winbind is congured it is given part of the UNIX
5105                 user id space and a part of the UNIX group id space in which to
5106                 store Windows NT users and groups. If a Windows NT user is
5107                 resolved for the first time, it is allocated the next UNIX id from
5108                 the range. The same process applies for Windows NT groups. Over
5109                 time, winbind will have mapped all Windows NT users and groups
5110                 to UNIX user ids and group ids.</P
5111 ><P
5112 >The results of this mapping are stored persistently in
5113                 a ID mapping database held in a tdb database). This ensures that
5114                 RIDs are mapped to UNIX IDs in a consistent way.</P
5115 ></DIV
5116 ><DIV
5117 CLASS="SECT2"
5118 ><HR><H2
5119 CLASS="SECT2"
5120 ><A
5121 NAME="AEN1157"
5122 >7.4.5. Result Caching</A
5123 ></H2
5124 ><P
5125 >An active system can generate a lot of user and group
5126                 name lookups. To reduce the network cost of these lookups winbind
5127                 uses a caching scheme based on the SAM sequence number supplied
5128                 by NT domain controllers.  User or group information returned
5129                 by a PDC is cached by winbind along with a sequence number also
5130                 returned by the PDC. This sequence number is incremented by
5131                 Windows NT whenever any user or group information is modied. If
5132                 a cached entry has expired, the sequence number is requested from
5133                 the PDC and compared against the sequence number of the cached entry.
5134                 If the sequence numbers do not match, then the cached information
5135                 is discarded and up to date information is requested directly
5136                 from the PDC.</P
5137 ></DIV
5138 ></DIV
5139 ><DIV
5140 CLASS="SECT1"
5141 ><HR><H1
5142 CLASS="SECT1"
5143 ><A
5144 NAME="AEN1160"
5145 >7.5. Installation and Configuration</A
5146 ></H1
5147 ><P
5148 >The easiest way to install winbind is by using the packages
5149         provided in the <TT
5150 CLASS="FILENAME"
5151 >pub/samba/appliance/</TT
5152 >
5153         directory on your nearest
5154         Samba mirror. These packages provide snapshots of the Samba source
5155         code and binaries already setup to provide the full functionality
5156         of winbind. This setup is a little more complex than a normal Samba
5157         build as winbind needs a small amount of functionality from a
5158         development code branch called SAMBA_TNG.</P
5159 ><P
5160 >Once you have installed the packages you should read
5161         the <B
5162 CLASS="COMMAND"
5163 >winbindd(8)</B
5164 > man page which will provide you
5165         with conguration information and give you sample conguration files.
5166         You may also wish to update the main Samba daemons smbd and nmbd)
5167         with a more recent development release, such as the recently
5168         announced Samba 2.2 alpha release.</P
5169 ></DIV
5170 ><DIV
5171 CLASS="SECT1"
5172 ><HR><H1
5173 CLASS="SECT1"
5174 ><A
5175 NAME="AEN1166"
5176 >7.6. Limitations</A
5177 ></H1
5178 ><P
5179 >Winbind has a number of limitations in its current
5180         released version which we hope to overcome in future
5181         releases:</P
5182 ><P
5183 ></P
5184 ><UL
5185 ><LI
5186 ><P
5187 >Winbind is currently only available for
5188                 the Linux operating system, although ports to other operating
5189                 systems are certainly possible. For such ports to be feasible,
5190                 we require the C library of the target operating system to
5191                 support the Name Service Switch and Pluggable Authentication
5192                 Modules systems. This is becoming more common as NSS and
5193                 PAM gain        support among UNIX vendors.</P
5194 ></LI
5195 ><LI
5196 ><P
5197 >The mappings of Windows NT RIDs to UNIX ids
5198                 is not made algorithmically and depends on the order in which
5199                 unmapped users or groups are seen by winbind. It may be difficult
5200                 to recover the mappings of rid to UNIX id mapping if the file
5201                 containing this information is corrupted or destroyed.</P
5202 ></LI
5203 ><LI
5204 ><P
5205 >Currently the winbind PAM module does not take
5206                 into account possible workstation and logon time restrictions
5207                 that may be been set for Windows NT users.</P
5208 ></LI
5209 ><LI
5210 ><P
5211 >Building winbind from source is currently
5212                 quite tedious as it requires combining source code from two Samba
5213                 branches. Work is underway to solve this by providing all
