| blob | fda931fa0ee3b96b6c975480750dc67bece4cf3f |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="Big500users">
4 <title>The 500-User Office</title>
6 <para>
7 The Samba-3 networking you explored in <link linkend="secure"/> covers the finer points of
8 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
9 implementation of a simple configuration of the services that are important adjuncts
10 to successful deployment of Samba.
11 </para>
13 <para>
14 An analysis of the history of postings to the Samba mailing list easily demonstrates
15 that the two most prevalent Samba problem areas are
16 </para>
18 <itemizedlist>
19 <listitem><para>
20 Defective resolution of a NetBIOS name to its IP address
21 </para></listitem>
23 <listitem><para>
24 Printing problems
25 </para></listitem>
27 </itemizedlist>
29 <para>
30 The exercises
31 so far in this book have focused on implementation of the simplest printing processes
32 involving no print job processing intelligence. In this chapter, you maintain
33 that same approach to printing, but <link linkend="happy"/> presents an opportunity
34 to make printing more complex for the administrator while making it easier for the user.
35 </para>
37 <para>
38 <indexterm><primary>WINS server</primary></indexterm>
39 <indexterm><primary>tdbsam</primary></indexterm>
40 <indexterm><primary>passdb backend</primary></indexterm>
41 <link linkend="secure"/> demonstrates operation of a DHCP server and a DNS server
42 as well as a central WINS server. You validated the operation of these services and
43 saw an effective implementation of a Samba domain controller using the
44 <parameter>tdbsam</parameter> passdb backend.
45 </para>
47 <para>
48 The objective of this chapter is to introduce more complex techniques that can be used to
49 improve manageability of Samba as networking needs grow. In this chapter, you implement
50 a distributed DHCP server environment, a distributed DNS server arrangement, a centralized
51 WINS server, and a centralized Samba domain controller.
52 </para>
54 <para>
55 A note of caution is important regarding the Samba configuration that is used in this
56 chapter. The use of a single domain controller on a routed, multisegment network is
57 a poor design choice that leads to potential network user complaints.
58 This chapter demonstrates some successful
59 techniques in deployment and configuration management. This should be viewed as a
60 foundation chapter for complex Samba deployments.
61 </para>
63 <para>
64 As you master the techniques presented here, you may find much better methods to
65 improve network management and control while reducing human resource overheads.
66 You should take the opportunity to innovate and expand on the methods presented
67 here and explore them to the fullest.
68 </para>
70 <sect1>
71 <title>Introduction</title>
73 <para>
74 Business continues to go well for Abmas. Mr. Meany is driving your success and the
75 network continues to grow thanks to the hard work Christine has done. You recently
76 hired Stanley Soroka as manager of information systems. Christine recommended Stan
77 to the role. She told you Stan is so good at handling Samba that he can make a cast
78 iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You
79 need skills like his. Christine and Stan get along just fine. Let's see what
80 you can get out of this pair as they plot the next-generation networks.
81 </para>
83 <para>
84 Ten months ago Abmas closed an acquisition of a property insurance business. The
85 founder lost interest in the business and decided to sell it to Mr. Meany. Because
86 they were former university classmates, the purchase was concluded with mutual assent.
87 The acquired business is located at the other end of town in much larger facilities.
88 The old Abmas building has become too small. Located on the same campus as the newly
89 acquired business are two empty buildings that are ideal to provide Abmas with
90 opportunity for growth.
91 </para>
93 <para>
94 Abmas has now completed the purchase of the two empty buildings, and you are
95 to install a new network and relocate staff in nicely furnished new facilities.
96 The new network is to be used to fully integrate company operations. You have
97 decided to locate the new network operations control center in the larger building
98 in which the insurance group is located to take advantage of an ideal floor space
99 and to allow Stan and Christine to fully stage the new network and test it before
100 it is rolled out. Your strategy is to complete the new network so that it
101 is ready for operation when the old office moves into the new premises.
102 </para>
104 <sect2>
105 <title>Assignment Tasks</title>
107 <para>
108 The acquired business had 280 network users. The old Abmas building housed
109 220 network users in unbelievably cramped conditions. The network that
110 initially served 130 users now handles 220 users quite well.
111 </para>
113 <para>
114 The two businesses will be fully merged to create a single campus company.
115 The Property Insurance Group (PIG) houses 300 employees, the new Accounting
116 Services Group (ASG) will be in a small building (BLDG1) that houses 50
117 employees, and the Financial Services Group (FSG) will be housed in a large
118 building that has capacity for growth (BLDG2). Building 2 houses 150 network
119 users.
120 </para>
122 <para>
123 You have decided to connect the building using fiber optic links between new
124 routers. As a backup, the buildings are interconnected using line-of-sight
125 high-speed infrared facilities. The infrared connection provides a
126 secondary route to be used during periods of high demand for network
127 bandwidth.
128 </para>
130 <para>
131 The Internet gateway is upgraded to 15 Mb/sec service. Your ISP
132 provides on your premises a fully managed Cisco PIX firewall. You no longer need
133 to worry about firewall facilities on your network.
134 </para>
136 <para>
137 Stanley and Christine have purchased new server hardware. Christine wants to
138 roll out a network that has whistles and bells. Stan wants to start off with
139 a simple to manage, not-too-complex network. He believes that network
140 users need to be gradually introduced to new features and capabilities and not
141 rushed into an environment that may cause disorientation and loss of productivity.
142 </para>
144 <para>
145 Your intrepid network team has decided to implement a network configuration
146 that closely mirrors the successful system you installed in the old Abmas building.
147 The new network infrastructure is owned by Abmas, but all desktop systems
148 are being procured through a new out-source services and leasing company. Under
149 the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides
150 all desktop systems and includes full level-one help desk support for
151 a flat per-machine monthly fee. The deal allows you to add workstations on demand.
152 This frees Stan and Christine to deal with deeper issues as they emerge and
153 permits Stan to work on creating new future value-added services.
154 </para>
156 <para>
157 DirectPointe Inc. receives from you a new standard desktop configuration
158 every four months. They automatically roll that out to each desktop system.
159 You must keep DirectPointe informed of all changes.
160 </para>
162 <para><indexterm>
163 <primary>PDC</primary>
164 </indexterm>
165 The new network has a single Samba Primary Domain Controller (PDC) located in the
166 Network Operation Center (NOC). Buildings 1 and 2 each have a local server
167 for local application servicing. It is a domain member. The new system
168 uses the <parameter>tdbsam</parameter> passdb backend.
169 </para>
171 <para>
172 Printing is based on raw pass-through facilities just as it has been used so far.
173 All printer drivers are installed on the desktop and notebook computers.
174 </para>
176 </sect2>
177 </sect1>
179 <sect1>
180 <title>Dissection and Discussion</title>
182 <para>
183 <indexterm><primary>network load factors</primary></indexterm>
184 The example you are building in this chapter is of a network design that works, but this
185 does not make it a design that is recommended. As a general rule, there should be at least
186 one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind
187 this recommendation is that correct operation of MS Windows clients requires rapid
188 network response to all SMB/CIFS requests. The same rule says that if there are more than
189 50 clients per domain controller, they are too busy to service requests. Let's put such
190 rules aside and recognize that network load affects the integrity of domain controller
191 responsiveness. This network will have 500 clients serviced by one central domain
192 controller. This is not a good omen for user satisfaction. You, of course, address this
193 very soon (see <link linkend="happy"/>).
194 </para>
196 <sect2>
197 <title>Technical Issues</title>
199 <para>
200 Stan has talked you into a horrible compromise, but it is addressed. Just make
201 certain that the performance of this network is well validated before going live.
202 </para>
204 <para>
205 Design decisions made in this design include the following:
206 </para>
208 <itemizedlist>
209 <listitem><para>
210 <indexterm><primary>PDC</primary></indexterm>
211 <indexterm><primary>LDAP</primary></indexterm>
212 <indexterm><primary>identity management</primary></indexterm>
213 A single PDC is being implemented. This limitation is based on the choice not to
214 use LDAP. Many network administrators fear using LDAP because of the perceived
215 complexity of implementation and management of an LDAP-based backend for all user
216 identity management as well as to store network access credentials.
217 </para></listitem>
219 <listitem><para>
220 <indexterm><primary>BDC</primary></indexterm>
221 <indexterm><primary>machine secret password</primary></indexterm>
222 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the
223 only choice that makes sense with 500 users is to use the tdbsam passwd backend.
224 This type of backend is not receptive to replication to BDCs. If the tdbsam
225 <filename>passdb.tdb</filename> file is replicated to BDCs using
226 <command>rsync</command>, there are two potential problems: (1) data that is in
227 memory but not yet written to disk will not be replicated, and (2) domain member
228 machines periodically change the secret machine password. When this happens, there
229 is no mechanism to return the changed password to the PDC.
