| blob | ebc25385668d0890f9b149d277ec7aabc027698e |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
4 <chapter id="appendix">
5 <title>A Collection of Useful Tidbits</title>
7 <para>
8 <indexterm><primary>material</primary></indexterm>
9 <indexterm><primary>domain</primary><secondary>joining</secondary></indexterm>
10 Information presented here is considered to be either basic or well-known material that is informative
11 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that
12 the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps
13 different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical,
14 as shown in the example given below.
15 </para>
17 <sect1 id="domjoin">
18 <title>Joining a Domain: Windows 200x/XP Professional</title>
20 <para>
21 <indexterm><primary>joining a domain</primary></indexterm>
22 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security.
23 This section steps through the process for making a Windows 200x/XP Professional machine a
24 member of a Domain Security environment. It should be noted that this process is identical
25 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC.
26 </para>
28 <procedure>
29 <title>Steps to Join a Domain</title>
31 <step><para>
32 Click <guimenu>Start</guimenu>.
33 </para></step>
35 <step><para>
36 Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>.
37 </para></step>
39 <step><para>
40 The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel.
41 See <link linkend="swxpp001"></link>.
42 <figure id="swxpp001"><imagefile>wxpp001</imagefile><title>The General Panel.</title></figure>
43 </para></step>
45 <step><para>
46 Click the <guimenu>Computer Name</guimenu> tab.
47 This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>,
48 and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>.
49 </para>
51 <para>
52 Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
53 Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
54 See <link linkend="swxpp004"></link>.
55 <figure id="swxpp004"><imagefile>wxpp004</imagefile><title>The Computer Name Panel.</title></figure>
56 </para></step>
58 <step><para>
59 Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP.
60 We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>.
61 <figure id="swxpp006"><imagefile>wxpp006</imagefile><title>The Computer Name Changes Panel</title></figure>
62 </para></step>
64 <step><para>
65 Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button.
66 </para>
68 <para>
69 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>.
70 <figure id="swxpp007"><imagefile>wxpp007</imagefile><title>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</title></figure>
71 </para></step>
73 <step><para>
74 Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password)
75 of a domain administrative account that has the rights to add machines to the domain.
76 </para>
78 <para>
79 Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
80 <figure id="swxpp008"><imagefile>wxpp008</imagefile><title>Computer Name Changes &smbmdash; User name and Password Panel</title></figure>
81 </para></step>
83 <step><para>
84 Click <guimenu>OK</guimenu>.
85 </para>
87 <para>
88 The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted.
89 Joining the domain is now complete.
90 </para></step>
92 </procedure>
94 <para>
95 <indexterm><primary>Active Directory</primary></indexterm>
96 <indexterm><primary>DNS</primary></indexterm>
97 The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a
98 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members
99 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.
100 </para>
102 <para>
103 <indexterm><primary>Netlogon</primary></indexterm>
104 <indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm>
105 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers
106 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server
107 to find the services (like which machines are domain controllers or which machines have the Netlogon service running).
108 </para>
110 <para>
111 <indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm>
112 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix,
113 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to
114 a valid IP address.
115 </para>
117 <para>
118 The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain.
119 Where the client is a member of a Samba domain, it is preferable to leave this field blank.
120 </para>
122 <para>
123 <indexterm><primary>Group Policy</primary></indexterm>
124 According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant>
125 enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used
126 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is
127 used only if Group Policy is disabled or unspecified.</quote>
128 </para>
130 </sect1>
132 <sect1>
133 <title>Samba System File Location</title>
135 <para><indexterm>
136 <primary>default installation</primary>
137 </indexterm><indexterm>
138 <primary>/usr/local/samba</primary>
139 </indexterm><indexterm>
140 <primary>/usr/local</primary>
141 </indexterm>
142 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team
143 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is
144 in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other
145 Open Source software that installs into the <filename>/usr/local</filename> subdirectories.
146 </para>
148 <para>
149 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team
150 default.
151 </para>
153 <para><indexterm>
154 <primary>Free Standards Group</primary>
155 <see>FSG</see>
156 </indexterm><indexterm>
157 <primary>FSG</primary>
158 </indexterm><indexterm>
159 <primary>Linux Standards Base</primary>
160 <see>LSB</see>
161 </indexterm><indexterm>
162 <primary>LSB</primary>
163 </indexterm><indexterm>
164 <primary>File Hierarchy System</primary>
165 <see>FHS</see>
166 </indexterm><indexterm>
167 <primary>FHS</primary>
168 </indexterm><indexterm>
169 <primary>file locations</primary>
170 </indexterm><indexterm>
171 <primary>/etc/samba</primary>
172 </indexterm><indexterm>
173 <primary>/usr/sbin</primary>
174 </indexterm><indexterm>
175 <primary>/usr/bin</primary>
176 </indexterm><indexterm>
177 <primary>/usr/share</primary>
178 </indexterm><indexterm>
179 <primary>/usr/share/swat</primary>
180 </indexterm><indexterm>
181 <primary>/usr/lib/samba</primary>
182 </indexterm><indexterm>
183 <primary>/usr/share/samba/swat</primary>
184 </indexterm><indexterm>
185 <primary>SWAT</primary>
186 </indexterm><indexterm>
187 <primary>VFS modules</primary>
188 </indexterm>
189 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy
190 System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary
191 files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the
192 <filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the
193 <filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in
194 <filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the
195 <filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the
196 passdb backend as well as for the VFS modules.
197 </para>
199 <para><indexterm>
200 <primary>/var/lib/samba</primary>
201 </indexterm><indexterm>
202 <primary>/var/log/samba</primary>
203 </indexterm><indexterm>
204 <primary>run-time control files</primary>
205 </indexterm>
206 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in
207 the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename>
208 </para>
210 <para>
211 When Samba is built and installed using the default Samba Team process, all files are located under the
212 <filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns.
213 </para>
215 <para><indexterm>
216 <primary>smbd</primary>
217 <secondary>location of files</secondary>
218 </indexterm>
219 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location
220 of all files called <command>smbd</command>. Here is an example:
221 <screen>
222 &rootprompt; find / -name smbd -print
223 </screen>
224 You can find the location of the configuration files by running:
225 <screen>
226 &rootprompt; /path-to-binary-file/smbd -b | more
227 ...