5214                 the necessary functionality in the main Samba code branch.</P
5215 ></LI
5216 ></UL
5217 ></DIV
5218 ><DIV
5219 CLASS="SECT1"
5220 ><HR><H1
5221 CLASS="SECT1"
5222 ><A
5223 NAME="AEN1178"
5224 >7.7. Conclusion</A
5225 ></H1
5226 ><P
5227 >The winbind system, through the use of the Name Service
5228         Switch, Pluggable Authentication Modules, and appropriate
5229         Microsoft RPC calls have allowed us to provide seamless
5230         integration of Microsoft Windows NT domain users on a
5231         UNIX system. The result is a great reduction in the administrative
5232         cost of running a mixed UNIX and NT network.</P
5233 ></DIV
5234 ></DIV
5235 ><DIV
5236 CLASS="CHAPTER"
5237 ><HR><H1
5238 ><A
5239 NAME="AEN1181"
5240 >Chapter 8. UNIX Permission Bits and WIndows NT Access Control Lists</A
5241 ></H1
5242 ><DIV
5243 CLASS="SECT1"
5244 ><H1
5245 CLASS="SECT1"
5246 ><A
5247 NAME="AEN1192"
5248 >8.1. Viewing and changing UNIX permissions using the NT
5249         security dialogs</A
5250 ></H1
5251 ><P
5252 >New in the Samba 2.0.4 release is the ability for Windows
5253         NT clients to use their native security settings dialog box to
5254         view and modify the underlying UNIX permissions.</P
5255 ><P
5256 >Note that this ability is careful not to compromise
5257         the security of the UNIX host Samba is running on, and
5258         still obeys all the file permission rules that a Samba
5259         administrator can set.</P
5260 ><P
5261 >In Samba 2.0.4 and above the default value of the
5262         parameter <A
5263 HREF="smb.conf.5.html#NTACLSUPPORT"
5264 TARGET="_top"
5265 ><TT
5266 CLASS="PARAMETER"
5267 ><I
5268 >       nt acl support</I
5269 ></TT
5270 ></A
5271 > has been changed from
5272         <TT
5273 CLASS="CONSTANT"
5274 >false</TT
5275 > to <TT
5276 CLASS="CONSTANT"
5277 >true</TT
5278 >, so
5279         manipulation of permissions is turned on by default.</P
5280 ></DIV
5281 ><DIV
5282 CLASS="SECT1"
5283 ><HR><H1
5284 CLASS="SECT1"
5285 ><A
5286 NAME="AEN1201"
5287 >8.2. How to view file security on a Samba share</A
5288 ></H1
5289 ><P
5290 >From an NT 4.0 client, single-click with the right
5291         mouse button on any file or directory in a Samba mounted
5292         drive letter or UNC path. When the menu pops-up, click
5293         on the <EM
5294 >Properties</EM
5295 > entry at the bottom of
5296         the menu. This brings up the normal file properties dialog
5297         box, but with Samba 2.0.4 this will have a new tab along the top
5298         marked <EM
5299 >Security</EM
5300 >. Click on this tab and you
5301         will see three buttons, <EM
5302 >Permissions</EM
5303 >,
5304         <EM
5305 >Auditing</EM
5306 >, and <EM
5307 >Ownership</EM
5308 >.
5309         The <EM
5310 >Auditing</EM
5311 > button will cause either
5312         an error message <SPAN
5313 CLASS="ERRORNAME"
5314 >A requested privilege is not held
5315         by the client</SPAN
5316 > to appear if the user is not the
5317         NT Administrator, or a dialog which is intended to allow an
5318         Administrator to add auditing requirements to a file if the
5319         user is logged on as the NT Administrator. This dialog is
5320         non-functional with a Samba share at this time, as the only
5321         useful button, the <B
5322 CLASS="COMMAND"
5323 >Add</B
5324 > button will not currently
5325         allow a list of users to be seen.</P
5326 ></DIV
5327 ><DIV
5328 CLASS="SECT1"
5329 ><HR><H1
5330 CLASS="SECT1"
5331 ><A
5332 NAME="AEN1212"
5333 >8.3. Viewing file ownership</A
5334 ></H1
5335 ><P
5336 >Clicking on the <B
5337 CLASS="COMMAND"
5338 >"Ownership"</B
5339 > button
5340         brings up a dialog box telling you who owns the given file. The
5341         owner name will be of the form :</P
5342 ><P
5343 ><B
5344 CLASS="COMMAND"
5345 >"SERVER\user (Long name)"</B
5346 ></P
5347 ><P
5348 >Where <TT
5349 CLASS="REPLACEABLE"
5350 ><I
5351 >SERVER</I
5352 ></TT
5353 > is the NetBIOS name of
5354         the Samba server, <TT
5355 CLASS="REPLACEABLE"
5356 ><I
5357 >user</I
5358 ></TT
5359 > is the user name of
5360         the UNIX user who owns the file, and <TT
5361 CLASS="REPLACEABLE"
5362 ><I
5363 >(Long name)</I
5364 ></TT
5365 >
5366         is the discriptive string identifying the user (normally found in the
5367         GECOS field of the UNIX password database). Click on the <B
5368 CLASS="COMMAND"
5369 >Close
5370         </B
5371 > button to remove this dialog.</P
5372 ><P
5373 >If the parameter <TT
5374 CLASS="PARAMETER"
5375 ><I
5376 >nt acl support</I
5377 ></TT
5378 >
5379         is set to <TT
5380 CLASS="CONSTANT"
5381 >false</TT
5382 > then the file owner will
5383         be shown as the NT user <B
5384 CLASS="COMMAND"
5385 >"Everyone"</B
5386 >.</P
5387 ><P