230 </para></listitem>
232 <listitem><para>
233 All domain user, group, and machine accounts are managed on the PDC. This makes
234 for a simple mode of operation but has to be balanced with network performance and
235 integrity of operations considerations.
236 </para></listitem>
238 <listitem><para>
239 <indexterm><primary>WINS</primary></indexterm>
240 A single central WINS server is being used. The PDC is also the WINS server.
241 Any attempt to operate a routed network without a WINS server while using NetBIOS
242 over TCP/IP protocols does not work unless on each client the name resolution
243 entries for the PDC are added to the <filename>LMHOSTS</filename>. This file is
244 normally located on the Windows XP Professional client in the
245 <filename>C:\WINDOWS\SYSTEM32\ETC\DRIVERS</filename> directory.
246 </para></listitem>
248 <listitem><para>
249 At this time the Samba WINS database cannot be replicated. That is
250 why a single WINS server is being implemented. This should work without a problem.
251 </para></listitem>
253 <listitem><para>
254 <indexterm><primary>winbindd</primary></indexterm>
255 BDCs make use of <command>winbindd</command> to provide
256 access to domain security credentials for file system access and object storage.
257 </para></listitem>
259 <listitem><para>
260 <indexterm><primary>DHCP</primary><secondary>relay</secondary></indexterm>
261 <indexterm><primary>DHCP</primary><secondary>requests</secondary></indexterm>
262 Configuration of Windows XP Professional clients is achieved using DHCP. Each
263 subnet has its own DHCP server. Backup DHCP serving is provided by one
264 alternate DHCP server. This necessitates enabling of the DHCP Relay agent on
265 all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the
266 network directed at the backup DHCP server.
267 </para></listitem>
269 <listitem><para>
270 All network users are granted the ability to print to any printer that is
271 network-attached. All printers are available from each server. Print jobs that
272 are spooled to a printer that is not on the local network segment are automatically
273 routed to the print spooler that is in control of that printer. The specific details
274 of how this might be done are demonstrated for one example only.
275 </para></listitem>
277 <listitem><para>
278 The network address and subnetmask chosen provide 1022 usable IP addresses in
279 each subnet. If in the future more addresses are required, it would make sense
280 to add further subnets rather than change addressing.
281 </para></listitem>
283 </itemizedlist>
285 </sect2>
288 <sect2>
289 <title>Political Issues</title>
291 <para>
292 This case gets close to the real world. You and I know the right way to implement
293 domain control. Politically, we have to navigate a minefield. In this case, the need is to
294 get the PDC rolled out in compliance with expectations and also to be ready to save the day
295 by having the real solution ready before it is needed. That real solution is presented in
296 <link linkend="happy"/>.
297 </para>
299 </sect2>
301 </sect1>
303 <sect1>
304 <title>Implementation</title>
306 <para>
307 The following configuration process begins following installation of Red Hat Fedora Core2 on the
308 three servers shown in the network topology diagram in <link linkend="chap05net"/>. You have
309 selected hardware that is appropriate to the task.
310 </para>
312 <figure id="chap05net">
313 <title>Network Topology &smbmdash; 500 User Network Using tdbsam passdb backend.</title>
314 <imagefile scale="50">chap5-net</imagefile>
315 </figure>
317 <sect2 id="ch5-dnshcp-setup">
318 <title>Installation of DHCP, DNS, and Samba Control Files</title>
320 <para>
321 Carefully install the configuration files into the correct locations as shown in
322 <link linkend="ch5-filelocations"/>. You should validate that the full file path is
323 correct as shown.
324 </para>
326 <para>
327 The abbreviation shown in this table as <constant>{VLN}</constant> refers to
328 the directory location beginning with <filename>/var/lib/named</filename>.
329 </para>
332 <table id="ch5-filelocations"><title>Domain: <constant>MEGANET</constant>, File Locations for Servers</title>
333 <tgroup cols="5">
334 <colspec colname='c1' align="left"/>
335 <colspec colname='c2' align="left"/>
336 <colspec colname='c3' align="center"/>
337 <colspec colname='c4' align="center"/>
338 <colspec colname='c5' align="center"/>
339 <thead>
340 <row>
341 <entry align="center" namest='c1' nameend='c2'>File Information</entry>
342 <entry align="center" namest="c3" nameend="c5">Server Name</entry>
343 </row>
344 <row>
345 <entry align="center">Source</entry>
346 <entry align="center">Target Location</entry>
347 <entry align="center">MASSIVE</entry>
348 <entry align="center">BLDG1</entry>
349 <entry align="center">BLDG2</entry>
350 </row>
351 </thead>
352 <tbody>
353 <row>
354 <entry><link linkend="ch5-massivesmb"/></entry>
355 <entry><filename>/etc/samba/smb.conf</filename></entry>
356 <entry>Yes</entry>
357 <entry>No</entry>
358 <entry>No</entry>
359 </row>
360 <row>
361 <entry><link linkend="ch5-dc-common"/></entry>
362 <entry><filename>/etc/samba/dc-common.conf</filename></entry>
363 <entry>Yes</entry>
364 <entry>No</entry>
365 <entry>No</entry>
366 </row>
367 <row>
368 <entry><link linkend="ch5-commonsmb"/></entry>
369 <entry><filename>/etc/samba/common.conf</filename></entry>
370 <entry>Yes</entry>
371 <entry>Yes</entry>
372 <entry>Yes</entry>
373 </row>
374 <row>
375 <entry><link linkend="ch5-bldg1-smb"/></entry>
376 <entry><filename>/etc/samba/smb.conf</filename></entry>
377 <entry>No</entry>
378 <entry>Yes</entry>
379 <entry>No</entry>
380 </row>
381 <row>
382 <entry><link linkend="ch5-bldg2-smb"/></entry>
383 <entry><filename>/etc/samba/smb.conf</filename></entry>
384 <entry>No</entry>
385 <entry>No</entry>
386 <entry>Yes</entry>
387 </row>
388 <row>
389 <entry><link linkend="ch5-dommem-smb"/></entry>
390 <entry><filename>/etc/samba/dommem.conf</filename></entry>
391 <entry>No</entry>
392 <entry>Yes</entry>
393 <entry>Yes</entry>
394 </row>
395 <row>
396 <entry><link linkend="massive-dhcp"/></entry>
397 <entry><filename>/etc/dhcpd.conf</filename></entry>
398 <entry>Yes</entry>
399 <entry>No</entry>
400 <entry>No</entry>
401 </row>
402 <row>
403 <entry><link linkend="bldg1dhcp"/></entry>
404 <entry><filename>/etc/dhcpd.conf</filename></entry>
405 <entry>No</entry>
406 <entry>Yes</entry>
407 <entry>No</entry>
408 </row>
409 <row>
410 <entry><link linkend="bldg2dhcp"/></entry>
411 <entry><filename>/etc/dhcpd.conf</filename></entry>
412 <entry>No</entry>
413 <entry>No</entry>
414 <entry>Yes</entry>
415 </row>
416 <row>
417 <entry><link linkend="massive-nameda"/></entry>
418 <entry><filename>/etc/named.conf (part A)</filename></entry>
419 <entry>Yes</entry>
420 <entry>No</entry>
421 <entry>No</entry>
422 </row>
423 <row>
424 <entry><link linkend="massive-namedb"/></entry>
425 <entry><filename>/etc/named.conf (part B)</filename></entry>
426 <entry>Yes</entry>
427 <entry>No</entry>
428 <entry>No</entry>
429 </row>
430 <row>
431 <entry><link linkend="massive-namedc"/></entry>
432 <entry><filename>/etc/named.conf (part C)</filename></entry>
433 <entry>Yes</entry>
434 <entry>No</entry>
435 <entry>No</entry>
436 </row>
437 <row>
438 <entry><link linkend="abmasbizdns"/></entry>
439 <entry><filename>{VLN}/master/abmas.biz.hosts</filename></entry>
440 <entry>Yes</entry>
441 <entry>No</entry>
442 <entry>No</entry>
443 </row>
444 <row>
445 <entry><link linkend="abmasusdns"/></entry>
446 <entry><filename>{VLN}/master/abmas.us.hosts</filename></entry>
447 <entry>Yes</entry>
448 <entry>No</entry>
449 <entry>No</entry>
450 </row>
451 <row>
452 <entry><link linkend="bldg12nameda"/></entry>
453 <entry><filename>/etc/named.conf (part A)</filename></entry>
454 <entry>No</entry>
455 <entry>Yes</entry>
456 <entry>Yes</entry>
457 </row>
458 <row>
459 <entry><link linkend="bldg12namedb"/></entry>
460 <entry><filename>/etc/named.conf (part B)</filename></entry>
461 <entry>No</entry>
462 <entry>Yes</entry>
463 <entry>Yes</entry>
464 </row>
465 <row>
466 <entry><link linkend="loopback"/></entry>
467 <entry><filename>{VLN}/localhost.zone</filename></entry>
468 <entry>Yes</entry>
469 <entry>Yes</entry>
470 <entry>Yes</entry>
471 </row>
472 <row>
473 <entry><link linkend="dnsloopy"/></entry>
474 <entry><filename>{VLN}/127.0.0.zone</filename></entry>
475 <entry>Yes</entry>
476 <entry>Yes</entry>
477 <entry>Yes</entry>
478 </row>
479 <row>
480 <entry><link linkend="roothint"/></entry>
481 <entry><filename>{VLN}/root.hint</filename></entry>
482 <entry>Yes</entry>
483 <entry>Yes</entry>
484 <entry>Yes</entry>
485 </row>
486 </tbody>
487 </tgroup>
488 </table>
490 </sect2>
492 <sect2>
493 <title>Server Preparation: All Servers</title>
495 <para>
496 The following steps apply to all servers. Follow each step carefully.
497 </para>
499 <procedure>
500 <title>Server Preparation Steps</title>
502 <step><para>
503 Using the UNIX/Linux system tools, set the name of the server as shown in the network
504 topology diagram in <link linkend="chap05net"/>. For SUSE Linux products, the tool
505 that permits this is called <command>yast2</command>; for Red Hat Linux products,
506 you can use the <command>netcfg</command> tool.
