| blob | 52e27bd6ce083828d6aee3c2c944b6836cba6fa1 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
5 <!-- Stuff for xincludes -->
6 <!ENTITY % xinclude SYSTEM "../entities/xinclude.dtd">
7 %xinclude;
9 <!-- entities files to use -->
10 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
11 %global_entities;
13 ]>
15 <chapter id="simple">
16 <title>No Frills Samba Servers</title>
18 <para>
19 Congratulations, you managed to get past the opening chapter. To some, this is where the interesting
20 exercises begin. This is the start of the real journey toward the Samba deployment of a lifetime.
21 </para>
23 <sect1>
24 <title>Introduction</title>
26 <para>
27 This chapter lays the groundwork for understanding the basics of Samba operation.
28 Instead of a bland technical discussion, each principle is demonstrated by way of a
29 real-world scenario for which a working solution<footnote>The examples given mirror those documented
30 in TOSHARG Chapter 2, Section 2.3.1. You may gain additional insight from the Stand-alone server
31 configurations covered in TOSHARG sections 2.3.1.2 through 2.3.1.4.
32 </footnote> is fully described.
33 </para>
35 <para>
36 The practical exercises take you on a journey through a drafting office, a charity administration
37 office, and an accounting office. You may choose to apply any or all of these to your own environment.
38 </para>
40 <para>
41 Every assignment case can be implemented far more creatively, but remember that the solutions you
42 create are designed to demonstrate a particular solution possibility. With experience, you should
43 find much improved solutions compared with those presented here. By the time you complete this book,
44 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your
45 way through the examples.
46 </para>
48 </sect1>
49 <sect1>
50 <title>Assignment Tasks</title>
52 <para>
53 Each case presented highlights different aspects of Windows networking for which a simple
54 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases.
55 Each is briefly reviewed to cover points of highlight. In each example, instructions are based
56 on the assumption that the official Samba Team RPM package has been installed.
57 </para>
59 <para>
60 This chapter has three assignments built around ficticious companies:
61 </para>
63 <para>
64 <itemizedlist>
65 <listitem><para>A drafting office</para></listitem>
66 <listitem><para>A charity administration office</para></listitem>
67 <listitem><para>An accounting office</para></listitem>
68 </itemizedlist>
69 </para>
71 <para>
72 Let's get started.
73 </para>
75 <sect2>
76 <title>Drafting Office</title>
78 <para>
79 Our fictitious company is called <emphasis>Abmas Design Inc.</emphasis> This is a three-person
80 computer-aided design (CAD) business that often has more work than can be handled. The
81 business owner hires contract draftspeople from wherever he can. They bring their own
82 notebook computers into the office. There are four permanent drafting machines. Abmas has a
83 collection of over 10 years of plans that must be available for all draftsmen to reference.
84 Abmas hires the services of an experienced network engineer to update the
85 plans that are stored on a central server one day per month. She knows how to upload
86 plans from each machine. The files available from the server must remain read-only.
87 Anyone should be able to access the plans at any time and without barriers or difficulty.
88 </para>
90 <para><indexterm>
91 <primary>Red Hat Linux</primary>
92 </indexterm>
93 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central
94 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk
95 to store plans, and a 100-base-T Ethernet card. You have already installed Red Hat Linux 9.0 and
96 have upgraded Samba to version 3.0.2 using the RPM package that is provided from the Samba
97 <ulink url="http://www.samba.org">FTP</ulink> sites.
98 </para>
100 <para><indexterm>
101 <primary>consultant</primary>
102 </indexterm>
103 The four permanent drafting machines (Microsoft Windows workstations) have attached printers
104 and plotters that are shared on a peer-to-peer basis by any/all network users. The intent
105 is to continue to share printers in this manner. The three permanent staff work together with
106 all contractors to store all new work on one PC. A daily copy is made of the work storage
107 area to another PC for safekeeping. When the network consultant arrives, the weekly work
108 area is copied to the central server and the files are removed from the main weekly storage
109 machine. The office works best with this arrangement and does not want to change anything.