228 Paths:
229 SBINDIR: /usr/sbin
230 BINDIR: /usr/bin
231 SWATDIR: /usr/share/samba/swat
232 CONFIGFILE: /etc/samba/smb.conf
233 LOGFILEBASE: /var/log/samba
234 LMHOSTSFILE: /etc/samba/lmhosts
235 LIBDIR: /usr/lib/samba
236 SHLIBEXT: so
237 LOCKDIR: /var/lib/samba
238 PIDDIR: /var/run/samba
239 SMB_PASSWD_FILE: /etc/samba/smbpasswd
240 PRIVATE_DIR: /etc/samba
241 ...
242 </screen>
243 If you wish to locate the Samba version, just run:
244 <screen>
245 &rootprompt; /path-to-binary-file/smbd -V
246 Version 3.0.20-SUSE
247 </screen>
248 </para>
250 <para>
251 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
252 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
253 executing:<indexterm>
254 <primary>rpm</primary>
255 </indexterm>
256 <screen>
257 &rootprompt; rpm -qa | grep samba
258 samba3-pdb-3.0.20-1
259 samba3-vscan-0.3.6-0
260 samba3-winbind-3.0.20-1
261 samba3-3.0.20-1
262 samba3-python-3.0.20-1
263 samba3-utils-3.0.20-1
264 samba3-doc-3.0.20-1
265 samba3-client-3.0.20-1
266 samba3-cifsmount-3.0.20-1
267 </screen><indexterm>
268 <primary>package names</primary>
269 </indexterm>
270 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them.
271 </para>
273 </sect1>
275 <sect1>
276 <title>Starting Samba</title>
278 <para><indexterm>
279 <primary>daemon</primary>
280 </indexterm>
281 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
282 An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there
283 are three daemons, two of which are needed as a minimum.
284 </para>
286 <para>
287 The Samba server is made up of the following daemons:
288 </para>
290 <example id="ch12SL">
291 <title>A Useful Samba Control Script for SUSE Linux</title>
292 <screen>
293 #!/bin/bash
294 #
295 # Script to start/stop samba
296 # Locate this in /sbin as a file called 'samba'
298 RCD=/etc/rc.d
300 if [ z$1 == 'z' ]; then
301 echo $0 - No arguments given; must be start or stop.
302 exit
303 fi
305 if [ $1 == 'start' ]; then
306 ${RCD}/nmb start
307 ${RCD}/smb start
308 ${RCD}/winbind start
310 fi
311 if [ $1 == 'stop' ]; then
312 ${RCD}/smb stop
313 ${RCD}/winbind stop
314 ${RCD}/nmb stop
315 fi
316 if [ $1 == 'restart' ]; then
317 ${RCD}/smb stop
318 ${RCD}/winbind stop
319 ${RCD}/nmb stop
320 sleep 5
321 ${RCD}/nmb start
322 ${RCD}/smb start
323 ${RCD}/winbind start
324 fi
325 exit 0
326 </screen>
327 </example>
329 <variablelist>
330 <varlistentry><term>nmbd</term>
331 <listitem><para>
332 <indexterm><primary>smbd</primary></indexterm>
333 <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
334 This daemon handles all name registration and resolution requests. It is the primary vehicle involved
335 in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
336 be the first command started as part of the Samba startup process.
337 </para></listitem>
338 </varlistentry>
340 <varlistentry><term>smbd</term>
341 <listitem><para>
342 <indexterm><primary>nmbd</primary></indexterm>
343 <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
344 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
345 manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
346 </para></listitem>
347 </varlistentry>
349 <varlistentry><term>winbindd</term>
350 <listitem><para>
351 <indexterm><primary>winbindd</primary></indexterm>
352 <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
353 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
354 Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
355 &smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
356 parameters. If they are not found, <command>winbindd</command> bails out and refuses to start.
357 </para></listitem>
358 </varlistentry>
359 </variablelist>
361 <para>
362 When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
363 integration into the platform as a whole. Please refer to your operating system platform administration manuals for
364 specific information pertaining to correct management of Samba startup.
365 </para>
367 <example id="ch12RHscript">
368 <title>A Sample Samba Control Script for Red Hat Linux</title>
369 <screen>
370 #!/bin/sh
371 #
372 # chkconfig: 345 81 35
373 # description: Starts and stops the Samba smbd and nmbd daemons \
374 # used to provide SMB network services.
376 # Source function library.
377 . /etc/rc.d/init.d/functions
378 # Source networking configuration.
379 . /etc/sysconfig/network
380 # Check that networking is up.
381 [ ${NETWORKING} = "no" ] && exit 0
382 CONFIG=/etc/samba/smb.conf
383 # Check that smb.conf exists.
384 [ -f $CONFIG ] || exit 0
386 # See how we were called.
387 case "$1" in
388 start)
389 echo -n "Starting SMB services: "
390 daemon smbd -D; daemon nmbd -D; echo;
391 touch /var/lock/subsys/smb
392 ;;
393 stop)
394 echo -n "Shutting down SMB services: "
395 smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
396 for pid in $smbdpids; do
397 kill -TERM $pid
398 done
399 killproc nmbd -TERM; rm -f /var/lock/subsys/smb
400 echo ""
401 ;;
402 status)
403 status smbd; status nmbd;
404 ;;
405 restart)
406 echo -n "Restarting SMB services: "
407 $0 stop; $0 start;
408 echo "done."
409 ;;
410 *)
411 echo "Usage: smb {start|stop|restart|status}"
412 exit 1
413 esac
414 </screen>
415 </example>
417 <para><indexterm>
418 <primary>samba control script</primary>
419 </indexterm>
420 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently
421 executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory
422 <filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be
423 owned by user root and group root, and set so that only root can execute it.
424 </para>
426 <para><indexterm>
427 <primary>startup script</primary>
428 </indexterm>
429 A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>.
430 This file could be located in the directory <filename>/etc/rc.d</filename> and can be called
431 <filename>samba</filename>. A similar startup script is required to control <command>winbind</command>.
432 If you want to find more information regarding startup scripts please refer to the packaging section of
433 the Samba source code distribution tarball. The packaging files for each platform include a
434 startup control file.
435 </para>
437 </sect1>
439 <sect1>
440 <title>DNS Configuration Files</title>
442 <para>
443 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they
444 are presented here for general reference.
445 </para>
447 <sect2>
448 <title>The Forward Zone File for the Loopback Adaptor</title>
450 <para>
451 The forward zone file for the loopback address never changes. An example file is shown
452 in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a
453 physical interface on the machine itself is routed to the loopback adaptor. This is
454 a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor
455 is called <constant>localhost</constant>.