507 Verify that your hostname is correctly set by running:
508 <screen>
509 &rootprompt; uname -n
510 </screen>
511 An alternate method to verify the hostname is:
512 <screen>
513 &rootprompt; hostname -f
514 </screen>
515 </para></step>
517 <step><para>
518 <indexterm><primary>/etc/hosts</primary></indexterm>
519 <indexterm><primary>named</primary></indexterm>
520 Edit your <filename>/etc/hosts</filename> file to include the primary names and addresses
521 of all network interfaces that are on the host server. This is necessary so that during
522 startup the system is able to resolve all its own names to the IP address prior to
523 startup of the DNS server. You should check the startup order of your system. If the
524 CUPS print server is started before the DNS server (<command>named</command>), you
525 should also include an entry for the printers in the <filename>/etc/hosts</filename> file.
526 </para></step>
528 <step><para>
529 <indexterm><primary>/etc/resolv.conf</primary></indexterm>
530 All DNS name resolution should be handled locally. To ensure that the server is configured
531 correctly to handle this, edit <filename>/etc/resolv.conf</filename> so it has the following
532 content:
533 <screen>
534 search abmas.us abmas.biz
535 nameserver 127.0.0.1
536 </screen>
537 This instructs the name resolver function (when configured correctly) to ask the DNS server
538 that is running locally to resolve names to addresses.
539 </para></step>
542 <step><para>
543 <indexterm><primary>administrator</primary></indexterm>
544 <indexterm><primary>smbpasswd</primary></indexterm>
545 Add the <constant>root</constant> user to the password backend:
546 <screen>
547 &rootprompt; smbpasswd -a root
548 New SMB password: XXXXXXXX
549 Retype new SMB password: XXXXXXXX
550 &rootprompt;
551 </screen>
552 The <constant>root</constant> account is the UNIX equivalent of the Windows domain administrator.
553 This account is essential in the regular maintenance of your Samba server. It must never be
554 deleted. If for any reason the account is deleted, you may not be able to recreate this account
555 without considerable trouble.
556 </para></step>
558 <step><para>
559 <indexterm><primary>username map</primary></indexterm>
560 <indexterm><primary>/etc/samba/smbusers</primary></indexterm>
561 Create the username map file to permit the <constant>root</constant> account to be called
562 <constant>Administrator</constant> from the Windows network environment. To do this, create
563 the file <filename>/etc/samba/smbusers</filename> with the following contents:
564 <screen>
565 ####
566 # User mapping file
567 ####
568 # File Format
569 # -----------
570 # Unix_ID = Windows_ID
571 #
572 # Examples:
573 # root = Administrator
574 # janes = "Jane Smith"
575 # jimbo = Jim Bones
576 #
577 # Note: If the name contains a space it must be double quoted.
578 # In the example above the name 'jimbo' will be mapped to Windows
579 # user names 'Jim' and 'Bones' because the space was not quoted.
580 #######################################################################
581 root = Administrator
582 ####
583 # End of File
584 ####
585 </screen>
586 </para></step>
588 <step><para>
589 Configure all network-attached printers to have a fixed IP address.
590 </para></step>
592 <step><para>
593 Create an entry in the DNS database on the server <constant>MASSIVE</constant>
594 in both the forward lookup database for the zone <constant>abmas.biz.hosts</constant>
595 and in the reverse lookup database for the network segment that the printer is
596 located in. Example configuration files for similar zones were presented in <link linkend="secure"/>,
597 <link linkend="abmasbiz"/> and <link linkend="eth2zone"/>.
598 </para></step>
600 <step><para>
601 Follow the instructions in the printer manufacturer's manuals to permit printing
602 to port 9100. Use any other port the manufacturer specifies for direct mode,
603 raw printing. This allows the CUPS spooler to print using raw mode protocols.
604 <indexterm><primary>CUPS</primary></indexterm>
605 <indexterm><primary>raw printing</primary></indexterm>
606 </para></step>
608 <step><para>
609 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
610 Only on the server to which the printer is attached configure the CUPS Print
611 Queues as follows:
612 <screen>
613 &rootprompt; lpadmin -p <parameter>printque</parameter> -v socket://<parameter>printer-name</parameter>.abmas.biz:9100 -E
614 </screen>
615 <indexterm><primary>print filter</primary></indexterm>
616 This step creates the necessary print queue to use no assigned print filter. This
617 is ideal for raw printing, that is, printing without use of filters.
618 The name <parameter>printque</parameter> is the name you have assigned for
619 the particular printer.
620 </para></step>
622 <step><para>
623 Print queues may not be enabled at creation. Make certain that the queues
624 you have just created are enabled by executing the following:
625 <screen>
626 &rootprompt; /usr/bin/enable <parameter>printque</parameter>
627 </screen>
628 </para></step>
630 <step><para>
631 Even though your print queue may be enabled, it is still possible that it
632 does not accept print jobs. A print queue services incoming printing
633 requests only when configured to do so. Ensure that your print queue is
634 set to accept incoming jobs by executing the following command:
635 <screen>
636 &rootprompt; /usr/bin/accept <parameter>printque</parameter>
637 </screen>
638 </para></step>
640 <step><para>
641 <indexterm><primary>mime type</primary></indexterm>
642 <indexterm><primary>/etc/mime.convs</primary></indexterm>
643 <indexterm><primary>application/octet-stream</primary></indexterm>
644 This step, as well as the next one, may be omitted where CUPS version 1.1.18
645 or later is in use. Although it does no harm to follow it anyhow, and may
646 help to avoid later time spent trying to figure out why print jobs may be
647 disappearing without trace. Look at these two steps as <emphasis>insurance</emphasis>
648 against lost time. Edit file <filename>/etc/cups/mime.convs</filename> to
649 uncomment the line:
650 <screen>
651 application/octet-stream application/vnd.cups-raw 0 -
652 </screen>
653 </para></step>
655 <step><para>
656 <indexterm><primary>/etc/mime.types</primary></indexterm>
657 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
658 <screen>
659 application/octet-stream
660 </screen>
661 </para></step>
663 <step><para>
664 Refer to the CUPS printing manual for instructions regarding how to configure
665 CUPS so that print queues that reside on CUPS servers on remote networks
666 route print jobs to the print server that owns that queue. The default setting
667 on your CUPS server may automatically discover remotely installed printers and
668 may permit this functionality without requiring specific configuration.
669 </para></step>
671 <step><para>
672 As part of the roll-out program, you need to configure the application's
673 server shares. This can be done once on the central server and may then be
674 replicated using a tool such as <command>rsync</command>. Refer to the man
675 page for <command>rsync</command> for details regarding use. The notes in
676 <link linkend="ch4appscfg"/> may help in your decisions to use an application
677 server facility.
678 </para></step>
680 </procedure>
682 <note><para>
683 Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent
684 processes to automap Windows client drives to an application server that is nearest to the client. This
685 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
686 as elegantly as you see in the next chapter.
687 </para></note>
689 </sect2>
691 <sect2>
692 <title>Server-Specific Preparation</title>
694 <para>
695 There are some steps that apply to particular server functionality only. Each step is critical
696 to correct server operation. The following step-by-step installation guidance will assist you
697 to work through the process of configuring the PDC and then both BDC's.
698 </para>
700 <sect3>
701 <title>Configuration for Server: <constant>MASSIVE</constant></title>
703 <para>
704 The steps presented here attempt to implement Samba installation in a generic manner. While
705 some steps are clearly specific to Linux, it should not be too difficult to apply them to
706 your platform of choice.