110 Old habits are too ingrained.
111 </para>
113 <sect3>
114 <title>Dissection and Discussion</title>
116 <para><indexterm>
117 <primary>file server</primary>
118 <secondary>read-only</secondary>
119 </indexterm>
120 The requirements for this server installation demand simplicity. An anonymous read-only
121 file server adequately meets all needs. The network consultant determines how
122 to upload all files from the weekly storage area to the server. This installation should
123 focus only on critical aspects of the installation.
124 </para>
126 <para>
127 It is not necessary to have specific users on the server. The site has a method for storing
128 all design files (plans). Each plan is stored in a directory that is named YYYYWW<footnote>
129 This information is given purely as an example of how data may be stored in such a way that it
130 will be easy to locate records at a later date. The example is not meant to imply any instructions
131 that may be construed as essential to the design of the solution, this is something you will almost
132 certainly want to determine for yourself.</footnote>, where
133 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored
134 by week of year to preserve the filing technique the site is familiar with.
135 There is another customer directory that is alphabetically listed. At the top level are 26
136 directories (A-Z), in each is a second level of directory for the first plus second letter of the name
137 (A-Z); inside each is a directory by the customers' name. Inside each directory is a symbolic
138 link to each design drawing/plan. This way of storing customer data files permits all
139 plans to be located both by customer name, as well as by the date the work was performed, without
140 demanding the disk space that would be needed if a duplicate file copy were to be stored.
141 The share containing the plans is called <emphasis>Plans</emphasis>.
142 </para>
144 </sect3>
146 <sect3>
147 <title>Implementation</title>
149 <para>
150 It is assumed that the server is fully installed and ready for installation and
151 configuration of Samba 3.0.2 and any support files needed. All TCP/IP addresses
152 have been hard coded. In our case the IP address of the Samba server is
153 <constant>192.168.1.1</constant> and the netmask is <constant>255.255.255.0</constant>.
154 The host name of the server used was <constant>server</constant>.
155 </para>
157 <procedure>
158 <title>Samba Server Configuration</title>
160 <step><para>
161 Download the Samba-3 RPM packages for Red Hat Linux 9.0 from the Samba
162 <ulink url="http://www.samba.org">FTP servers.</ulink>
163 </para></step>
165 <step><para><indexterm>
166 <primary>RPM</primary>
167 <secondary>install</secondary>
168 </indexterm><indexterm>
169 <primary>package</primary>
170 </indexterm>
171 Install the RPM package as using either the Red Hat Linux preferred GUI
172 tool or using the <command>rpm</command>, as follows:
173 <screen>
174 &rootprompt; rpm -Uvh samba-3.0.2-1.i386.rpm
175 </screen>
176 </para></step>
178 <step><para>
179 Create a mount point for the file system that will be used to store all data files.
180 You can create a directory called <filename>/plans</filename> as follows:
181 <screen>
182 &rootprompt; mkdir /plans
183 &rootprompt; chmod 755 /plans
184 </screen>
185 The 755 permissions on this directory (mount point) permit the owner to read, write
186 and execute, and the group and everyone else to read and execute only.
187 </para>
189 <para><indexterm>
190 <primary>file system</primary>
191 <secondary>Ext3</secondary>
192 </indexterm>
193 Use Red Hat Linux system tools (refer to Red Hat instructions for instructions)
194 to format the 160GB hard drive with a suitable file system. An Ext3 file system
195 is suitable. Configure this drive to automatically mount using the <filename>/plans</filename>
196 directory as the mount point.
197 </para></step>
199 <step><para>
200 Install the &smb.conf; file shown in <link linkend="draft-smbconf"/> in the
201 <filename>/etc/samba</filename> directory.