5388 >The <B
5389 CLASS="COMMAND"
5390 >Take Ownership</B
5391 > button will not allow
5392         you to change the ownership of this file to yourself (clicking on
5393         it will display a dialog box complaining that the user you are
5394         currently logged onto the NT client cannot be found). The reason
5395         for this is that changing the ownership of a file is a privilaged
5396         operation in UNIX, available only to the <EM
5397 >root</EM
5398 >
5399         user. As clicking on this button causes NT to attempt to change
5400         the ownership of a file to the current user logged into the NT
5401         client this will not work with Samba at this time.</P
5402 ><P
5403 >There is an NT chown command that will work with Samba
5404         and allow a user with Administrator privillage connected
5405         to a Samba 2.0.4 server as root to change the ownership of
5406         files on both a local NTFS filesystem or remote mounted NTFS
5407         or Samba drive. This is available as part of the <EM
5408 >Seclib
5409         </EM
5410 > NT security library written by Jeremy Allison of
5411         the Samba Team, available from the main Samba ftp site.</P
5412 ></DIV
5413 ><DIV
5414 CLASS="SECT1"
5415 ><HR><H1
5416 CLASS="SECT1"
5417 ><A
5418 NAME="AEN1232"
5419 >8.4. Viewing file or directory permissions</A
5420 ></H1
5421 ><P
5422 >The third button is the <B
5423 CLASS="COMMAND"
5424 >"Permissions"</B
5425 >
5426         button. Clicking on this brings up a dialog box that shows both
5427         the permissions and the UNIX owner of the file or directory.
5428         The owner is displayed in the form :</P
5429 ><P
5430 ><B
5431 CLASS="COMMAND"
5432 >"SERVER\user (Long name)"</B
5433 ></P
5434 ><P
5435 >Where <TT
5436 CLASS="REPLACEABLE"
5437 ><I
5438 >SERVER</I
5439 ></TT
5440 > is the NetBIOS name of
5441         the Samba server, <TT
5442 CLASS="REPLACEABLE"
5443 ><I
5444 >user</I
5445 ></TT
5446 > is the user name of
5447         the UNIX user who owns the file, and <TT
5448 CLASS="REPLACEABLE"
5449 ><I
5450 >(Long name)</I
5451 ></TT
5452 >
5453         is the discriptive string identifying the user (normally found in the
5454         GECOS field of the UNIX password database).</P
5455 ><P
5456 >If the parameter <TT
5457 CLASS="PARAMETER"
5458 ><I
5459 >nt acl support</I
5460 ></TT
5461 >
5462         is set to <TT
5463 CLASS="CONSTANT"
5464 >false</TT
5465 > then the file owner will
5466         be shown as the NT user <B
5467 CLASS="COMMAND"
5468 >"Everyone"</B
5469 > and the
5470         permissions will be shown as NT "Full Control".</P
5471 ><P
5472 >The permissions field is displayed differently for files
5473         and directories, so I'll describe the way file permissions
5474         are displayed first.</P
5475 ><DIV
5476 CLASS="SECT2"
5477 ><HR><H2
5478 CLASS="SECT2"
5479 ><A
5480 NAME="AEN1247"
5481 >8.4.1. File Permissions</A
5482 ></H2
5483 ><P
5484 >The standard UNIX user/group/world triple and
5485                 the correspinding "read", "write", "execute" permissions
5486                 triples are mapped by Samba into a three element NT ACL
5487                 with the 'r', 'w', and 'x' bits mapped into the corresponding
5488                 NT permissions. The UNIX world permissions are mapped into
5489                 the global NT group <B
5490 CLASS="COMMAND"
5491 >Everyone</B
5492 >, followed
5493                 by the list of permissions allowed for UNIX world. The UNIX
5494                 owner and group permissions are displayed as an NT
5495                 <B
5496 CLASS="COMMAND"
5497 >user</B
5498 > icon and an NT <B
5499 CLASS="COMMAND"
5500 >local
5501                 group</B
5502 > icon respectively followed by the list
5503                 of permissions allowed for the UNIX user and group.</P
5504 ><P
5505 >As many UNIX permission sets don't map into common
5506                 NT names such as <B
5507 CLASS="COMMAND"
5508 >"read"</B
5509 >, <B
5510 CLASS="COMMAND"
5511 >               "change"</B
5512 > or <B
5513 CLASS="COMMAND"
5514 >"full control"</B
5515 > then
5516                 usually the permissions will be prefixed by the words <B
5517 CLASS="COMMAND"
5518 >               "Special Access"</B
5519 > in the NT display list.</P
5520 ><P
5521 >But what happens if the file has no permissions allowed
5522                 for a particular UNIX user group or world component ? In order
5523                 to  allow "no permissions" to be seen and modified then Samba
5524                 overloads the NT <B
5525 CLASS="COMMAND"
5526 >"Take Ownership"</B
5527 > ACL attribute
5528                 (which has no meaning in UNIX) and reports a component with
5529                 no permissions as having the NT <B
5530 CLASS="COMMAND"
5531 >"O"</B
5532 > bit set.