707 </para>
709 <procedure>
710 <title>Primary Domain Controller Preparation</title>
712 <step><para>
713 <indexterm><primary>/etc/rc.d/boot.local</primary></indexterm>
714 <indexterm><primary>IP forwarding</primary></indexterm>
715 The host server acts as a router between the two internal network segments as well
716 as for all Internet access. This necessitates that IP forwarding be enabled. This can be
717 achieved by adding to the <filename>/etc/rc.d/boot.local</filename> an entry as follows:
718 <screen>
719 echo 1 > /proc/sys/net/ipv4/ip_forward
720 </screen>
721 To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute
722 that command manually also. This setting permits the Linux system to act as a router.
723 </para></step>
725 <step><para>
726 This server is dual hosted (i.e., has two network interfaces) &smbmdash; one goes to the Internet
727 and the other to a local network that has a router that is the gateway to the remote networks.
728 You must therefore configure the server with route table entries so that it can find machines
729 on the remote networks. You can do this using the appropriate system tools for your Linux
730 server or using static entries that you place in one of the system startup files. It is best
731 to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the
732 best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat,
733 this is best done using the graphical system configuration tools (see the Red Hat documentation).
734 An example of how this may be done manually is as follows:
735 <screen>
736 &rootprompt; route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128
737 &rootprompt; route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128
738 </screen>
739 If you just execute these commands manually, the route table entries you have created are
740 not persistent across system reboots. You may add these commands directly to the local
741 startup files as follows: (SUSE) <filename>/etc/rc.d/boot.local</filename>, (Red Hat)
742 <filename>/etc/rc.d/init.d/rc.local</filename>.
743 </para></step>
745 <step><para>
746 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
747 The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
748 This file controls the operation of the various resolver libraries that are part of the Linux
749 Glibc libraries. Edit this file so that it contains the following entries:
750 <screen>
751 hosts: files dns wins
752 </screen>
753 </para></step>
755 <step><para>
756 <indexterm><primary>initGrps.sh</primary></indexterm>
757 Create and map Windows domain groups to UNIX groups. A sample script is provided in
758 <link linkend="ch5-initgrps"/>. Create a file containing this script. You called yours
759 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed
760 and then execute the script. An example of the execution of this script as well as its
761 validation are shown in Section 4.3.2, Step 5.
762 </para></step>
764 <step><para>
765 <indexterm><primary>/etc/passwd</primary></indexterm>
766 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
767 <indexterm><primary>smbpasswd</primary></indexterm>
768 For each user who needs to be given a Windows domain account, make an entry in the
769 <filename>/etc/passwd</filename> file as well as in the Samba password backend.
770 Use the system tool of your choice to create the UNIX system account, and use the Samba
771 <command>smbpasswd</command> to create a domain user account.
772 </para>
774 <para>
775 <indexterm><primary>useradd</primary></indexterm>
776 <indexterm><primary>adduser</primary></indexterm>
777 <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
778 There are a number of tools for user management under UNIX, such as
779 <command>useradd</command>, <command>adduser</command>, as well as a plethora of custom
780 tools. With the tool of your choice, create a home directory for each user.
781 </para></step>
783 <step><para>
784 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
785 previously as necessary. File system access control is based on UNIX group membership.
786 </para></step>
788 <step><para>
789 Create the directory mount point for the disk subsystem that is to be mounted to provide
790 data storage for company files, in this case, the mount point indicated in the &smb.conf;
791 file is <filename>/data</filename>. Format the file system as required and mount the formatted
792 file system partition using appropriate system tools.
793 </para></step>
795 <step><para>
796 <indexterm><primary>file system</primary>
797 <secondary>permissions</secondary></indexterm>
798 Create the top-level file storage directories for data and applications as follows:
799 <screen>
800 &rootprompt; mkdir -p /data/{accounts,finsvcs,pidata}
801 &rootprompt; mkdir -p /apps
802 &rootprompt; chown -R root:root /data
803 &rootprompt; chown -R root:root /apps
804 &rootprompt; chown -R bjordan:accounts /data/accounts
805 &rootprompt; chown -R bjordan:finsvcs /data/finsvcs
806 &rootprompt; chown -R bjordan:finsvcs /data/pidata
807 &rootprompt; chmod -R ug+rwxs,o-rwx /data
808 &rootprompt; chmod -R ug+rwx,o+rx-w /apps
809 </screen>
810 Each department is responsible for creating its own directory structure within the departmental
811 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
812 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
813 The <filename>/apps</filename> directory is the root of the <constant>apps</constant> share
814 that provides the application server infrastructure.
815 </para></step>
817 <step><para>
818 The &smb.conf; file specifies an infrastructure to support roaming profiles and network
819 logon services. You can now create the file system infrastructure to provide the
820 locations on disk that these services require. Adequate planning is essential
821 because desktop profiles can grow to be quite large. For planning purposes, a minimum of
822 200 MB of storage should be allowed per user for profile storage. The following
823 commands create the directory infrastructure needed:
824 <screen>
825 &rootprompt; mkdir -p /var/spool/samba
826 &rootprompt; mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
827 &rootprompt; chown -R root:root /var/spool/samba
828 &rootprompt; chown -R root:root /var/lib/samba
829 &rootprompt; chmod a+rwxt /var/spool/samba
830 </screen>
831 For each user account that is created on the system, the following commands should be
832 executed:
833 <screen>
834 &rootprompt; mkdir /var/lib/samba/profiles/'username'
835 &rootprompt; chown 'username':users /var/lib/samba/profiles/'username'
836 &rootprompt; chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
837 </screen>
838 </para></step>
840 <step><para>
841 <indexterm><primary>unix2dos</primary></indexterm>
842 <indexterm><primary>dos2unix</primary></indexterm>
843 Create a logon script. It is important that each line is correctly terminated with
844 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
845 works if the right tools (<constant>unxi2dos</constant> and <constant>dos2unix</constant>) are installed.
846 First, create a file called <filename>/var/lib/samba/netlogon/scripts/logon.bat.unix</filename>
847 with the following contents:
848 <screen>
849 net time \\massive /set /yes
850 net use h: /home
851 </screen>
852 Convert the UNIX file to a DOS file:
853 <screen>
854 &rootprompt; dos2unix < /var/lib/samba/netlogon/scripts/logon.bat.unix \
855 > /var/lib/samba/netlogon/scripts/logon.bat
856 </screen>
857 </para></step>
859 <step><para>
860 There is one preparatory step without which you cannot have a working Samba network
861 environment. You must add an account for each network user. You can do this by executing
862 the following steps for each user:
863 <screen>
864 &rootprompt; useradd -m <parameter>username</parameter>
865 &rootprompt; passwd <parameter>username</parameter>
866 Changing password for <parameter>username</parameter>.
867 New password: XXXXXXXX
868 Re-enter new password: XXXXXXXX
869 Password changed
870 &rootprompt; smbpasswd -a <parameter>username</parameter>
871 New SMB password: XXXXXXXX
872 Retype new SMB password: XXXXXXXX
873 Added user <parameter>username</parameter>.
874 </screen>
875 You do, of course, use a valid user login ID in place of <parameter>username</parameter>.
876 </para></step>
878 <step><para>
879 Follow the processes shown in <link linkend="ch5-procstart"/> to start all services.
880 </para></step>
882 <step><para>
883 Your server is ready for validation testing. Do not proceed with the steps in
884 <link linkend="ch5-domsvrspec"/> until after the operation of the server has been
885 validated following the same methods as outlined in <link linkend="secure"/>, <link linkend="ch4valid"/>.
886 </para></step>
888 </procedure>
890 </sect3>
892 <sect3 id="ch5-domsvrspec">
893 <title>Configuration Specific to Domain Member Servers: <constant>BLDG1, BLDG2</constant></title>
895 <para>
896 The following steps will guide you trough the nuances of imlplementing BDC's for the broadcast
897 isolated network segments. Remember that if the target installation platform is not Linux, it may
898 be necessary to adapt some commands to the equivalent on the target platform.
899 </para>
901 <procedure>
902 <title>Backup Domain Controller Configuration Steps</title>
904 <step><para>
905 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
906 The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
907 This file controls the operation of the various resolver libraries that are part of the Linux
908 Glibc libraries. Edit this file so that it contains the following entries:
909 <screen>
910 passwd: files winbind
911 group: files winbind
912 hosts: files dns wins
913 </screen>
914 </para></step>
916 <step><para>
917 Follow the steps outlined in <link linkend="ch5-procstart"/> to start all services. Do not
918 start Samba at this time. Samba is controlled by the process called <command>smb</command>.
919 </para></step>
921 <step><para>
922 <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
923 You must now attempt to join the domain member servers to the domain. The following
924 instructions should be executed to effect this:
925 <screen>
926 &rootprompt; net rpc join
927 </screen>
928 </para></step>
930 <step><para>
931 <indexterm><primary>service</primary><secondary>smb</secondary><tertiary>start</tertiary></indexterm>
932 You now start the Samba services by executing:
933 <screen>
934 &rootprompt; service smb start
935 </screen>
936 </para></step>
938 <step><para>
939 Your server is ready for validation testing. Do not proceed with the steps in
940 <link linkend="ch5-domsvrspec"/> until after the operation of the server has been
941 validated following the same methods as outlined in <link linkend="ch4valid"/>.
