docs/htmldocs/StandAloneServer.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Stand-alone Servers</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="previous" href="domain-member.html" title="Chapter 7. Domain Membership"><link rel="next" href="ClientConfig.html" title="Chapter 9. MS Windows Network Configuration Guide"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Stand-alone Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="domain-member.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="ClientConfig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="StandAloneServer"></a>Chapter 8. Stand-alone Servers</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:jht@samba.org">jht@samba.org</a>&gt;</tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="StandAloneServer.html#id2896324">Features and Benefits</a></dt><dt><a href="StandAloneServer.html#id2896363">Background</a></dt><dt><a href="StandAloneServer.html#id2896435">Example Configuration</a></dt><dd><dl><dt><a href="StandAloneServer.html#RefDocServer">Reference Documentation Server</a></dt><dt><a href="StandAloneServer.html#SimplePrintServer">Central Print Serving</a></dt></dl></dd><dt><a href="StandAloneServer.html#id2897068">Common Errors</a></dt></dl></div><p>
   2 Stand-alone Servers are independent of Domain Controllers on the network.
   3 They are not Domain Members and function more like workgroup servers. In many
   4 cases a Stand-alone Server is configured with a minimum of security control
   5 with the intent that all data served will be readily accessible to all users.
   6 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896324"></a>Features and Benefits</h2></div></div><div></div></div><p>
   7 Stand-alone Servers can be as secure or as insecure as needs dictate. They can
   8 have simple or complex configurations. Above all, despite the hoopla about
   9 Domain Security they remain a common installation.
  10 </p><p>
  11 If all that is needed is a server for read-only files, or for
  12 printers alone, it may not make sense to effect a complex installation.
  13 For example: A drafting office needs to store old drawings and reference
  14 standards. Noone can write files to the server as it is legislatively
  15 important that all documents remain unaltered. A share mode read-only Stand-alone
  16 Server is an ideal solution.
  17 </p><p>
  18 Another situation that warrants simplicity is an office that has many printers
  19 that are queued off a single central server. Everyone needs to be able to print
  20 to the printers, there is no need to effect any access controls and no files will
  21 be served from the print server. Again, a share mode Stand-alone Server makes
  22 a great solution.
  23 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896363"></a>Background</h2></div></div><div></div></div><p>
  24 The term <span class="emphasis"><em>Stand-alone Server</em></span> means that it
  25 will provide local authentication and access control for all resources
  26 that are available from it. In general this means that there will be a
  27 local user database. In more technical terms, it means resources
  28 on the machine will be made available in either SHARE mode or in
  29 USER mode.
  30 </p><p>
  31 No special action is needed other than to create user accounts. Stand-alone
  32 servers do not provide network logon services. This means that machines that
  33 use this server do not perform a domain logon to it. Whatever logon facility
  34 the workstations are subject to is independent of this machine. It is, however,
  35 necessary to accommodate any network user so the logon name they use will
  36 be translated (mapped) locally on the Stand-alone Server to a locally known
  37 user name. There are several ways this can be done.
  38 </p><p>
  39 Samba tends to blur the distinction a little in respect of what is
  40 a Stand-alone Server. This is because the authentication database may be
  41 local or on a remote server, even if from the SMB protocol perspective
  42 the Samba server is not a member of a domain security context.
  43 </p><p>
  44 Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH),
  45 which maintains the UNIX-user database) the source of authentication may reside on
  46 another server. We would be inclined to call this the authentication server.
  47 This means that the Samba server may use the local UNIX/Linux system password database
  48 (<tt class="filename">/etc/passwd</tt> or <tt class="filename">/etc/shadow</tt>), may use a
  49 local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server
  50 for authentication.
  51 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896435"></a>Example Configuration</h2></div></div><div></div></div><p>
  52 The examples, <link linkend="simplynice">, and link linkend="SimplePrintServer"/&gt;,
  53 are designed to inspire simplicity. It is too easy to attempt a high level of creativity
  54 and to introduce too much complexity in server and network design.
  55 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="RefDocServer"></a>Reference Documentation Server</h3></div></div><div></div></div><p>
  56 Configuration of a read-only data server that everyone can access is very simple.
  57 <link linkend="simplynice"> is the <tt class="filename">smb.conf</tt> file that will do this. Assume that all the reference documents
  58 are stored in the directory <tt class="filename">/export</tt>, and the documents are owned by a user other than
  59 nobody. No home directories are shared, and there are no users in the <tt class="filename">/etc/passwd</tt>
  60 UNIX system database. This is a simple system to administer.
  61 </p><div class="example"><a name="simplynice"></a><p class="title"><b>Example 8.1. smb.conf for Reference Documentation Server</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td>#  Global parameters</td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>workgroup = MIDEARTH</tt></i></td></tr><tr><td><i class="parameter"><tt>netbios name = GANDALF</tt></i></td></tr><tr><td><i class="parameter"><tt>security = SHARE</tt></i></td></tr><tr><td><i class="parameter"><tt>passdb backend = guest</tt></i></td></tr><tr><td><i class="parameter"><tt>wins server = 192.168.1.1</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[data]</tt></i></td></tr><tr><td><i class="parameter"><tt>comment = Data</tt></i></td></tr><tr><td><i class="parameter"><tt>path = /export</tt></i></td></tr><tr><td><i class="parameter"><tt>guest only = Yes</tt></i></td></tr></table></div><p>
  62 In <link linkend="simplynice"> above, the machine name is set to GANDALF, the workgroup is set to the name
  63 of the local workgroup (MIDEARTH) so the machine will appear together with systems with
  64 which users are familiar. The only password backend required is the &#8220;<span class="quote">guest</span>&#8221; backend to allow default
  65 unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it.