5533                 This was chosen of course to make it look like a zero, meaning
5534                 zero permissions. More details on the decision behind this will
5535                 be given below.</P
5536 ></DIV
5537 ><DIV
5538 CLASS="SECT2"
5539 ><HR><H2
5540 CLASS="SECT2"
5541 ><A
5542 NAME="AEN1261"
5543 >8.4.2. Directory Permissions</A
5544 ></H2
5545 ><P
5546 >Directories on an NT NTFS file system have two
5547                 different sets of permissions. The first set of permissions
5548                 is the ACL set on the directory itself, this is usually displayed
5549                 in the first set of parentheses in the normal <B
5550 CLASS="COMMAND"
5551 >"RW"</B
5552 >
5553                 NT style. This first set of permissions is created by Samba in
5554                 exactly the same way as normal file permissions are, described
5555                 above, and is displayed in the same way.</P
5556 ><P
5557 >The second set of directory permissions has no real meaning
5558                 in the UNIX permissions world and represents the <B
5559 CLASS="COMMAND"
5560 >               "inherited"</B
5561 > permissions that any file created within
5562                 this directory would inherit.</P
5563 ><P
5564 >Samba synthesises these inherited permissions for NT by
5565                 returning as an NT ACL the UNIX permission mode that a new file
5566                 created by Samba on this share would receive.</P
5567 ></DIV
5568 ></DIV
5569 ><DIV
5570 CLASS="SECT1"
5571 ><HR><H1
5572 CLASS="SECT1"
5573 ><A
5574 NAME="AEN1268"
5575 >8.5. Modifying file or directory permissions</A
5576 ></H1
5577 ><P
5578 >Modifying file and directory permissions is as simple
5579         as changing the displayed permissions in the dialog box, and
5580         clicking the <B
5581 CLASS="COMMAND"
5582 >OK</B
5583 > button. However, there are
5584         limitations that a user needs to be aware of, and also interactions
5585         with the standard Samba permission masks and mapping of DOS
5586         attributes that need to also be taken into account.</P
5587 ><P
5588 >If the parameter <TT
5589 CLASS="PARAMETER"
5590 ><I
5591 >nt acl support</I
5592 ></TT
5593 >
5594         is set to <TT
5595 CLASS="CONSTANT"
5596 >false</TT
5597 > then any attempt to set
5598         security permissions will fail with an <B
5599 CLASS="COMMAND"
5600 >"Access Denied"
5601         </B
5602 > message.</P
5603 ><P
5604 >The first thing to note is that the <B
5605 CLASS="COMMAND"
5606 >"Add"</B
5607 >
5608         button will not return a list of users in Samba 2.0.4 (it will give
5609         an error message of <B
5610 CLASS="COMMAND"
5611 >"The remote proceedure call failed
5612         and did not execute"</B
5613 >). This means that you can only
5614         manipulate the current user/group/world permissions listed in
5615         the dialog box. This actually works quite well as these are the
5616         only permissions that UNIX actually has.</P
5617 ><P
5618 >If a permission triple (either user, group, or world)
5619         is removed from the list of permissions in the NT dialog box,
5620         then when the <B
5621 CLASS="COMMAND"
5622 >"OK"</B
5623 > button is pressed it will
5624         be applied as "no permissions" on the UNIX side. If you then
5625         view the permissions again the "no permissions" entry will appear
5626         as the NT <B
5627 CLASS="COMMAND"
5628 >"O"</B
5629 > flag, as described above. This
5630         allows you to add permissions back to a file or directory once
5631         you have removed them from a triple component.</P
5632 ><P
5633 >As UNIX supports only the "r", "w" and "x" bits of
5634         an NT ACL then if other NT security attributes such as "Delete
5635         access" are selected then they will be ignored when applied on
5636         the Samba server.</P
5637 ><P
5638 >When setting permissions on a directory the second
5639         set of permissions (in the second set of parentheses) is