456 </para>
458 <example id="loopback">
459 <title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title>
460 <screen>
461 $TTL 1W
462 @ IN SOA @ root (
463 42 ; serial
464 2D ; refresh
465 4H ; retry
466 6W ; expiry
467 1W ) ; minimum
469 IN NS @
470 IN A 127.0.0.1
471 </screen>
472 </example>
474 </sect2>
476 <sect2>
477 <title>The Reverse Zone File for the Loopback Adaptor</title>
479 <para>
480 The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/>
481 is necessary so that references to the address <constant>127.0.0.1</constant> can be
482 resolved to the correct name of the interface.
483 </para>
485 <example id="dnsloopy">
486 <title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title>
487 <screen>
488 $TTL 1W
489 @ IN SOA localhost. root.localhost. (
490 42 ; serial
491 2D ; refresh
492 4H ; retry
493 6W ; expiry
494 1W ) ; minimum
496 IN NS localhost.
497 1 IN PTR localhost.
498 </screen>
499 </example>
501 <example id="roothint">
502 <title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title>
503 <screen>
504 ; This file is made available by InterNIC under anonymous FTP as
505 ; file /domain/named.root
506 ; on server FTP.INTERNIC.NET
507 ; last update: Nov 5, 2002. Related version of root zone: 2002110501
508 ; formerly NS.INTERNIC.NET
509 . 3600000 IN NS A.ROOT-SERVERS.NET.
510 A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
511 ; formerly NS1.ISI.EDU
512 . 3600000 NS B.ROOT-SERVERS.NET.
513 B.ROOT-SERVERS.NET. 3600000 A 128.9.0.107
514 ; formerly C.PSI.NET
515 . 3600000 NS C.ROOT-SERVERS.NET.
516 C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
517 ; formerly TERP.UMD.EDU
518 . 3600000 NS D.ROOT-SERVERS.NET.
519 D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
520 ; formerly NS.NASA.GOV
521 . 3600000 NS E.ROOT-SERVERS.NET.
522 E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
523 ; formerly NS.ISC.ORG
524 . 3600000 NS F.ROOT-SERVERS.NET.
525 F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
526 ; formerly NS.NIC.DDN.MIL
527 . 3600000 NS G.ROOT-SERVERS.NET.
528 G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
529 ; formerly AOS.ARL.ARMY.MIL
530 . 3600000 NS H.ROOT-SERVERS.NET.
531 H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
532 ; formerly NIC.NORDU.NET
533 . 3600000 NS I.ROOT-SERVERS.NET.
534 I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
535 ; operated by VeriSign, Inc.
536 . 3600000 NS J.ROOT-SERVERS.NET.
537 J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
538 ; housed in LINX, operated by RIPE NCC
539 . 3600000 NS K.ROOT-SERVERS.NET.
540 K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
541 ; operated by IANA
542 . 3600000 NS L.ROOT-SERVERS.NET.
543 L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
544 ; housed in Japan, operated by WIDE
545 . 3600000 NS M.ROOT-SERVERS.NET.
546 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
547 ; End of File
548 </screen>
549 </example>
550 </sect2>
552 <sect2>
553 <title>DNS Root Server Hint File</title>
555 <para>
556 The content of the root hints file as shown in <link linkend="roothint"/> changes slowly over time.
557 Periodically this file should be updated from the source shown. Because
558 of its size, this file is located at the end of this appendix.
559 </para>
561 </sect2>
563 </sect1>
565 <sect1 id="altldapcfg">
566 <title>Alternative LDAP Database Initialization</title>
568 <para><indexterm>
569 <primary>LDAP</primary>
570 <secondary>database</secondary>
571 </indexterm><indexterm>
572 <primary>LDAP</primary>
573 <secondary>initial configuration</secondary>
574 </indexterm>
575 The following procedure may be used as an alternative means of configuring
576 the initial LDAP database. Many administrators prefer to have greater control
577 over how system files get configured.
578 </para>
580 <sect2>
581 <title>Initialization of the LDAP Database</title>
583 <para><indexterm>
584 <primary>LDIF</primary>
585 </indexterm><indexterm>
586 <primary>Domain Groups</primary>
587 <secondary>well-known</secondary>
588 </indexterm><indexterm>
589 <primary>SID</primary>
590 </indexterm>
591 The first step to get the LDAP server ready for action is to create the LDIF file from
592 which the LDAP database will be preloaded. This is necessary to create the containers
593 into which the user, group, and other accounts are written. It is also necessary to
594 preload the well-known Windows NT Domain Groups, as they must have the correct SID so
595 that they can be recognized as special NT Groups by the MS Windows clients.
596 </para>
598 <procedure id="ldapinit">
599 <title>LDAP Directory Pre-Load Steps</title>
601 <step><para>
602 Create a directory in which to store the files you use to generate
603 the LDAP LDIF file for your system. Execute the following:
604 <screen>
605 &rootprompt; mkdir /etc/openldap/SambaInit
606 &rootprompt; chown root:root /etc/openldap/SambaInit
607 &rootprompt; chmod 700 /etc/openldap/SambaInit
608 </screen>
609 </para></step>
611 <step><para>
612 Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>,
613 and <link linkend="sbehap-ldapreconfc"/> into the directory
614 <filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are,
615 respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file.
616 </para></step>
618 <step><para>
619 Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory
620 <filename>/etc/openldap/SambaInit/nit-ldif.pat.</filename> These two files are
621 parts A and B, respectively, of the <filename>init-ldif.pat</filename> file.
622 </para></step>
624 <step><para>
625 Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following:
626 <screen>
627 &rootprompt; ./SMBLDAP-ldif-preconfig.sh
629 How do you wish to refer to your organization?
630 Suggestions:
631 Black Tire Company, Inc.
632 Cat With Hat Ltd.
633 How would you like your organization name to appear?
634 Your organization name is: My Organization
635 Enter a new name is this is not what you want, press Enter to Continue.
636 Name [My Organization]: Abmas Inc.
638 Samba Config File Location [/etc/samba/smb.conf]:
639 Enter a new full path or press Enter to continue.
640 Samba Config File Location [/etc/samba/smb.conf]:
641 Domain Name: MEGANET2
642 Domain SID: S-1-5-21-3504140859-1010554828-2431957765
644 The name of your Internet domain is now needed in a special format
645 as follows, if your domain name is mydomain.org, what we need is
646 the information in the form of:
647 Domain ID: mydomain
648 Top level: org
649 If your fully qualified hostname is: snoopy.bazaar.garagesale.net
650 where "snoopy" is the name of the machine,
651 Then the information needed is:
652 Domain ID: garagesale
653 Top Level: net
655 Found the following domain name: abmas.biz
656 I think the bit we are looking for might be: abmas
657 Enter the domain name or press Enter to continue:
659 The top level organization name I will use is: biz
660 Enter the top level org name or press Enter to continue:
661 &rootprompt;