942 </para></step>
944 </procedure>
946 </sect3>
948 </sect2>
950 <!-- One -->
951 <example id="ch5-massivesmb">
952 <title>Server: MASSIVE (PDC), File: <filename>/etc/samba/smb.conf</filename></title>
953 <smbconfblock>
954 <smbconfcomment>Global parameters</smbconfcomment>
955 <smbconfsection name="[global]"/>
956 <smbconfoption name="workgroup">MEGANET</smbconfoption>
957 <smbconfoption name="netbios name">MASSIVE</smbconfoption>
958 <smbconfoption name="interfaces">eth1, lo</smbconfoption>
959 <smbconfoption name="bind interfaces only">Yes</smbconfoption>
960 <smbconfoption name="passdb backend">tdbsam</smbconfoption>
961 <smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
962 <smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
963 <smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
964 <smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
965 <smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
966 <smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption>
967 <smbconfoption name="preferred master">Yes</smbconfoption>
968 <smbconfoption name="wins support">Yes</smbconfoption>
969 <smbconfoption name="include">/etc/samba/dc-common.conf</smbconfoption>
971 <smbconfsection name="[IPC$]"/>
972 <smbconfoption name="path">/tmp</smbconfoption>
973 <smbconfoption name="hosts allow">172.16.0.0/16, 127.0.0.1</smbconfoption>
974 <smbconfoption name="hosts deny">0.0.0.0/0</smbconfoption>
976 <smbconfsection name="[accounts]"/>
977 <smbconfoption name="comment">Accounting Files</smbconfoption>
978 <smbconfoption name="path">/data/accounts</smbconfoption>
979 <smbconfoption name="read only">No</smbconfoption>
981 <smbconfsection name="[service]"/>
982 <smbconfoption name="comment">Financial Services Files</smbconfoption>
983 <smbconfoption name="path">/data/service</smbconfoption>
984 <smbconfoption name="read only">No</smbconfoption>
986 <smbconfsection name="[pidata]"/>
987 <smbconfoption name="comment">Property Insurance Files</smbconfoption>
988 <smbconfoption name="path">/data/pidata</smbconfoption>
989 <smbconfoption name="read only">No</smbconfoption>
990 </smbconfblock>
991 </example>
993 <!-- Two -->
994 <example id="ch5-dc-common">
995 <title>Server: MASSIVE (PDC), File: <filename>/etc/samba/dc-common.conf</filename></title>
996 <smbconfblock>
997 <smbconfcomment>Global parameters</smbconfcomment>
998 <smbconfsection name="[global]"/>
999 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1000 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1001 <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
1002 <smbconfoption name="logon path">\%L\profiles\%U</smbconfoption>
1003 <smbconfoption name="logon drive">X:</smbconfoption>
1004 <smbconfoption name="logon home">\%L\%U</smbconfoption>
1005 <smbconfoption name="domain logons">Yes</smbconfoption>
1006 <smbconfoption name="preferred master">Yes</smbconfoption>
1007 <smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
1009 <smbconfsection name="[homes]"/>
1010 <smbconfoption name="comment">Home Directories</smbconfoption>
1011 <smbconfoption name="valid users">%S</smbconfoption>
1012 <smbconfoption name="read only">No</smbconfoption>
1013 <smbconfoption name="browseable">No</smbconfoption>
1015 <smbconfsection name="[netlogon]"/>
1016 <smbconfoption name="comment">Network Logon Service</smbconfoption>
1017 <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
1018 <smbconfoption name="guest ok">Yes</smbconfoption>
1019 <smbconfoption name="locking">No</smbconfoption>
1021 <smbconfsection name="[profiles]"/>
1022 <smbconfoption name="comment">Profile Share</smbconfoption>
1023 <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
1024 <smbconfoption name="read only">No</smbconfoption>
1025 <smbconfoption name="profile acls">Yes</smbconfoption>
1026 </smbconfblock>
1027 </example>
1029 <!-- Three -->
1030 <example id="ch5-commonsmb">
1031 <title>Common Samba Configuration File: <filename>/etc/samba/common.conf</filename></title>
1032 <smbconfblock>
1033 <smbconfsection name="[global]"/>
1034 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
1035 <smbconfoption name="log level">1</smbconfoption>
1036 <smbconfoption name="syslog">0</smbconfoption>
1037 <smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
1038 <smbconfoption name="max log size">50</smbconfoption>
1039 <smbconfoption name="smb ports">139 445</smbconfoption>
1040 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
1041 <smbconfoption name="time server">Yes</smbconfoption>
1042 <smbconfoption name="printcap name">CUPS</smbconfoption>
1043 <smbconfoption name="show add printer wizard">No</smbconfoption>
1044 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1045 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1046 <smbconfoption name="utmp">Yes</smbconfoption>
1047 <smbconfoption name="map acl inherit">Yes</smbconfoption>
1048 <smbconfoption name="printing">cups</smbconfoption>
1049 <smbconfoption name="veto files">/*.eml/*.nws/*.{*}/</smbconfoption>
1050 <smbconfoption name="veto oplock files">/*.doc/*.xls/*.mdb/</smbconfoption>
1051 <smbconfoption name="include"> </smbconfoption>
1053 <smbconfcomment>Share and Service Definitions are common to all servers</smbconfcomment>
1054 <smbconfsection name="[printers]"/>
1055 <smbconfoption name="comment">SMB Print Spool</smbconfoption>
1056 <smbconfoption name="path">/var/spool/samba</smbconfoption>
1057 <smbconfoption name="guest ok">Yes</smbconfoption>
1058 <smbconfoption name="printable">Yes</smbconfoption>
1059 <smbconfoption name="use client driver">Yes</smbconfoption>
1060 <smbconfoption name="default devmode">Yes</smbconfoption>
1061 <smbconfoption name="browseable">No</smbconfoption>
1063 <smbconfsection name="[apps]"/>
1064 <smbconfoption name="comment">Application Files</smbconfoption>
1065 <smbconfoption name="path">/apps</smbconfoption>
1066 <smbconfoption name="admin users">bjordan</smbconfoption>
1067 <smbconfoption name="read only">No</smbconfoption>
1068 </smbconfblock>
1069 </example>
1071 <!-- Four -->
1072 <example id="ch5-bldg1-smb">
1073 <title>Server: BLDG1 (Member), File: smb.conf</title>
1074 <smbconfblock>
1075 <smbconfcomment>Global parameters</smbconfcomment>
1076 <smbconfsection name="[global]"/>
1077 <smbconfoption name="workgroup">MEGANET</smbconfoption>
1078 <smbconfoption name="netbios name">BLDG1</smbconfoption>
1079 <smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
1080 </smbconfblock>
1081 </example>
1083 <!-- Five -->
1084 <example id="ch5-bldg2-smb">
1085 <title>Server: BLDG2 (Member), File: smb.conf</title>
1086 <smbconfblock>
1087 <smbconfcomment>Global parameters</smbconfcomment>
1088 <smbconfsection name="[global]"/>
1089 <smbconfoption name="workgroup">MEGANET</smbconfoption>
1090 <smbconfoption name="netbios name">BLDG2</smbconfoption>
1091 <smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
1092 </smbconfblock>
1093 </example>
1095 <!-- Six -->
1096 <example id="ch5-dommem-smb">
1097 <title>Common Domain Member Include File: dom-mem.conf</title>
1098 <smbconfblock>
1099 <smbconfcomment>Global parameters</smbconfcomment>
1100 <smbconfsection name="[global]"/>
1101 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1102 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1103 <smbconfoption name="preferred master">Yes</smbconfoption>
1104 <smbconfoption name="wins server">172.16.0.1</smbconfoption>
1105 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
1106 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
1107 <smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
1108 </smbconfblock>
1109 </example>
1111 <!-- Seven -->
1112 <example id="massive-dhcp">
1113 <title>Server: MASSIVE, File: dhcpd.conf</title>
1114 <screen>
1115 # Abmas Accounting Inc.