5640         by default applied to all files within that directory. If this
5641         is not what you want you must uncheck the <B
5642 CLASS="COMMAND"
5643 >"Replace
5644         permissions on existing files"</B
5645 > checkbox in the NT
5646         dialog before clicking <B
5647 CLASS="COMMAND"
5648 >"OK"</B
5649 >.</P
5650 ><P
5651 >If you wish to remove all permissions from a
5652         user/group/world  component then you may either highlight the
5653         component and click the <B
5654 CLASS="COMMAND"
5655 >"Remove"</B
5656 > button,
5657         or set the component to only have the special <B
5658 CLASS="COMMAND"
5659 >"Take
5660         Ownership"</B
5661 > permission (dsplayed as <B
5662 CLASS="COMMAND"
5663 >"O"
5664         </B
5665 >) highlighted.</P
5666 ></DIV
5667 ><DIV
5668 CLASS="SECT1"
5669 ><HR><H1
5670 CLASS="SECT1"
5671 ><A
5672 NAME="AEN1290"
5673 >8.6. Interaction with the standard Samba create mask
5674         parameters</A
5675 ></H1
5676 ><P
5677 >Note that with Samba 2.0.5 there are four new parameters
5678         to control this interaction.  These are :</P
5679 ><P
5680 ><TT
5681 CLASS="PARAMETER"
5682 ><I
5683 >security mask</I
5684 ></TT
5685 ></P
5686 ><P
5687 ><TT
5688 CLASS="PARAMETER"
5689 ><I
5690 >force security mode</I
5691 ></TT
5692 ></P
5693 ><P
5694 ><TT
5695 CLASS="PARAMETER"
5696 ><I
5697 >directory security mask</I
5698 ></TT
5699 ></P
5700 ><P
5701 ><TT
5702 CLASS="PARAMETER"
5703 ><I
5704 >force directory security mode</I
5705 ></TT
5706 ></P
5707 ><P
5708 >Once a user clicks <B
5709 CLASS="COMMAND"
5710 >"OK"</B
5711 > to apply the
5712         permissions Samba maps the given permissions into a user/group/world
5713         r/w/x triple set, and then will check the changed permissions for a
5714         file against the bits set in the <A
5715 HREF="smb.conf.5.html#SECURITYMASK"
5716 TARGET="_top"
5717 >
5718         <TT
5719 CLASS="PARAMETER"
5720 ><I
5721 >security mask</I
5722 ></TT
5723 ></A
5724 > parameter. Any bits that
5725         were changed that are not set to '1' in this parameter are left alone
5726         in the file permissions.</P
5727 ><P
5728 >Essentially, zero bits in the <TT
5729 CLASS="PARAMETER"
5730 ><I
5731 >security mask</I
5732 ></TT
5733 >
5734         mask may be treated as a set of bits the user is <EM
5735 >not</EM
5736 >
5737         allowed to change, and one bits are those the user is allowed to change.
5738         </P
5739 ><P
5740 >If not set explicitly this parameter is set to the same value as
5741         the <A
5742 HREF="smb.conf.5.html#CREATEMASK"
5743 TARGET="_top"
5744 ><TT
5745 CLASS="PARAMETER"
5746 ><I
5747 >create mask
5748         </I
5749 ></TT
5750 ></A
5751 > parameter to provide compatibility with Samba 2.0.4
5752         where this permission change facility was introduced. To allow a user to
5753         modify all the user/group/world permissions on a file, set this parameter
5754         to 0777.</P
5755 ><P
5756 >Next Samba checks the changed permissions for a file against
5757         the bits set in the <A
5758 HREF="smb.conf.5.html#FORCESECURITYMODE"
5759 TARGET="_top"
5760 >       <TT
5761 CLASS="PARAMETER"
5762 ><I
5763 >force security mode</I
5764 ></TT
5765 ></A
5766 > parameter. Any bits
5767         that were changed that correspond to bits set to '1' in this parameter
5768         are forced to be set.</P
5769 ><P
5770 >Essentially, bits set in the <TT
5771 CLASS="PARAMETER"
5772 ><I
5773 >force security mode
5774         </I
5775 ></TT
5776 > parameter may be treated as a set of bits that, when
5777         modifying security on a file, the user has always set to be 'on'.</P
5778 ><P
5779 >If not set explicitly this parameter is set to the same value
5780         as the <A
5781 HREF="smb.conf.5.html#FORCECREATEMODE"
5782 TARGET="_top"
5783 ><TT
5784 CLASS="PARAMETER"
5785 ><I
5786 >force
5787         create mode</I
5788 ></TT
5789 ></A
5790 > parameter to provide compatibility
5791         with Samba 2.0.4 where the permission change facility was introduced.