662 </screen>
663 This creates a file called <filename>MEGANET2.ldif</filename>.
664 </para></step>
666 <step><para>
667 It is now time to preload the LDAP database with the following
668 command:
669 <screen>
670 &rootprompt; slapadd -v -l MEGANET2.ldif
671 added: "dc=abmas,dc=biz" (00000001)
672 added: "cn=Manager,dc=abmas,dc=biz" (00000002)
673 added: "ou=People,dc=abmas,dc=biz" (00000003)
674 added: "ou=Computers,dc=abmas,dc=biz" (00000004)
675 added: "ou=Groups,dc=abmas,dc=biz" (00000005)
676 added: "ou=Domains,dc=abmas,dc=biz" (00000006)
677 added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007)
678 added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008)
679 added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009)
680 added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a)
681 </screen>
682 You should verify that the account information was correctly loaded by executing:
683 <screen>
684 &rootprompt; slapcat
685 dn: dc=abmas,dc=biz
686 objectClass: dcObject
687 objectClass: organization
688 dc: abmas
689 o: Abmas Inc.
690 description: Posix and Samba LDAP Identity Database
691 structuralObjectClass: organization
692 entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474
693 creatorsName: cn=manager,dc=abmas,dc=biz
694 modifiersName: cn=manager,dc=abmas,dc=biz
695 createTimestamp: 20031217055747Z
696 modifyTimestamp: 20031217055747Z
697 entryCSN: 2003121705:57:47Z#0x0001#0#0000
698 ...
700 dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
701 objectClass: posixGroup
702 objectClass: sambaGroupMapping
703 gidNumber: 513
704 cn: domusers
705 sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
706 sambaGroupType: 2
707 displayName: Domain Users
708 description: Domain Users
709 structuralObjectClass: posixGroup
710 entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474
711 creatorsName: cn=manager,dc=abmas,dc=biz
712 modifiersName: cn=manager,dc=abmas,dc=biz
713 createTimestamp: 20031217055747Z
714 modifyTimestamp: 20031217055747Z
715 entryCSN: 2003121705:57:47Z#0x000a#0#0000
716 </screen>
717 </para></step>
719 <step><para>
720 Your LDAP database is ready for testing. You can now start the LDAP server
721 using the system tool for your Linux operating system. For SUSE Linux, you can
722 do this as follows:
723 <screen>
724 &rootprompt; rcldap start
725 </screen>
726 </para></step>
728 <step><para>
729 It is now a good idea to validate that the LDAP server is running correctly.
730 Execute the following:
731 <screen>
732 &rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
733 # extended LDIF
734 #
735 # LDAPv3
736 # base <dc=abmas,dc=biz> with scope sub
737 # filter: (ObjectClass=*)
738 # requesting: ALL
739 #
741 # abmas.biz
742 dn: dc=abmas,dc=biz
743 objectClass: dcObject
744 objectClass: organization
745 dc: abmas
746 o: Abmas Inc.
747 description: Posix and Samba LDAP Identity Database
748 ...
749 # domusers, Groups, abmas.biz
750 dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
751 objectClass: posixGroup
752 objectClass: sambaGroupMapping
753 gidNumber: 513
754 cn: domusers
755 sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
756 sambaGroupType: 2
757 displayName: Domain Users
758 description: Domain Users
760 # search result
761 search: 2
762 result: 0 Success
764 # numResponses: 11
765 # numEntries: 10
766 </screen>
767 Your LDAP server is ready for creation of additional accounts.
768 </para></step>
769 </procedure>
771 </sect2>
773 <example id="sbehap-ldapreconfa">
774 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title>
775 <screen>
776 #!/bin/bash
777 #
778 # This script prepares the ldif LDAP load file only
779 #
781 # Pattern File Name
782 file=init-ldif.pat
784 # The name of my organization
785 ORGNAME="My Organization"
787 # My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets"
788 INETDOMAIN="my-domain"
790 # In the above case, md domain is: buckets.org, TLDORG="org"
791 TLDORG="org"
793 # This is the Samba Domain/Workgroup Name
794 DOMNAME="MYWORKGROUP"
796 #
797 # Here We Go ...
798 #
800 cat <<EOF
802 How do you wish to refer to your organization?
804 Suggestions:
805 Black Tire Company, Inc.
806 Cat With Hat Ltd.
808 How would you like your organization name to appear?
810 EOF
812 echo "Your organization name is: $ORGNAME"
813 echo
814 echo "Enter a new name or, press Enter to Continue."
815 echo
816 </screen>
817 </example>
819 <example id="sbehap-ldapreconfb">
820 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title>
821 <screen>
822 echo -e -n "Name [$ORGNAME]: "
823 read name
825 if [ ! -z "$name" ]; then
826 ORGNAME=${name}
827 fi
828 echo
829 sed "s/ORGNAME/${ORGNAME}/g" < $file > $file.tmp1
831 # Try to find smb.conf
833 if [ -e /usr/local/samba/lib/smb.conf ]; then
834 CONF=/usr/local/samba/lib/smb.conf
835 elif [ -e /etc/samba/smb.conf ]; then
836 CONF=/etc/samba/smb.conf
837 fi
839 echo "Samba Config File Location [$CONF]: "
840 echo
841 echo "Enter a new full path or press Enter to continue."