203 <smbconfexample id="draft-smbconf">
204 <title>Drafting Office &smb.conf; File</title>
205 <smbconfcomment>Global Parameters</smbconfcomment>
206 <smbconfsection>[global]</smbconfsection>
207 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
208 <smbconfoption><name>security</name><value>SHARE</value></smbconfoption>
210 <smbconfsection>[Plans]</smbconfsection>
211 <smbconfoption><name>path</name><value>/plans</value></smbconfoption>
212 <smbconfoption><name>read only</name><value>Yes</value></smbconfoption>
213 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
214 </smbconfexample>
215 </para></step>
217 <step><para><indexterm>
218 <primary>/etc/hosts</primary>
219 </indexterm>
220 Verify that the <filename>/etc/hosts</filename> file contains the following entry:
221 <screen>
222 192.168.1.1 server
223 </screen>
224 </para></step>
226 <step><para><indexterm>
227 <primary>samba</primary>
228 <secondary>starting samba</secondary>
229 </indexterm><indexterm>
230 <primary>chkconfig</primary>
231 </indexterm>
232 <indexterm><primary>starting samba</primary></indexterm>
233 Use the standard system tool to start Samba and to configure it to restart
234 automatically at every system reboot. For example:
235 <screen>
236 &rootprompt; chkconfig smb on
237 &rootprompt; /etc/rc.d/init.d/smb restart
238 </screen>
239 </para></step>
241 </procedure>
243 <procedure>
244 <title>Windows Client Configuration</title>
246 <step><para>
247 Make certain that all clients are set to the same network address range as
248 has been used for the Samba server. For example, one client might have an IP
249 address 192.168.1.10.
250 </para></step>
252 <step><para><indexterm>
253 <primary>netmask</primary>
254 </indexterm>
255 Ensure that the netmask used on the Windows clients matches that used
256 for the Samba server. All clients must have the same netmask. For example,
257 255.255.255.0.
258 </para></step>
260 <step><para><indexterm>
261 <primary>workgroup</primary>
262 </indexterm>
263 Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
264 </para></step>
266 <step><para>
267 Verify on each client that the machine called <constant>SERVER</constant>
268 is visible in the <guimenu>Network Neighborhood</guimenu>, that it is
269 possible to connect to it and see the share <guimenuitem>Plans</guimenuitem>,
270 and that it is possible to open that share to reveal its contents.
271 </para></step>
273 </procedure>
275 </sect3>
277 <sect3 id="validate1">
278 <title>Validation</title>
280 <para><indexterm>
281 <primary>validation</primary>
282 </indexterm>
283 The first priority in validating the new Samba configuration should be to check
284 that Samba answers on the loop-back interface. Then it is time to check that Samba
285 answers its own name correctly. Last, check that a client can connect to the Samba
286 server.
287 </para>
289 <procedure>
290 <step><para><indexterm>
291 <primary>smbd</primary>
292 </indexterm><indexterm>
293 <primary>daemon</primary>
294 </indexterm><indexterm>
295 <primary>smbclient</primary>
296 </indexterm>
297 To check the ability to access the <command>smbd</command> daemon
298 services, execute the following:
299 <screen>
300 &rootprompt; smbclient -L localhost -U%
301 Sharename Type Comment
302 --------- ---- -------
303 Plans Disk
304 IPC$ IPC IPC Service (Samba 3.0.2)
305 ADMIN$ IPC IPC Service (Samba 3.0.2)
307 Server Comment
308 --------- -------
309 SERVER Samba 3.0.2
311 Workgroup Master
312 --------- --------
313 MIDEARTH SERVER
314 </screen>
315 <indexterm>
316 <primary>loopback</primary>
317 </indexterm><indexterm>
318 <primary>NULL connection</primary>
319 </indexterm>
320 This indicates that Samba is able to respond on the loopback interface to
321 a NULL connection. The <parameter>-U%</parameter> means send an empty
322 username and an empty password. This command should be repeated after
323 Samba has been running for 15 minutes.
324 </para></step>
326 <step><para>
327 Now verify that Samba correctly handles being passed a username
328 and password, and that it answers its own name. Execute the following:
329 <screen>
330 &rootprompt; smbclient -L server -Uroot%password
331 </screen>
332 The output should be identical to the previous response. Samba has been
333 configured to ignore all usernames given; instead it uses the
334 <parameter>guest account</parameter> for all connections.
335 </para></step>
337 <step><para><indexterm>
338 <primary>Windows Explorer</primary>
339 </indexterm><indexterm>
340 <primary>Network Neighborhood</primary>
341 </indexterm>
342 From the Windows 9x/Me client, launch Windows Explorer,
343 <menuchoice>
344 <guiicon>[Desktop: right-click] Network Neighborhood</guiicon>
345 <guimenu>Explore</guimenu>
346 <guimenuitem>[Left Panel] [+] Entire Network</guimenuitem>
347 <guimenuitem>[Left Panel] [+] Server</guimenuitem>
348 <guimenuitem>[Left Panel] [+] Plans</guimenuitem>
349 </menuchoice>. In the right panel you should see the files and directories
350 (folders) that are in the <guiicon>Plans</guiicon> share.