5792         To allow a user to modify all the user/group/world permissions on a file,
5793         with no restrictions set this parameter to 000.</P
5794 ><P
5795 >The <TT
5796 CLASS="PARAMETER"
5797 ><I
5798 >security mask</I
5799 ></TT
5800 > and <TT
5801 CLASS="PARAMETER"
5802 ><I
5803 >force
5804         security mode</I
5805 ></TT
5806 > parameters are applied to the change
5807         request in that order.</P
5808 ><P
5809 >For a directory Samba will perform the same operations as
5810         described above for a file except using the parameter <TT
5811 CLASS="PARAMETER"
5812 ><I
5813 >       directory security mask</I
5814 ></TT
5815 > instead of <TT
5816 CLASS="PARAMETER"
5817 ><I
5818 >security
5819         mask</I
5820 ></TT
5821 >, and <TT
5822 CLASS="PARAMETER"
5823 ><I
5824 >force directory security mode
5825         </I
5826 ></TT
5827 > parameter instead of <TT
5828 CLASS="PARAMETER"
5829 ><I
5830 >force security mode
5831         </I
5832 ></TT
5833 >.</P
5834 ><P
5835 >The <TT
5836 CLASS="PARAMETER"
5837 ><I
5838 >directory security mask</I
5839 ></TT
5840 > parameter
5841         by default is set to the same value as the <TT
5842 CLASS="PARAMETER"
5843 ><I
5844 >directory mask
5845         </I
5846 ></TT
5847 > parameter and the <TT
5848 CLASS="PARAMETER"
5849 ><I
5850 >force directory security
5851         mode</I
5852 ></TT
5853 > parameter by default is set to the same value as
5854         the <TT
5855 CLASS="PARAMETER"
5856 ><I
5857 >force directory mode</I
5858 ></TT
5859 > parameter to provide
5860         compatibility with Samba 2.0.4 where the permission change facility
5861         was introduced.</P
5862 ><P
5863 >In this way Samba enforces the permission restrictions that
5864         an administrator can set on a Samba share, whilst still allowing users
5865         to modify the permission bits within that restriction.</P
5866 ><P
5867 >If you want to set up a share that allows users full control
5868         in modifying the permission bits on their files and directories and
5869         doesn't force any particular bits to be set 'on', then set the following
5870         parameters in the <A
5871 HREF="smb.conf.5.html"
5872 TARGET="_top"
5873 ><TT
5874 CLASS="FILENAME"
5875 >smb.conf(5)
5876         </TT
5877 ></A
5878 > file in that share specific section :</P
5879 ><P
5880 ><TT
5881 CLASS="PARAMETER"
5882 ><I
5883 >security mask = 0777</I
5884 ></TT
5885 ></P
5886 ><P
5887 ><TT
5888 CLASS="PARAMETER"
5889 ><I
5890 >force security mode = 0</I
5891 ></TT
5892 ></P
5893 ><P
5894 ><TT
5895 CLASS="PARAMETER"
5896 ><I
5897 >directory security mask = 0777</I
5898 ></TT
5899 ></P
5900 ><P
5901 ><TT
5902 CLASS="PARAMETER"
5903 ><I
5904 >force directory security mode = 0</I
5905 ></TT
5906 ></P
5907 ><P
5908 >As described, in Samba 2.0.4 the parameters :</P
5909 ><P
5910 ><TT
5911 CLASS="PARAMETER"
5912 ><I
5913 >create mask</I
5914 ></TT
5915 ></P
5916 ><P
5917 ><TT
5918 CLASS="PARAMETER"
5919 ><I
5920 >force create mode</I
5921 ></TT
5922 ></P
5923 ><P
5924 ><TT
5925 CLASS="PARAMETER"
5926 ><I
5927 >directory mask</I
5928 ></TT
5929 ></P
5930 ><P
5931 ><TT
5932 CLASS="PARAMETER"
5933 ><I
5934 >force directory mode</I
5935 ></TT
5936 ></P
5937 ><P
5938 >were used instead of the parameters discussed here.</P
5939 ></DIV
5940 ><DIV
5941 CLASS="SECT1"
5942 ><HR><H1
5943 CLASS="SECT1"
5944 ><A
5945 NAME="AEN1354"
5946 >8.7. Interaction with the standard Samba file attribute
5947         mapping</A
5948 ></H1
5949 ><P
5950 >Samba maps some of the DOS attribute bits (such as "read
5951         only") into the UNIX permissions of a file. This means there can
5952         be a conflict between the permission bits set via the security
5953         dialog and the permission bits set by the file attribute mapping.