842 echo
843 echo -n "Samba Config File Location [$CONF]: "
844 read name
845 if [ ! -z "$name" ]; then
846 CONF=$name
847 fi
848 echo
850 # Find the name of our Domain/Workgroup
851 DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=`
852 echo Domain Name: $DOMNAME
853 echo
855 sed "s/DOMNAME/${DOMNAME}/g" < $file.tmp1 > $file.tmp2
857 DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"`
858 echo Domain SID: $DOMSID
860 sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1
861 </screen>
862 </example>
864 <example id="sbehap-ldapreconfc">
865 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title>
866 <screen>
867 cat >>EOL
868 The name of your Internet domain is now needed in a special format
869 as follows, if your domain name is mydomain.org, what we need is
870 the information in the form of:
871 Domain ID: mydomain
872 Top level: org
874 If your fully qualified hostname is: snoopy.bazaar.garagesale.net
875 where "snoopy" is the name of the machine,
876 Then the information needed is:
877 Domain ID: garagesale
878 Top Level: net
880 EOL
881 INETDOMAIN=`hostname -d | cut -f1 -d.`
882 echo Found the following domain name: `hostname -d`
883 echo "I think the bit we are looking for might be: $INETDOMAIN"
884 echo
885 echo -n "Enter the domain name or press Enter to continue: "
886 read domnam
887 if [ ! -z $domnam ]; then
888 INETDOMAIN=$domnam
889 fi
890 echo
891 sed "s/INETDOMAIN/${INETDOMAIN}/g" < $file.tmp1 > $file.tmp2
892 TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"`
893 echo "The top level organization name I will use is: ${TLDORG}"
894 echo
895 echo -n "Enter the top level org name or press Enter to continue: "
896 read domnam
897 if [ ! -z $domnam ]; then
898 TLDORG=$domnam
899 fi
900 sed "s/TLDORG/${TLDORG}/g" < $file.tmp2 > $DOMNAME.ldif
901 rm $file.tmp*
902 exit 0
903 </screen>
904 </example>
906 <example id="sbehap-ldifpata">
907 <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title>
908 <screen>
909 dn: dc=INETDOMAIN,dc=TLDORG
910 objectClass: dcObject
911 objectClass: organization
912 dc: INETDOMAIN
913 o: ORGNAME
914 description: Posix and Samba LDAP Identity Database
916 dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG
917 objectClass: organizationalRole
918 cn: Manager
919 description: Directory Manager
921 dn: ou=People,dc=INETDOMAIN,dc=TLDORG
922 objectClass: top
923 objectClass: organizationalUnit
924 ou: People
926 dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG
927 objectClass: top
928 objectClass: organizationalUnit
929 ou: Computers
931 dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG
932 objectClass: top
933 objectClass: organizationalUnit
934 ou: Groups
936 dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG
937 objectClass: top
938 objectClass: organizationalUnit
939 ou: Idmap
941 dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG
942 objectClass: sambaDomain
943 sambaDomainName: DOMNAME
944 sambaSID: DOMSID
945 sambaAlgorithmicRidBase: 1000
946 structuralObjectClass: sambaDomain
947 </screen>
948 </example>
950 <example id="sbehap-ldifpatb">
951 <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title>
952 <screen>
953 dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG
954 objectClass: posixGroup
955 objectClass: sambaGroupMapping
956 gidNumber: 512
957 cn: domadmins
958 sambaSID: DOMSID-512
959 sambaGroupType: 2
960 displayName: Domain Admins
961 description: Domain Administrators
963 dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG
964 objectClass: posixGroup
965 objectClass: sambaGroupMapping
966 gidNumber: 514
967 cn: domguests
968 sambaSID: DOMSID-514
969 sambaGroupType: 2
970 displayName: Domain Guests
971 description: Domain Guests Users
973 dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG
974 objectClass: posixGroup
975 objectClass: sambaGroupMapping
976 gidNumber: 513
977 cn: domusers
978 sambaSID: DOMSID-513
979 sambaGroupType: 2
980 displayName: Domain Users
981 description: Domain Users
982 </screen>
983 </example>
985 </sect1>
987 <sect1>
988 <title>The LDAP Account Manager</title>
990 <para>
991 <indexterm><primary>LAM</primary></indexterm>
992 <indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm>
993 <indexterm><primary>PHP</primary></indexterm>
994 <indexterm><primary>unencrypted</primary></indexterm>
995 <indexterm><primary>SSL</primary></indexterm>
996 <indexterm><primary>Posix</primary></indexterm>
997 <indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm>
998 The LDAP Account Manager (LAM) is an application suite that has been written in PHP.
999 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP
1000 server either using unencrypted connections or via SSL/TLS. LAM can be used to manage
1001 Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines
1002 (hosts).
1003 </para>
1005 <para>
1006 LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink>
1007 home page and from its mirror sites. LAM has been released under the GNU GPL version 2.
1008 The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter
1009 of 2005.
1010 </para>
1012 <para>
1013 <indexterm><primary>PHP4</primary></indexterm>
1014 <indexterm><primary>OpenLDAP</primary></indexterm>
1015 <indexterm><primary>Perl</primary></indexterm>
1016 Requirements:
1017 </para>
1019 <itemizedlist>
1020 <listitem><para>A web server that will work with PHP4.</para></listitem>
1021 <listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem>
1022 <listitem><para>OpenLDAP 2.0 or later.</para></listitem>
1023 <listitem><para>A Web browser that supports CSS.</para></listitem>
1024 <listitem><para>Perl.</para></listitem>
1025 <listitem><para>The gettext package.</para></listitem>
1026 <listitem><para>mcrypt + mhash (optional).</para></listitem>
1027 <listitem><para>It is also a good idea to install SSL support.</para></listitem>
1028 </itemizedlist>
1030 <para>
1031 LAM is a useful tool that provides a simple Web-based device that can be used to
1032 manage the contents of the LDAP directory to:
1033 <indexterm><primary>organizational units</primary></indexterm>
1034 <indexterm><primary>operating profiles</primary></indexterm>
1035 <indexterm><primary>account policies</primary></indexterm>
1036 </para>
1038 <itemizedlist>
1039 <listitem><para>Display user/group/host and Domain entries.</para></listitem>
1040 <listitem><para>Manage entries (Add/Delete/Edit).</para></listitem>
1041 <listitem><para>Filter and sort entries.</para></listitem>
1042 <listitem><para>Store and use multiple operating profiles.</para></listitem>
1043 <listitem><para>Edit organizational units (OUs).</para></listitem>
1044 <listitem><para>Upload accounts from a file.</para></listitem>
1045 <listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem>
1046 </itemizedlist>
1048 <para>
1049 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba
1050 user, group, and windows domain member machine accounts.
1051 </para>
1053 <para>
1054 <indexterm><primary>default password</primary></indexterm>
1055 <indexterm><primary>secure connections</primary></indexterm>
1056 <indexterm><primary>LAM</primary></indexterm>
1057 <indexterm><primary>SSL</primary></indexterm>
1058 The default password is <quote>lam.</quote> It is highly recommended that you use only
1059 an SSL connection to your Web server for all remote operations involving LAM. If you
1060 want secure connections, you must configure your Apache Web server to permit connections
1061 to LAM using only SSL.