  66 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="SimplePrintServer"></a>Central Print Serving</h3></div></div><div></div></div><p>
  67 Configuration of a simple print server is easy if you have all the right tools
  68 on your system.
  69 </p><div class="orderedlist"><p class="title"><b> Assumptions:</b></p><ol type="1"><li><p>
  70         The print server must require no administration.
  71         </p></li><li><p>
  72         The print spooling and processing system on our print server will be CUPS.
  73         (Please refer to <link linkend="CUPS-printing"> for more information).
  74         </p></li><li><p>
  75         The print server will service only network printers. The network administrator
  76         will correctly configure the CUPS environment to support the printers.
  77         </p></li><li><p>
  78         All workstations will use only postscript drivers. The printer driver
  79         of choice is the one shipped with the Windows OS for the Apple Color LaserWriter.
  80         </p></li></ol></div><p>
  81 In this example our print server will spool all incoming print jobs to
  82 <tt class="filename">/var/spool/samba</tt> until the job is ready to be submitted by
  83 Samba to the CUPS print processor. Since all incoming connections will be as
  84 the anonymous (guest) user, two things will be required:
  85 </p><div class="itemizedlist"><p class="title"><b>Enabling Anonymous Printing</b></p><ul type="disc"><li><p>
  86         The UNIX/Linux system must have a <b class="command">guest</b> account.
  87         The default for this is usually the account <b class="command">nobody</b>.
  88         To find the correct name to use for your version of Samba, do the
  89         following:
  90 </p><pre class="screen">
  91 <tt class="prompt">$ </tt><b class="userinput"><tt>testparm -s -v | grep "guest account"</tt></b>
  92 </pre><p>
  93         Make sure that this account exists in your system password
  94         database (<tt class="filename">/etc/passwd</tt>).
  95         </p></li><li><p>
  96         The directory into which Samba will spool the file must have write
  97         access for the guest account. The following commands will ensure that
  98         this directory is available for use:
  99 </p><pre class="screen">
 100 <tt class="prompt">root# </tt><b class="userinput"><tt>mkdir /var/spool/samba</tt></b>
 101 <tt class="prompt">root# </tt><b class="userinput"><tt>chown nobody.nobody /var/spool/samba</tt></b>
 102 <tt class="prompt">root# </tt><b class="userinput"><tt>chmod a+rwt /var/spool/samba</tt></b>
 103 </pre><p>
 104         </p></li></ul></div><p>
 105 The contents of the <tt class="filename">smb.conf</tt> file is shown in <link linkend="AnonPtrSvr">.
 106 </p><p>
 107 </p><div class="example"><a name="AnonPtrSvr"></a><p class="title"><b>Example 8.2. smb.conf for Anonymous Printing</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td>#  Global parameters</td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>workgroup = MIDEARTH</tt></i></td></tr><tr><td><i class="parameter"><tt>netbios name = GANDALF</tt></i></td></tr><tr><td><i class="parameter"><tt>security = SHARE</tt></i></td></tr><tr><td><i class="parameter"><tt>passdb backend = guest</tt></i></td></tr><tr><td><i class="parameter"><tt>printing = cups</tt></i></td></tr><tr><td><i class="parameter"><tt>printcap name = cups</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[printers]</tt></i></td></tr><tr><td><i class="parameter"><tt>comment = All Printers</tt></i></td></tr><tr><td><i class="parameter"><tt>path = /var/spool/samba</tt></i></td></tr><tr><td><i class="parameter"><tt>printer admin = root</tt></i></td></tr><tr><td><i class="parameter"><tt>guest ok = Yes</tt></i></td></tr><tr><td><i class="parameter"><tt>printable = Yes</tt></i></td></tr><tr><td><i class="parameter"><tt>use client driver = Yes</tt></i></td></tr><tr><td><i class="parameter"><tt>browseable = No</tt></i></td></tr></table></div><p>
 108 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
 109 <a class="indexterm" name="id2897019"></a>
 110 <a class="indexterm" name="id2897030"></a>
 111 On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
 112 intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
 113 it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
 114 handler in the <tt class="filename">/etc/mime.conv</tt> and <tt class="filename">/etc/mime.types</tt>
 115 files. Refer to <link linkend="cups-raw">.
 116 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2897068"></a>Common Errors</h2></div></div><div></div></div><p>
 117 The greatest mistake so often made is to make a network configuration too complex.
 118 It pays to use the simplest solution that will meet the needs of the moment.
 119 </p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="domain-member.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ClientConfig.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 7. Domain Membership </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 9. MS Windows Network Configuration Guide</td></tr></table></div></body></html>