5954         </P
5955 ><P
5956 >One way this can show up is if a file has no UNIX read access
5957         for the owner it will show up as "read only" in the standard
5958         file attributes tabbed dialog. Unfortunately this dialog is
5959         the same one that contains the security info in another tab.</P
5960 ><P
5961 >What this can mean is that if the owner changes the permissions
5962         to allow themselves read access using the security dialog, clicks
5963         <B
5964 CLASS="COMMAND"
5965 >"OK"</B
5966 > to get back to the standard attributes tab
5967         dialog, and then clicks <B
5968 CLASS="COMMAND"
5969 >"OK"</B
5970 > on that dialog, then
5971         NT will set the file permissions back to read-only (as that is what
5972         the attributes still say in the dialog). This means that after setting
5973         permissions and clicking <B
5974 CLASS="COMMAND"
5975 >"OK"</B
5976 > to get back to the
5977         attributes dialog you should always hit <B
5978 CLASS="COMMAND"
5979 >"Cancel"</B
5980 >
5981         rather than <B
5982 CLASS="COMMAND"
5983 >"OK"</B
5984 > to ensure that your changes
5985         are not overridden.</P
5986 ></DIV
5987 ></DIV
5988 ><DIV
5989 CLASS="CHAPTER"
5990 ><HR><H1
5991 ><A
5992 NAME="AEN1364"
5993 >Chapter 9. OS2 Client HOWTO</A
5994 ></H1
5995 ><DIV
5996 CLASS="SECT1"
5997 ><H1
5998 CLASS="SECT1"
5999 ><A
6000 NAME="AEN1375"
6001 >9.1. FAQs</A
6002 ></H1
6003 ><DIV
6004 CLASS="SECT2"
6005 ><H2
6006 CLASS="SECT2"
6007 ><A
6008 NAME="AEN1377"
6009 >9.1.1. How can I configure OS/2 Warp Connect or
6010                 OS/2 Warp 4 as a client for Samba?</A
6011 ></H2
6012 ><P
6013 >A more complete answer to this question can be
6014                 found on <A
6015 HREF="http://carol.wins.uva.nl/~leeuw/samba/warp.html"
6016 TARGET="_top"
6017 >               http://carol.wins.uva.nl/~leeuw/samba/warp.html</A
6018 >.</P
6019 ><P
6020 >Basically, you need three components:</P
6021 ><P
6022 ></P
6023 ><UL
6024 ><LI
6025 ><P
6026 >The File and Print Client ('IBM Peer')
6027                         </P
6028 ></LI
6029 ><LI
6030 ><P
6031 >TCP/IP ('Internet support')
6032                         </P
6033 ></LI
6034 ><LI
6035 ><P
6036 >The "NetBIOS over TCP/IP" driver ('TCPBEUI')
6037                         </P
6038 ></LI
6039 ></UL
6040 ><P
6041 >Installing the first two together with the base operating
6042                 system on a blank system is explained in the Warp manual. If Warp
6043                 has already been installed, but you now want to install the
6044                 networking support, use the "Selective Install for Networking"
6045                 object in the "System Setup" folder.</P
6046 ><P
6047 >Adding the "NetBIOS over TCP/IP" driver is not described
6048                 in the manual and just barely in the online documentation. Start
6049                 MPTS.EXE, click on OK, click on "Configure LAPS" and click
6050                 on "IBM OS/2 NETBIOS OVER TCP/IP" in  'Protocols'.  This line
6051                 is then moved to 'Current Configuration'. Select that line,
6052                 click on "Change number" and increase it from 0 to 1. Save this
6053                 configuration.</P
6054 ><P
6055 >If the Samba server(s) is not on your local subnet, you
6056                 can optionally add IP names and addresses of these servers
6057                 to the "Names List", or specify a  WINS server ('NetBIOS
6058                 Nameserver' in IBM and RFC terminology). For Warp Connect you
6059                 may need to download an update for 'IBM Peer' to bring it on
6060                 the same level as Warp 4. See the webpage mentioned above.</P
6061 ></DIV
6062 ><DIV
6063 CLASS="SECT2"
6064 ><HR><H2
6065 CLASS="SECT2"
6066 ><A
6067 NAME="AEN1392"
6068 >9.1.2. How can I configure OS/2 Warp 3 (not Connect),
6069                 OS/2 1.2, 1.3 or 2.x for Samba?</A
6070 ></H2
6071 ><P
6072 >You can use the free Microsoft LAN Manager 2.2c Client
6073                 for OS/2 from
6074                 <A
6075 HREF="ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/"
6076 TARGET="_top"
6077 >               ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/</A
6078 >.