1062 </para>
1064 <procedure id="sbehap-laminst">
1065 <title>Apache Configuration Steps for LAM</title>
1067 <step><para>
1068 Extract the LAM package by untarring it as shown here:
1069 <screen>
1070 &rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz
1071 </screen>
1072 Alternatively, install the LAM DEB for your system using the following command:
1073 <screen>
1074 &rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb
1075 </screen>
1076 </para></step>
1078 <step><para>
1079 Copy the extracted files to the document root directory of your Web server.
1080 For example, on SUSE Linux Enterprise Server 9, copy to the
1081 <filename>/srv/www/htdocs</filename> directory.
1082 </para></step>
1084 <step><para>
1085 <indexterm><primary>file permissions</primary></indexterm>
1086 Set file permissions using the following commands:
1087 <screen>
1088 &rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam
1089 &rootprompt; chmod 755 /srv/www/htdocs/lam/sess
1090 &rootprompt; chmod 755 /srv/www/htdocs/lam/tmp
1091 &rootprompt; chmod 755 /srv/www/htdocs/lam/config
1092 &rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl
1093 </screen>
1094 </para></step>
1096 <step><para>
1097 <indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm>
1098 Using your favorite editor create the following <filename>config.cfg</filename>
1099 LAM configuration file:
1100 <screen>
1101 &rootprompt; cd /srv/www/htdocs/lam/config
1102 &rootprompt; cp config.cfg_sample config.cfg
1103 &rootprompt; vi config.cfg
1104 </screen>
1105 <indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm>
1106 <indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm>
1107 An example file is shown in <link linkend="lamcfg"/>.
1108 This is the minimum configuration that must be completed. The LAM profile
1109 file can be created using a convenient wizard that is part of the LAM
1110 configuration suite.
1111 </para></step>
1113 <step><para>
1114 Start your Web server then, using your Web browser, connect to
1115 <ulink url="http://localhost/lam">LAM</ulink> URL. Click on the
1116 the <parameter>Configuration Login</parameter> link then click on the
1117 Configuration Wizard link to begin creation of the default profile so that
1118 LAM can connect to your LDAP server. Alternately, copy the
1119 <filename>lam.conf_sample</filename> file to a file called
1120 <filename>lam.conf</filename> then, using your favorite editor,
1121 change the settings to match local site needs.
1122 </para></step>
1123 </procedure>
1125 <para>
1126 <indexterm><primary>pitfalls</primary></indexterm>
1127 An example of a working file is shown here in <link linkend="lamconf"/>.
1128 This file has been stripped of comments to keep the size small. The comments
1129 and help information provided in the profile file that the wizard creates
1130 is very useful and will help many administrators to avoid pitfalls.
1131 Your configuration file obviously reflects the configuration options that
1132 are preferred at your site.
1133 </para>
1135 <para>
1136 <indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm>
1137 It is important that your LDAP server is running at the time that LAM is
1138 being configured. This permits you to validate correct operation.
1139 An example of the LAM login screen is provided in <link linkend="lam-login"/>.
1140 </para>
1142 <figure id="lam-login">
1143 <title>The LDAP Account Manager Login Screen</title>
1144 <imagefile scale="50">lam-login</imagefile>
1145 </figure>
1147 <para>
1148 <indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm>
1149 The LAM configuration editor has a number of options that must be managed correctly.
1150 An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>.
1151 It is important that you correctly set the minimum and maximum UID/GID values that are
1152 permitted for use at your site. The default values may not be compatible with a need to
1153 modify initial default account values for well-known Windows network users and groups.
1154 The best work-around is to temporarily set the minimum values to zero (0) to permit
1155 the initial settings to be made. Do not forget to reset these to sensible values before
1156 using LAM to add additional users and groups.
1157 </para>
1159 <figure id="lam-config">
1160 <title>The LDAP Account Manager Configuration Screen</title>
1161 <imagefile scale="50">lam-config</imagefile>
1162 </figure>
1164 <para>
1165 <indexterm><primary>PDF</primary></indexterm>
1166 LAM has some nice, but unusual features. For example, one unexpected feature in most application
1167 screens permits the generation of a PDF file that lists configuration information. This is a well
1168 thought out facility. This option has been edited out of the following screen shots to conserve
1169 space.
1170 </para>
1172 <para>
1173 <indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm>
1174 When you log onto LAM the opening screen drops you right into the user manager as shown in
1175 <link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility
1176 to be used immediately. The editing of an existing user, as with the addition of a new user,
1177 is easy to follow and very clear in both layout and intent. It is a simple matter to edit
1178 generic settings, UNIX specific parameters, and then Samba account requirements. Each step
1179 involves clicking a button that intuitively drives you through the process. When you have
1180 finished editing simply press the <guimenu>Final</guimenu> button.
1181 </para>
1183 <figure id="lam-user">
1184 <title>The LDAP Account Manager User Edit Screen</title>
1185 <imagefile scale="50">lam-users</imagefile>
1186 </figure>
1188 <para>
1189 The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen
1190 for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/>
1191 shows a sub-screen from the group editor that permits users to be assigned secondary group
1192 memberships.
1193 </para>
1195 <figure id="lam-group">
1196 <title>The LDAP Account Manager Group Edit Screen</title>
1197 <imagefile scale="50">lam-groups</imagefile>
1198 </figure>
1200 <figure id="lam-group-mem">
1201 <title>The LDAP Account Manager Group Membership Edit Screen</title>
1202 <imagefile scale="50">lam-group-members</imagefile>
1203 </figure>
1205 <para>
1206 <indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm>
1207 The final screen presented here is one that you should not normally need to use. Host accounts will
1208 be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/>
1209 will, in most cases, not be used.
1210 </para>
1212 <figure id="lam-host">
1213 <title>The LDAP Account Manager Host Edit Screen</title>
1214 <imagefile scale="50">lam-hosts</imagefile>
1215 </figure>
1217 <para>
1218 One aspect of LAM that may annoy some users is the way it forces certain conventions on
1219 the administrator. For example, LAM does not permit the creation of Windows user and group
1220 accounts that contain spaces even though the underlying UNIX/Linux
1221 operating system may exhibit no problems with them. Given the propensity for using upper-case
1222 characters and spaces (particularly in the default Windows account names) this may cause
1223 some annoyance. For the rest, LAM is a very useful administrative tool.
1224 </para>
1226 <para>
1227 The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features
1228 (e.g., logon hours). The new plugin-based architecture also allows management of much more different
1229 account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another
1230 important point is the tree view which allows browsing and editing LDAP objects directly.