1117 default-lease-time 86400;
1118 max-lease-time 172800;
1119 default-lease-time 86400;
1120 ddns-updates on;
1121 ddns-update-style interim;
1123 option ntp-servers 172.16.0.1;
1124 option domain-name "abmas.biz";
1125 option domain-name-servers 172.16.0.1, 172.16.4.1;
1126 option netbios-name-servers 172.16.0.1;
1127 option netbios-node-type 8;
1129 subnet 172.16.1.0 netmask 255.255.252.0 {
1130 range dynamic-bootp 172.16.1.0 172.16.2.255;
1131 option subnet-mask 255.255.252.0;
1132 option routers 172.16.0.1, 172.16.0.128;
1133 allow unknown-clients;
1134 }
1135 subnet 172.16.4.0 netmask 255.255.252.0 {
1136 range dynamic-bootp 172.16.7.0 172.16.7.254;
1137 option subnet-mask 255.255.252.0;
1138 option routers 172.16.4.128;
1139 allow unknown-clients;
1140 }
1141 subnet 172.16.8.0 netmask 255.255.252.0 {
1142 range dynamic-bootp 172.16.11.0 172.16.11.254;
1143 option subnet-mask 255.255.252.0;
1144 option routers 172.16.4.128;
1145 allow unknown-clients;
1146 }
1147 subnet 127.0.0.0 netmask 255.0.0.0 {
1148 }
1149 subnet 123.45.67.64 netmask 255.255.255.252 {
1150 }
1151 </screen>
1152 </example>
1154 <!-- Eight -->
1155 <example id="bldg1dhcp">
1156 <title>Server: BLDG1, File: dhcpd.conf</title>
1157 <screen>
1158 # Abmas Accounting Inc.
1160 default-lease-time 86400;
1161 max-lease-time 172800;
1162 default-lease-time 86400;
1163 ddns-updates on;
1164 ddns-update-style ad-hoc;
1166 option ntp-servers 172.16.0.1;
1167 option domain-name "abmas.biz";
1168 option domain-name-servers 172.16.0.1, 172.16.4.1;
1169 option netbios-name-servers 172.16.0.1;
1170 option netbios-node-type 8;
1172 subnet 172.16.1.0 netmask 255.255.252.0 {
1173 range dynamic-bootp 172.16.3.0 172.16.2.254;
1174 option subnet-mask 255.255.252.0;
1175 option routers 172.16.0.1, 172.16.0.128;
1176 allow unknown-clients;
1177 }
1178 subnet 172.16.4.0 netmask 255.255.252.0 {
1179 range dynamic-bootp 172.16.5.0 172.16.6.255;
1180 option subnet-mask 255.255.252.0;
1181 option routers 172.16.4.128;
1182 allow unknown-clients;
1183 }
1184 subnet 127.0.0.0 netmask 255.0.0.0 {
1185 }
1186 </screen>
1187 </example>
1189 <!-- Nine -->
1190 <example id="bldg2dhcp">
1191 <title>Server: BLDG2, File: dhcpd.conf</title>
1192 <screen>
1193 # Abmas Accounting Inc.
1195 default-lease-time 86400;
1196 max-lease-time 172800;
1197 default-lease-time 86400;
1198 ddns-updates on;
1199 ddns-update-style interim;
1201 option ntp-servers 172.16.0.1;
1202 option domain-name "abmas.biz";
1203 option domain-name-servers 172.16.0.1, 172.16.4.1;
1204 option netbios-name-servers 172.16.0.1;
1205 option netbios-node-type 8;
1207 subnet 172.16.8.0 netmask 255.255.252.0 {
1208 range dynamic-bootp 172.16.9.0 172.16.10.255;
1209 option subnet-mask 255.255.252.0;
1210 option routers 172.16.8.128;
1211 allow unknown-clients;
1212 }
1213 subnet 127.0.0.0 netmask 255.0.0.0 {
1214 }
1215 </screen>
1216 </example>
1218 <!-- Ten -->
1219 <example id="massive-nameda">
1220 <title>Server: MASSIVE, File: named.conf, Part: A</title>
1221 <screen>
1222 ###
1223 # Abmas Biz DNS Control File
1224 ###
1225 # Date: November 15, 2003
1226 ###
1227 options {
1228 directory "/var/lib/named";
1229 forwarders {
1230 123.45.12.23;
1231 123.45.54.32;
1232 };
1233 forward first;
1234 listen-on {
1235 mynet;
1236 };
1237 auth-nxdomain yes;
1238 multiple-cnames yes;
1239 notify no;
1240 };
1242 zone "." in {
1243 type hint;
1244 file "root.hint";
1245 };
1247 zone "localhost" in {
1248 type master;
1249 file "localhost.zone";
1250 };
1252 zone "0.0.127.in-addr.arpa" in {
1253 type master;
1254 file "127.0.0.zone";
1255 };
1257 acl mynet {
1258 172.16.0.0/24;
1259 172.16.4.0/24;
1260 172.16.8.0/24;
1261 127.0.0.1;
1262 };
1264 acl seconddns {
1265 123.45.54.32;
1266 }
1267 </screen>
1268 </example>
1270 <!-- Eleven -->
1271 <example id="massive-namedb">
1272 <title>Server: MASSIVE, File: named.conf, Part: B</title>
1273 <screen>
1274 zone "abmas.biz" {
1275 type master;
1276 file "/var/lib/named/master/abmas.biz.hosts";
1277 allow-query {
1278 mynet;
1279 };
1280 allow-transfer {
1281 mynet;
1282 };
1283 allow-update {
1284 mynet;
1285 };
1286 };
1288 zone "abmas.us" {
1289 type master;
1290 file "/var/lib/named/master/abmas.us.hosts";
1291 allow-query {
1292 all;
1293 };
1294 allow-transfer {
1295 seconddns;
1296 };
1297 };
1298 </screen>
1299 </example>
1301 <!-- Twelve -->
1302 <example id="massive-namedc">
1303 <title>Server: MASSIVE, File: named.conf, Part: C</title>
1304 <screen>
1305 zone "0.16.172.in-addr.arpa" {
1306 type master;
1307 file "/var/lib/named/master/172.16.0.0.rev";
1308 allow-query {
1309 mynet;
1310 };
1311 allow-transfer {
1312 mynet;
1313 };
1314 allow-update {
1315 mynet;
1316 };
1317 };
1319 zone "4.16.172.in-addr.arpa" {
1320 type master;
1321 file "/var/lib/named/master/172.16.4.0.rev";
1322 allow-query {
1323 mynet;
1324 };
1325 allow-transfer {
1326 mynet;
1327 };
1328 allow-update {
1329 mynet;
1330 };
1331 };
1333 zone "8.16.172.in-addr.arpa" {
1334 type master;
1335 file "/var/lib/named/master/172.16.8.0.rev";
1336 allow-query {
1337 mynet;
1338 };
1339 allow-transfer {
1340 mynet;
1341 };
1342 allow-update {
1343 mynet;
1344 };
1345 };
1346 </screen>
1347 </example>
1349 <!-- Thirteen -->
1350 <example id="abmasbizdns">
1351 <title>Forward Zone File: abmas.biz.hosts</title>
1352 <screen>
1353 $ORIGIN .
1354 $TTL 38400 ; 10 hours 40 minutes
1355 abmas.biz IN SOA massive.abmas.biz. root.abmas.biz. (
1356 2003021833 ; serial
1357 10800 ; refresh (3 hours)
1358 3600 ; retry (1 hour)
1359 604800 ; expire (1 week)
1360 38400 ; minimum (10 hours 40 minutes)
1361 )
1362 NS massive.abmas.biz.
1363 NS bldg1.abmas.biz.
1364 NS bldg2.abmas.biz.
1365 MX 10 massive.abmas.biz.
1366 $ORIGIN abmas.biz.
1367 massive A 172.16.0.1
1368 router0 A 172.16.0.128
1369 bldg1 A 172.16.4.1
1370 router4 A 172.16.4.128
1371 bldg2 A 172.16.8.1
1372 router8 A 172.16.8.128
1373 </screen>
1374 </example>
1376 <!-- Forteen -->
1377 <example id="abmasusdns">
1378 <title>Forward Zone File: abmas.biz.hosts</title>
1379 <screen>
1380 $ORIGIN .
1381 $TTL 38400 ; 10 hours 40 minutes
1382 abmas.us IN SOA server.abmas.us. root.abmas.us. (
1383 2003021833 ; serial
1384 10800 ; refresh (3 hours)
1385 3600 ; retry (1 hour)
1386 604800 ; expire (1 week)
1387 38400 ; minimum (10 hours 40 minutes)
1388 )
1389 NS dns.abmas.us.
1390 NS dns2.abmas.us.
1391 MX 10 mail.abmas.us.
1392 $ORIGIN abmas.us.