6079         See <A
6080 HREF="http://carol.wins.uva.nl/~leeuw/lanman.html"
6081 TARGET="_top"
6082 >               http://carol.wins.uva.nl/~leeuw/lanman.html</A
6083 > for
6084                 more information on how to install and use this client. In
6085                 a nutshell, edit the file \OS2VER in the root directory of
6086                 the OS/2 boot partition and add the lines:</P
6087 ><P
6088 ><TABLE
6089 BORDER="0"
6090 BGCOLOR="#E0E0E0"
6091 WIDTH="100%"
6092 ><TR
6093 ><TD
6094 ><PRE
6095 CLASS="PROGRAMLISTING"
6096 >               20=setup.exe
6097                 20=netwksta.sys
6098                 20=netvdd.sys
6099                 </PRE
6100 ></TD
6101 ></TR
6102 ></TABLE
6103 ></P
6104 ><P
6105 >before you install the client. Also, don't use the
6106                 included NE2000 driver because it is buggy. Try the NE2000
6107                 or NS2000 driver from
6108                 <A
6109 HREF="ftp://ftp.cdrom.com/pub/os2/network/ndis/"
6110 TARGET="_top"
6111 >               ftp://ftp.cdrom.com/pub/os2/network/ndis/</A
6112 > instead.
6113                 </P
6114 ></DIV
6115 ><DIV
6116 CLASS="SECT2"
6117 ><HR><H2
6118 CLASS="SECT2"
6119 ><A
6120 NAME="AEN1401"
6121 >9.1.3. Are there any other issues when OS/2 (any version)
6122                 is used as a client?</A
6123 ></H2
6124 ><P
6125 >When you do a NET VIEW or use the "File and Print
6126                 Client Resource Browser", no Samba servers show up. This can
6127                 be fixed by a patch from <A
6128 HREF="http://carol.wins.uva.nl/~leeuw/samba/fix.html"
6129 TARGET="_top"
6130 >               http://carol.wins.uva.nl/~leeuw/samba/fix.html</A
6131 >.
6132                 The patch will be included in a later version of Samba. It also
6133                 fixes a couple of other problems, such as preserving long
6134                 filenames when objects are dragged from the Workplace Shell
6135                 to the Samba server. </P
6136 ></DIV
6137 ><DIV
6138 CLASS="SECT2"
6139 ><HR><H2
6140 CLASS="SECT2"
6141 ><A
6142 NAME="AEN1405"
6143 >9.1.4. How do I get printer driver download working
6144                 for OS/2 clients?</A
6145 ></H2
6146 ><P
6147 >First, create a share called [PRINTDRV] that is
6148                 world-readable.  Copy your OS/2 driver files there.  Note
6149                 that the .EA_ files must still be separate, so you will need
6150                 to use the original install files, and not copy an installed
6151                 driver from an OS/2 system.</P
6152 ><P
6153 >Install the NT driver first for that printer.  Then,
6154                 add to your smb.conf a paramater, "os2 driver map =
6155                 <TT
6156 CLASS="REPLACEABLE"
6157 ><I
6158 >filename</I
6159 ></TT
6160 >".  Then, in the file
6161                 specified by <TT
6162 CLASS="REPLACEABLE"
6163 ><I
6164 >filename</I
6165 ></TT
6166 >, map the
6167                 name of the NT driver name to the OS/2 driver name as
6168                 follows:</P
6169 ><P
6170 >&#60;nt driver name&#62; = &#60;os2 driver
6171                 name&#62;.&#60;device name&#62;, e.g.:
6172                 HP LaserJet 5L = LASERJET.HP LaserJet 5L</P
6173 ><P
6174 >You can have multiple drivers mapped in this file.</P
6175 ><P
6176 >If you only specify the OS/2 driver name, and not the
6177                 device name, the first attempt to download the driver will
6178                 actually download the files, but the OS/2 client will tell
6179                 you the driver is not available.  On the second attempt, it
6180                 will work.  This is fixed simply by adding the device name
6181                  to the mapping, after which it will work on the first attempt.
6182                 </P
6183 ></DIV
6184 ></DIV
6185 ></DIV
6186 ></DIV
6187 ></BODY
6188 ></HTML
6189 >