1231 </para>
1233 <example id="lamcfg">
1234 <title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title>
1235 <screen>
1236 # password to add/delete/rename configuration profiles
1237 password: not24get
1239 # default profile, without ".conf"
1240 default: lam
1241 </screen>
1242 </example>
1244 <example id="lamconf">
1245 <title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title>
1246 <screen>
1247 ServerURL: ldap://massive.abmas.org:389
1248 Admins: cn=Manager,dc=abmas,dc=biz
1249 Passwd: not24get
1250 usersuffix: ou=People,dc=abmas,dc=biz
1251 groupsuffix: ou=Groups,dc=abmas,dc=biz
1252 hostsuffix: ou=Computers,dc=abmas,dc=biz
1253 domainsuffix: ou=Domains,dc=abmas,dc=biz
1254 MinUID: 0
1255 MaxUID: 65535
1256 MinGID: 0
1257 MaxGID: 65535
1258 MinMachine: 20000
1259 MaxMachine: 25000
1260 userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber
1261 grouplistAttributes: #cn;#gidNumber;#memberUID;#description
1262 hostlistAttributes: #cn;#description;#uidNumber;#gidNumber
1263 maxlistentries: 30
1264 defaultLanguage: en_GB:ISO-8859-1:English (Great Britain)
1265 scriptPath:
1266 scriptServer:
1267 samba3: yes
1268 cachetimeout: 5
1269 pwdhash: SSHA
1270 </screen>
1271 </example>
1273 </sect1>
1275 <sect1>
1276 <title>IDEALX Management Console</title>
1278 <para>
1279 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive
1280 web-based management interface for UNIX and Linux systems.
1281 </para>
1283 <para>
1284 The Samba toolset is the first console developped for IMC. It offers a simple and ergonomic
1285 interface for managing a Samba domain controler. The goal is to give Linux administrators who
1286 need to manage production Samba servers an effective, intuitive and consistent management
1287 experience. An IMC screenshot of the user management tool is shown in <link linkend="imcidealx"/>.
1288 </para>
1290 <figure id="imcidealx">
1291 <title>The IMC Samba User Account Screen</title>
1292 <imagefile scale="40">imc-usermanager2</imagefile>
1293 </figure>
1295 <para>
1296 IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC,
1297 but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language.
1298 </para>
1300 <para>
1301 For further information regarding IMC refer to the web <ulink url="http://imc.sourceforge.net/">site.</ulink>
1302 Prebuilt RPM packages are also <ulink url="http://imc.sourceforge.net/download.html">available.</ulink>
1303 </para>
1305 </sect1>
1307 <sect1 id="ch12-SUIDSGID">
1308 <title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title>
1310 <indexterm><primary>SUID</primary></indexterm>
1311 <indexterm><primary>SGID</primary></indexterm>
1312 <para>
1313 The setting of the SUID/SGID bits on the file or directory permissions flag has particular
1314 consequences. If the file is executable and the SUID bit is set, it executes with the privilege
1315 of (with the UID of) the owner of the file. For example, if you are logged onto a system as
1316 a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned
1317 by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is
1318 executed as if you had logged in as the user <constant>root</constant> and then executed the file.
1319 The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the
1320 use of that executable file.
1321 </para>
1323 <para>
1324 The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it
1325 applies the privilege to the UNIX group setting. In other words, the file executes with the force
1326 of capability of the group.
1327 </para>
1329 <para>
1330 When the SUID/SGID permissions are set on a directory, all files that are created within that directory
1331 are automatically given the ownership of the SUID user and the SGID group, as per the ownership
1332 of the directory in which the file is created. This means that the system level <command>create()</command>
1333 function executes with the SUID user and/or SGID group of the directory in which the file is
1334 created.
1335 </para>
1337 <para>
1338 If you want to obtain the SUID behavior, simply execute the following command:
1339 <screen>
1340 &rootprompt; chmod u+s file-or-directory
1341 </screen>
1342 To set the SGID properties on a file or a directory, execute this command:
1343 <screen>
1344 &rootprompt; chmod g+s file-or-directory
1345 </screen>
1346 And to set both SUID and SGID properties, execute the following:
1347 <screen>
1348 &rootprompt; chmod ug+s file-or-directory
1349 </screen>
1350 </para>
1352 <para>
1353 Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this
1354 directory before setting both SUID and SGID on this directory are:
1355 <screen>
1356 &rootprompt; ls -al /data/accounts
1357 total 1
1358 drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1359 drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1360 drwxrwxrwx 2 bobj Domain Users 48 Dec 18 17:08 accounts/
1361 drwx------ 2 root root 48 Jan 26 2002 lost+found
1362 </screen>
1363 In this example, if the user <constant>maryv</constant> creates a file, it is owned by her.
1364 If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is
1365 owned by the group <constant>Accounts</constant>, as shown in this listing:
1366 <screen>
1367 &rootprompt; ls -al /data/accounts/maryvfile.txt
1368 drw-rw-r-- 2 maryv Accounts 12346 Dec 18 17:53
1369 </screen>
1370 </para>
1372 <para>
1373 Now you set the SUID and SGID and check the result as follows:
1374 <screen>
1375 &rootprompt; chmod ug+s /data/accounts
1376 &rootprompt; ls -al /data/accounts
1377 total 1
1378 drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1379 drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1380 drwsrwsr-x 2 bobj Domain Users 48 Dec 18 17:08 accounts
1381 drwx------ 2 root root 48 Jan 26 2002 lost+found
1382 </screen>
1383 If <constant>maryv</constant> creates a file in this directory after this change has been made, the
1384 file is owned by the user <constant>bobj</constant>, and the group is set to the group
1385 <constant>Domain Users</constant>, as shown here:
1386 <screen>
1387 &rootprompt; chmod ug+s /data/accounts
1388 &rootprompt; ls -al /data/accounts/maryvfile.txt
1389 total 1
1390 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
1391 </screen>
1392 </para>
1394 </sect1>
1396 <sect1 id="ch12dblck">
1397 <title>Shared Data Integrity</title>
1399 <para><indexterm>
1400 <primary>data integrity</primary>
1401 </indexterm><indexterm>
1402 <primary>multi-user</primary>
1403 <secondary>data access</secondary>
1404 </indexterm>
1405 The integrity of shared data is often viewed as a particularly emotional issue, especially where
1406 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have
1407 experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
1408 </para>
1410 <para>
1411 The solution to concurrent multiuser data access problems must consider three separate areas
1412 from which the problem may stem:<indexterm>
1413 <primary>locking</primary>
1414 <secondary>Application level</secondary>
1415 </indexterm><indexterm>
1416 <primary>locking</primary>
1417 <secondary>Client side</secondary>
1418 </indexterm><indexterm>
1419 <primary>locking</primary>
1420 <secondary>Server side</secondary>
1421 </indexterm>
1422 </para>
1424 <itemizedlist>
1425 <listitem><para>application-level locking controls</para></listitem>
1426 <listitem><para>client-side locking controls</para></listitem>
1427 <listitem><para>server-side locking controls</para></listitem>
1428 </itemizedlist>
1430 <para><indexterm>
1431 <primary>database applications</primary>
1432 </indexterm><indexterm>
1433 <primary>Microsoft Access</primary>
1434 </indexterm>
1435 Many database applications use some form of application-level access control. An example of one
1436 well-known application that uses application-level locking is Microsoft Access. Detailed guidance
1437 is provided here because this is the most common application for which problems have been reported.