1393 server A 123.45.67.66
1394 dns2 A 123.45.54.32
1395 gw A 123.45.67.65
1396 www CNAME server
1397 mail CNAME server
1398 dns CNAME server
1399 </screen>
1400 </example>
1402 <!-- Fifteen -->
1403 <example id="bldg12nameda">
1404 <title>Servers: BLDG1/BLDG2, File: named.conf, Part: A</title>
1405 <screen>
1406 ###
1407 # Abmas Biz DNS Control File
1408 ###
1409 # Date: November 15, 2003
1410 ###
1411 options {
1412 directory "/var/lib/named";
1413 forwarders {
1414 172.16.0.1;
1415 };
1416 forward first;
1417 listen-on {
1418 mynet;
1419 };
1420 auth-nxdomain yes;
1421 multiple-cnames yes;
1422 notify no;
1423 };
1425 zone "." in {
1426 type hint;
1427 file "root.hint";
1428 };
1430 zone "localhost" in {
1431 type master;
1432 file "localhost.zone";
1433 };
1435 zone "0.0.127.in-addr.arpa" in {
1436 type master;
1437 file "127.0.0.zone";
1438 };
1440 acl mynet {
1441 172.16.0.0/24;
1442 172.16.4.0/24;
1443 172.16.8.0/24;
1444 127.0.0.1;
1445 };
1447 acl seconddns {
1448 123.45.54.32;
1449 }
1450 </screen>
1451 </example>
1453 <!-- Sixteen -->
1454 <example id="bldg12namedb">
1455 <title>Servers: BLDG1/BLDG2, File: named.conf, Part: B</title>
1456 <screen>
1457 zone "abmas.biz" {
1458 type slave;
1459 file "/var/lib/named/slave/abmas.biz.hosts";
1460 allow-query {
1461 mynet;
1462 };
1463 allow-transfer {
1464 mynet;
1465 };
1466 };
1468 zone "0.16.172.in-addr.arpa" {
1469 type slave;
1470 file "/var/lib/slave/master/172.16.0.0.rev";
1471 allow-query {
1472 mynet;
1473 };
1474 allow-transfer {
1475 mynet;
1476 };
1477 };
1479 zone "4.16.172.in-addr.arpa" {
1480 type slave;
1481 file "/var/lib/named/slave/172.16.4.0.rev";
1482 allow-query {
1483 mynet;
1484 };
1485 allow-transfer {
1486 mynet;
1487 };
1488 };
1490 zone "8.16.172.in-addr.arpa" {
1491 type slave;
1492 file "/var/lib/named/slave/172.16.8.0.rev";
1493 allow-query {
1494 mynet;
1495 };
1496 allow-transfer {
1497 mynet;
1498 };
1499 };
1500 </screen>
1501 </example>
1504 <!-- Seventeen -->
1505 <example id="ch5-initgrps">
1506 <title>Initialize Groups Script, File: /etc/samba/initGrps.sh</title>
1507 <screen>
1508 #!/bin/bash
1510 # Create UNIX groups
1511 groupadd acctsdep
1512 groupadd finsrvcs
1513 groupadd piops
1515 # Map Windows Domain Groups to UNIX groups
1516 net groupmap modify ntgroup="Domain Admins" unixgroup=root
1517 net groupmap modify ntgroup="Domain Users" unixgroup=users
1518 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
1520 # Add Functional Domain Groups
1521 net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
1522 net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
1523 net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d
1524 </screen>
1525 </example>
1527 <!-- End of Examples -->
1529 <sect2 id="ch5-procstart">
1530 <title>Process Startup Configuration</title>
1532 <para>
1533 <indexterm><primary>chkconfig</primary></indexterm>
1534 <indexterm><primary>daemon control</primary></indexterm>
1535 There are two essential steps to process startup configuration. A process
1536 must be configured so that it is automatically restarted each time the server
1537 is rebooted. This step involves use of the <command>chkconfig</command> tool that
1538 created appropriate symbolic links from the master daemon control file that is
1539 located in the <filename>/etc/rc.d</filename> directory to the <filename>/etc/rc'x'.d</filename>
1540 directories. Links are created so that when the system run-level is changed, the
1541 necessary start or kill script is run.
1542 </para>
1544 <para>
1545 <indexterm><primary>/etc/xinetd.d</primary></indexterm>
1546 In the event that a service is provided not as a daemon but via the internetworking
1547 super daemon (<command>inetd</command> or <command>xinetd</command>), then the <command>chkconfig</command>
1548 tool makes the necessary entries in the <filename>/etc/xinetd.d</filename> directory
1549 and sends a hang-up (HUP) signal to the super daemon, thus forcing it to
1550 re-read its control files.
1551 </para>
1553 <para>
1554 Last, each service must be started to permit system validation to proceed. The following steps
1555 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you
1556 are installing Samba.
1557 </para>
1559 <procedure>
1560 <title>Process Startup Configuration Steps</title>
1562 <step><para>
1563 Use the standard system tool to configure each service to restart
1564 automatically at every system reboot. For example,
1565 <indexterm><primary>chkconfig</primary></indexterm>
1566 <screen>
1567 &rootprompt; chkconfig dhpc on
1568 &rootprompt; chkconfig named on
1569 &rootprompt; chkconfig cups on
1570 &rootprompt; chkconfig smb on
1571 &rootprompt; chkconfig swat on
1572 </screen>
1573 </para></step>
1575 <step><para>
1576 <indexterm><primary>starting dhcpd</primary></indexterm>
1577 <indexterm><primary>starting samba</primary></indexterm>
1578 <indexterm><primary>starting CUPS</primary></indexterm>
1579 Now start each service to permit the system to be validated.
1580 Execute each of the following in the sequence shown:
1582 <screen>
1583 &rootprompt; service dhcp restart
1584 &rootprompt; service named restart
1585 &rootprompt; service cups restart
1586 &rootprompt; service smb restart
1587 &rootprompt; service swat restart
1588 </screen>
1589 </para></step>
1590 </procedure>
1592 </sect2>
1594 <sect2 id="ch5wincfg">
1595 <title>Windows Client Configuration</title>
1597 <para>
1598 The procedure for desktop client configuration for the network in this chapter is similar to
1599 that used for the previous one. There are a few subtle changes that should be noted.
1600 </para>
1602 <procedure>
1603 <title>Windows Client Configuration Steps</title>
1605 <step><para>
1606 Install MS Windows XP Professional. During installation, configure the client to use DHCP for
1607 TCP/IP protocol configuration.
1608 <indexterm><primary>WINS</primary></indexterm>
1609 <indexterm><primary>DHCP</primary></indexterm>
1610 DHCP configures all Windows clients to use the WINS Server address that has been defined
1611 for the local subnet.
1612 </para></step>
1614 <step><para>
1615 Join the Windows domain <constant>MEGANET</constant>. Use the domain administrator
1616 username <constant>root</constant> and the SMB password you assigned to this account.
1617 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
1618 a Windows domain is given in Appendix A, <link linkend="domjoin"/>.
1619 Reboot the machine as prompted and then log on using the domain administrator account
1620 (<constant>root</constant>).
1621 </para></step>
1623 <step><para>
1624 Verify that the server called <constant>MEGANET</constant> is visible in <guimenu>My Network Places</guimenu>,
1625 that it is possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>,
1626 <guimenuitem>apps</guimenuitem>, and <guimenuitem>finsvcs</guimenuitem>,
1627 and that it is possible to open each share to reveal its contents.
1628 </para></step>
1630 <step><para>
1631 Create a drive mapping to the <constant>apps</constant> share on a server. At this time, it does
1632 not particularly matter which application server is used. It is necessary to manually
1633 set a persistent drive mapping to the local applications server on each workstation at the time of
1634 installation. This step is avoided by the improvements to the design of the network configuration
1635 in the next chapter.
1636 </para></step>
1638 <step><para>
1639 Perform an administrative installation of each application to be used. Select the options
1640 that you wish to use. Of course, you choose to run applications over the network, correct?
1641 </para></step>
1643 <step><para>
1644 Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
1645 NTP-based time synchronization software, drivers for specific local devices such as fingerprint
1646 scanners, and the like. Probably the most significant application to be locally installed
1647 is antivirus software.
1648 </para></step>
1650 <step><para>
1651 Now install all four printers onto the staging system. The printers you install
1652 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you
1653 also configure use of the identical printers that are located in the financial services department.
1654 Install printers on each machine using the following steps:
1656 <procedure>
1657 <title>Steps to Install Printer Drivers on Windows Clients</title>
1659 <step><para>
1660 Click <menuchoice>
1661 <guimenu>Start</guimenu>
1662 <guimenuitem>Settings</guimenuitem>
1663 <guimenuitem>Printers</guimenuitem>
1664 <guiicon>Add Printer</guiicon>
1665 <guibutton>Next</guibutton>
1666 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
1667 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
1668 </para></step>
1670 <step><para>
1671 Click <guibutton>Next</guibutton>. In the
1672 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
1673 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
1674 <constant>HP LaserJet 6</constant>. Click <guibutton>Next</guibutton>.
1675 </para></step>
1677 <step><para>
1678 In the <guimenuitem>Available ports:</guimenuitem> panel, select
1679 <constant>FILE:</constant>. Accept the default printer name by clicking
1680 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
1681 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
1682 <guibutton>Finish</guibutton>.
1683 </para></step>
1685 <step><para>
1686 You may be prompted for the name of a file to print to. If so, close the
1687 dialog panel. Right-click <menuchoice>
1688 <guiicon>HP LaserJet 6</guiicon>
1689 <guimenuitem>Properties</guimenuitem>
1690 <guimenusub>Details (Tab)</guimenusub>
1691 <guimenubutton>Add Port</guimenubutton>
1692 </menuchoice>.