351 </para></step>
352 </procedure>
354 </sect3>
356 </sect2>
358 <sect2>
359 <title>Charity Administration Office</title>
361 <para>
362 The fictitious charity organization is called <emphasis>Abmas Vision NL</emphasis>. This is an
363 office that has five networked computers. Staff are all volunteers with frequent staff changes.
364 Ms. Amy May, the director of operations, wants a no-hassle network. Anyone should be able to
365 use any PC. Only two Windows applications are used: a custom funds tracking and management package
366 that stores all files on the central server and Microsoft Word. The office prepares mail-out
367 letters, letters of invitation, and thank-you notes. All files must be stored in perpetuity.
368 The custom funds tracking and management software has been configured to use a server named
369 <constant>SERVER</constant>, a share named <constant>FTMFILES</constant>, and a printer queue
370 named <constant>PRINTQ</constant> that uses preprinted stationery, thus demanding a
371 dedicated printer. This printer does not need to be mapped to a local printer on the workstations.
372 </para>
374 <para><indexterm>
375 <primary>print queue</primary>
376 </indexterm><indexterm>
377 <primary>print spooler</primary>
378 </indexterm>
379 Printer handling in Samba results in a significant level of confusion. Samba presents to the
380 MS Windows client only a print queue. The Samba <command>smbd</command> process passes a
381 print job sent to it from the Windows client to the native UNIX printing system. The native
382 UNIX printing system (spooler) places the job in a print queue from which it is
383 delivered to the printer. In this book, network diagrams refer to a printer by the name
384 of the print queue that services that printer. It does not matter what the fully qualified
385 name (or the host name) of a network attached printer is. The UNIX print spooler is configured
386 to correctly deliver all jobs to the printer.
387 </para>
389 <para>
390 This organization has a policy forbidding use of privately owned computers on site as a measure
391 to prevent leakage of confidential information. Only the five PCs owned by Abmas Vision NL are
392 used on this network.
393 </para>
395 <para><indexterm>
396 <primary>SUSE Enterprise Linux Server</primary>
397 </indexterm>
398 The central server was donated by a local computer store. It is a dual processor Pentium-III
399 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has 4 x 200GB IDE hard drives, and a
400 100-base-T network card. The office has 100-base-T permanent network connections that go to
401 a central hub and all equipment is new. The five network computers all are equipped with Microsoft
402 Windows Me. Funding is limited, so the server has no operating system on it. You have approval
403 to install Samba on Linux, but just make sure it works without problems. There are two HP LaserJet
404 5 PS printers that are network connected. The second printer is to be used for general
405 office and letter printing. Your recommendation to allow only the Linux server to print directly
406 to the printers was accepted. You have supplied SUSE Enterprise Linux Server version 8.0 and
407 have upgraded Samba to version 3.0.2.
408 </para>
410 <sect3>
411 <title>Dissection and Discussion</title>
413 <para>
414 <indexterm><primary>force user</primary></indexterm><indexterm>
415 <primary>nt acl support</primary>
416 </indexterm><indexterm>
417 <primary>UID</primary>
418 </indexterm><indexterm>
419 <primary>Posix</primary>
420 </indexterm>
421 This installation demands simplicity. Frequent turn-over of volunteer staff would indicate that
422 a network environment that requires users to logon might be problematic. It is suggested that the
423 best solution for this office would be one where the user can log onto any PC with any username
424 and password. Samba can accommodate an office like this by using the <parameter>force user</parameter>
425 parameter in share and printer definitions. The use of the <parameter>force user</parameter>
426 ensures that all files are owned by same user identifier (UID) and thus ensures that there
427 will never be a problem with file access due to file access permissions. Additionally, you elect
428 to use the <parameter>nt acl support = No</parameter> option to ensure that no attempts can be
429 made to write access control lists (Posix type) to any file or directory. This prevents
430 an inadvertent ACL from overriding actual file permissions.