1438 </para>
1440 <para><indexterm>
1441 <primary>Microsoft Excel</primary>
1442 </indexterm><indexterm>
1443 <primary>Act!</primary>
1444 </indexterm>
1445 Common applications that are affected by client- and server-side locking controls include MS
1446 Excel and Act!. Important locking guidance is provided here.
1447 </para>
1450 <sect2>
1451 <title>Microsoft Access</title>
1453 <para>
1454 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that
1455 cover this area. Examples of relevant documents include:
1456 </para>
1458 <itemizedlist>
1459 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem>
1460 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem>
1461 </itemizedlist>
1464 <para><indexterm>
1465 <primary>multi-user</primary>
1466 <secondary>access</secondary>
1467 </indexterm><indexterm>
1468 <primary>exclusive open</primary>
1469 </indexterm>
1470 Make sure that your MS Access database file is configured for multiuser access (not set for
1471 exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice>
1472 <guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu>
1473 </menuchoice>. Set network path to Default database folder: <filename>\\server\share\folder</filename>.
1474 </para>
1476 <para>
1477 You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>.
1478 Set:<indexterm>
1479 <primary>record locking</primary>
1480 </indexterm>
1481 </para>
1483 <itemizedlist>
1484 <listitem><para>Default open mode: Shared</para></listitem>
1485 <listitem><para>Default Record Locking: Edited Record</para></listitem>
1486 <listitem><para>Open databases using record_level locking</para></listitem>
1487 </itemizedlist>
1489 <para><indexterm>
1490 <primary>MS Access</primary>
1491 <secondary>validate</secondary>
1492 </indexterm>
1493 You must now commit the changes so that they will take effect. To do so, click
1494 <guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart
1495 it, and then validate that these settings have not changed.
1496 </para>
1498 </sect2>
1500 <sect2>
1501 <title>Act! Database Sharing</title>
1503 <para><indexterm>
1504 <primary>ACT! database</primary>
1505 </indexterm><indexterm>
1506 <primary>data corruption</primary>
1507 </indexterm>
1508 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you
1509 must disable opportunistic locking on the server and all workstations. Failure to do so
1510 results in data corruption. This information is available from the Act! Web site
1511 knowledgebase articles
1512 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink>
1513 as well as from article
1514 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>.
1515 </para>
1517 <para><indexterm>
1518 <primary>opportunistic locking</primary>
1519 </indexterm><indexterm>
1520 <primary>Act!Diag</primary>
1521 </indexterm>
1522 These documents clearly state that opportunistic locking must be disabled on both
1523 the server (Samba in the case we are interested in here), as well as on every workstation
1524 from which the centrally shared Act! database will be accessed. Act! provides
1525 a tool called <command>Act!Diag</command> that may be used to disable all workstation
1526 registry settings that may otherwise interfere with the operation of Act!
1527 Registered Act! users may download this utility from the Act! Web
1528 <ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink>
1529 </para>
1531 </sect2>
1533 <sect2>
1534 <title>Opportunistic Locking Controls</title>
1536 <para><indexterm>
1537 <primary>file caching</primary>
1538 </indexterm>
1539 Third-party Windows applications may not be compatible with the use of opportunistic file
1540 and record locking. For applications that are known not to be compatible,<footnote>Refer to
1541 the application manufacturer's installation guidelines and knowledge base for specific
1542 information regarding compatibility. It is often safe to assume that if the software
1543 manufacturer does not specifically mention incompatibilities with opportunistic file
1544 and record locking, or with Windows client file caching, the application is probably
1545 compatible with Windows (as well as Samba) default settings.</footnote> oplock
1546 support may need to be disabled both on the Samba server and on the Windows workstations.
1547 </para>
1549 <para><indexterm>
1550 <primary>cache</primary>
1551 </indexterm><indexterm>
1552 <primary>write lock</primary>
1553 </indexterm><indexterm>
1554 <primary>flush</primary>
1555 <secondary>cache memory</secondary>
1556 </indexterm>
1557 Oplocks enable a Windows client to cache parts of a file that are being
1558 edited. Another windows client may then request to open the file with the
1559 ability to write to it. The server will then ask the original workstation
1560 that had the file open with a write lock to release its lock. Before
1561 doing so, that workstation must flush the file from cache memory to the
1562 disk or network drive.
1563 </para>
1565 <para><indexterm>
1566 <primary>Oplocks</primary>
1567 <secondary>disabled</secondary>
1568 </indexterm>
1569 Disabling of Oplocks usage may require server and client changes.
1570 Oplocks may be disabled by file, by file pattern, on the share, or on the
1571 Samba server.
1572 </para>
1574 <para>
1575 The following are examples showing how Oplock support may be managed using
1576 Samba &smb.conf; file settings:
1577 <screen>
1578 By file: veto oplock files = myfile.mdb
1580 By Pattern: veto oplock files = /*.mdb/
1582 On the Share: oplocks = No
1583 level2 oplocks = No
1585 On the server:
1586 (in [global]) oplocks = No
1587 level2 oplocks = No
1588 </screen>
1589 </para>
1591 <para>
1592 The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4
1593 workstation clients must be configured as shown here:
1594 <screen>
1595 REGEDIT4
1597 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1598 Services\LanmanServer\Parameters]
1599 "EnableOplocks"=dword:00000000
1601 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1602 Services\LanmanWorkstation\Parameters]
1603 "UseOpportunisticLocking"=dword:00000000
1604 </screen>
1605 </para>
1607 <para>
1608 Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13.
1609 The information in that chapter was obtained from a wide variety of sources.
1610 </para>
1612 </sect2>
1614 </sect1>
1616 </chapter>