1693 </para></step>
1695 <step><para>
1696 In the <guimenuitem>Network</guimenuitem> panel, enter the name of
1697 the print queue on the Samba server as follows: <constant>\\BLDG1\hplj6a</constant>.
1698 Click <menuchoice>
1699 <guibutton>OK</guibutton>
1700 <guibutton>OK</guibutton>
1701 </menuchoice> to complete the installation.
1702 </para></step>
1704 <step><para>
1705 Repeat the printer installation steps above for both HP LaserJet 6 printers
1706 as well as for both QMS Magicolor laser printers. Remember to install all
1707 printers but to set the destination port for each to the server on the
1708 local network. For example, a workstation in the accounting group should
1709 have all printers directed at the server <constant>BLDG1</constant>.
1710 You may elect to point all desktop workstation configurations at the
1711 server called <constant>MASSIVE</constant> and then in your deployment
1712 procedures, it would be wise to document the need to redirect the printer
1713 configuration (as well as the applications server drive mapping) to the
1714 server on the network segment on which the workstation is to be located.
1715 </para></step>
1716 </procedure>
1717 </para></step>
1719 <step><para>
1720 When you are satisfied that the staging systems are complete, use the appropriate procedure to
1721 remove the client from the domain. Reboot the system, and then log on as the local administrator
1722 and clean out all temporary files stored on the system. Before shutting down, use the disk
1723 defragmentation tool so that the file system is in optimal condition before replication.
1724 </para></step>
1726 <step><para>
1727 Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the
1728 machine to a network share on the server.
1729 </para></step>
1731 <step><para>
1732 You may now replicate the image using the appropriate Norton Ghost procedure to the target
1733 machines. Make sure to use the procedure that ensures each machine has a unique
1734 Windows security identifier (SID). When the installation of the disk image is complete, boot the PC.
1735 </para></step>
1737 <step><para>
1738 Log onto the machine as the local Administrator (the only option), and join the machine to
1739 the domain following the procedure set out in Appendix A, <link linkend="domjoin"/>. You must now set the
1740 persistent drive mapping to the applications server that the user is to use. The system is now
1741 ready for the user to log on, provided you have created a network logon account for that
1742 user, of course.
1743 </para></step>
1745 <step><para>
1746 Instruct all users to log onto the workstation using their assigned username and password.
1747 </para></step>
1748 </procedure>
1750 </sect2>
1752 <sect2>
1753 <title>Key Points Learned</title>
1755 <para>
1756 The network you have just deployed has been a valuable exercise in forced constraint.
1757 You have deployed a network that works well, although you may soon start to see
1758 performance problems, at which time the modifications demonstrated in <link linkend="happy"/>
1759 bring the network to life. The following key learning points were experienced:
1760 </para>
1762 <itemizedlist>
1763 <listitem><para>
1764 The power of using &smb.conf; include files
1765 </para></listitem>
1767 <listitem><para>
1768 Use of a single PDC over a routed network
1769 </para></listitem>
1771 <listitem><para>
1772 Joining a Samba-3 domain member server to a Samba-3 domain
1773 </para></listitem>
1775 <listitem><para>
1776 Configuration of winbind to use domain users and groups for Samba access
1777 to resources on the domain member servers
1778 </para></listitem>
1780 <listitem><para>
1781 The introduction of roaming profiles
1782 </para></listitem>
1784 </itemizedlist>
1786 </sect2>
1788 </sect1>
1790 <sect1>
1791 <title>Questions and Answers</title>
1793 <para>
1794 </para>
1796 <qandaset defaultlabel="chap01qa" type="number">
1797 <qandaentry>
1798 <question>
1800 <para>
1801 The example &smb.conf; files in this chapter make use of the <parameter>include</parameter> facility.
1802 How may I get to see what the actual working &smb.conf; settings are?
1803 </para>
1805 </question>
1806 <answer>
1808 <para>
1809 You may readily see the net compound effect of the included files by running:
1810 <screen>
1811 &rootprompt; testparm -s | less
1812 </screen>
1813 </para>
1815 </answer>
1816 </qandaentry>
1818 <qandaentry>
1819 <question>
1821 <para>
1822 Why does the include file <filename>common.conf</filename> have an empty include statement?
1823 </para>
1825 </question>
1826 <answer>
1828 <para>
1829 The use of the empty include statement nullifies further includes. For example, let's say you
1830 desire to have just an smb.conf file that is built from the array of include files of which the
1831 master control file is called <filename>master.conf</filename>. The following command
1832 produces a compound &smb.conf; file.
1833 <screen>
1834 &rootprompt; testparm -s /etc/samba/master.conf > /etc/samba/smb.conf
1835 </screen>
1836 If the include parameter was not in the common.conf file, the final &smb.conf; file leaves
1837 the include in place, even though the file it points to has already been included. This is a bug
1838 that will be fixed at a future date.
1839 </para>
1841 </answer>
1842 </qandaentry>
1844 <qandaentry>
1845 <question>
1847 <para>
1848 I accept that the simplest configuration necessary to do the job is the best. The use of <parameter>tdbsam</parameter>
1849 passdb backend is much simpler than having to manage an LDAP-based <parameter>ldapsam</parameter> passdb backend.
1850 I tried using <command>rsync</command> to replicate the <filename>passdb.tdb</filename>, and it seems to work fine!
1851 So what is the problem?
1852 </para>
1854 </question>
1855 <answer>
1857 <para>
1858 Replication of the <parameter>tdbsam</parameter> database file can result in loss of currency in its
1859 contents between the PDC and BDCs. The most notable symptom is that workstations may not be able
1860 to log onto the network following a reboot and may have to rejoin the domain to recover network
1861 access capability.
1862 </para>
1864 </answer>
1865 </qandaentry>
1867 <qandaentry>
1868 <question>
1870 <para>
1871 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
1872 </para>
1874 </question>
1875 <answer>
1877 <para>
1878 No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server
1879 offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many
1880 offers are made. Under normal operation, the client accepts the first offer it receives.
1881 </para>
1883 <para>
1884 The only exception to this rule is when the client makes a directed request from a specific DHCP server
1885 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash.
1886 </para>
1888 </answer>
1889 </qandaentry>
1891 <qandaentry>
1892 <question>
1894 <para>
1895 How does the Windows client find the PDC?
1896 </para>
1898 </question>
1899 <answer>
1901 <para>
1902 The Windows client obtains the WINS server address from the DHCP lease information. It also
1903 obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast)
1904 to register itself with the WINS server and to obtain enumeration of vital network information to
1905 enable it to operate successfully.
1906 </para>
1908 </answer>
1909 </qandaentry>
1911 <qandaentry>
1912 <question>
1914 <para>
1915 Why did you enable IP forwarding (routing) only on the server called <constant>MASSIVE</constant>?
1916 </para>
1918 </question>
1919 <answer>
1921 <para>
1922 The server called <constant>MASSIVE</constant> is acting as a router to the Internet. No other server
1923 (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network.
1924 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network
1925 segments to the router that is its gateway to them.
1926 </para>
1928 </answer>
1929 </qandaentry>
1931 <qandaentry>
1932 <question>
1934 <para>
1935 You did nothing special to implement roaming profiles. Why?
1936 </para>
1938 </question>
1939 <answer>
1941 <para>
1942 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
1943 clients is to use roaming profiles.
1944 </para>
1946 </answer>
1947 </qandaentry>
1949 <qandaentry>
1950 <question>
1952 <para>
1953 On the domain member computers, you configured winbind in the <filename>/etc/nsswitch.conf</filename> file.
1954 You did not configure any PAM settings. Is this an omission?
1955 </para>
1957 </question>
1958 <answer>
1960 <para>
1961 PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only
1962 marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain
1963 member servers using Windows networking usernames and passwords, it is necessary to configure PAM
1964 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name
1965 service switch (NSS).
1966 </para>
1968 </answer>
1969 </qandaentry>
1971 <qandaentry>
1972 <question>
1974 <para>
1975 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
1976 </para>
1978 </question>
1979 <answer>
1981 <para>
1982 Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed
1983 in <emphasis>TOSHARG</emphasis>, which has a full chapter dedicated to the subject. While we are on the
1984 subject, it should be noted that you should definitely not use SWAT on any system that makes use
1985 of &smb.conf; <parameter>include</parameter> files because SWAT optimizes them out into an aggregated
1986 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to
1987 handle this functionality gracefully.
1988 </para>
1990 </answer>
1991 </qandaentry>
1993 <qandaentry>
1994 <question>
1996 <para>
1997 The domain controller has an auto-shutdown script. Isn't that dangerous?
1998 </para>
2000 </question>
2001 <answer>
2003 <para>
2004 Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though.
2005 </para>
2007 </answer>
2008 </qandaentry>
2010 </qandaset>
2012 </sect1>
2014 </chapter>