431 </para>
433 <para>
434 <indexterm><primary>SUID</primary></indexterm>
435 <indexterm><primary>SGID</primary></indexterm>
436 <indexterm><primary>security</primary><secondary>share mode</secondary></indexterm>
437 This organization is a prime candidate for Share Mode security. The <parameter>force user</parameter>
438 allows all files to be owned by the same user and group. In addition to this, it would not hurt to
439 set SUID and set SGID shared directories. This means that all new files that are created, no matter
440 who creates it, are owned by the owner or group of the directory in which they are created.
441 For further information regarding the significance of the SUID/SGID settings, see
442 <link linkend="ch12-SUIDSGID"/>.
443 </para>
445 <para>
446 <indexterm><primary>CUPS</primary></indexterm>
447 <indexterm><primary>printing</primary><secondary>raw</secondary></indexterm><indexterm>
448 <primary>Red Hat Linux</primary>
449 </indexterm><indexterm>
450 <primary>SUSE Linux</primary>
451 </indexterm>
452 All client workstations print to a print queue on the server. This ensures that print jobs
453 continue to print in the event that a user may shut down the workstation immediately after
454 sending a job to the printer. Today, both Red Hat Linux and SUSE Linux use CUPS-based printing.
455 Older Linux systems offered a choice to use either the LPRng printing system, or CUPS. It appears, however,
456 that CUPS has now become the leading UNIX printing technology.
457 </para>
459 <para>
460 <indexterm><primary>print queue</primary></indexterm>
461 The print queues are set up as <constant>Raw</constant> devices, which means that CUPS will
462 not do intelligent print processing, and vendor supplied drivers be installed locally on the
463 Windows clients.
464 </para>
466 <para>
467 The hypothetical software (Funds Tracking and Management) referred to is representative of
468 custom-built software that directly uses a NetBIOS interface. Most such software originated in
469 the days of MS/PC DOS. NetBIOS names are upper-case (and functionally are case insensitive),
470 thus some old software applications would permit only upper-case names to be entered.
471 Some such applications were later ported to MS Windows but retain the upper-case network
472 resource naming conventions because customers are familiar with that. We made the decision
473 to name shares and print queues for this application in upper-case also for the same reason.
474 Nothing would break if you were to use lower-case names, but that decision might create a need
475 to re-educate staff &smbmdash; something well avoided at this time.
476 </para>
478 <para>
479 NetBIOS networking does not print directly to a printer. Instead, all printing is done to a
480 print queue. The print spooling system is responsible for communicating with the physical
481 printer. In this example, therefore, the resource that is referred to as <constant>PRINTQ</constant>
482 really is just a print queue. The name of the print queue is held to be representative of
483 the device to which the print spooler delivers print jobs.
484 </para>
486 </sect3>
488 <sect3>
489 <title>Implementation</title>
491 <para>
492 It is assumed that the server is fully installed and ready for configuration of
493 Samba 3.0.2 and for necessary support files. All TCP/IP addresses should be hard coded.
494 In our case, the IP address of the Samba server is 192.168.1.1 and the netmask is
495 255.255.255.0. The host name of the server used was <constant>server</constant>.
496 The office network is built as shown in <link linkend="charitynet"/>.
497 </para>
499 <figure id="charitynet">
500 <title>Charity Administration Office Network</title>
501 <mediaobject>
502 <imageobject role="latex">
503 <imagedata fileref="guide/images/Charity-Network.png" scale="100" scalefit="1"/>
504 </imageobject>
505 <imageobject>
506 <imagedata fileref="guide/images/Charity-Network.png" scale="100" scalefit="1"/>
507 </imageobject>
508 </mediaobject>
509 </figure>
511 <procedure>
512 <title>Samba Server Configuration</title>
514 <step><para><indexterm>
515 <primary>groupadd</primary>
516 </indexterm>
517 Create a group account for office file storage as follows:
518 <screen>
519 &rootprompt; groupadd office
520 </screen>
521 </para></step>
523 <step><para><indexterm>
524 <primary>useradd</primary>
525 </indexterm><indexterm>
526 <primary>passwd</primary>
527 </indexterm>
528 Create a user account for office file storage as follows:
529 <screen>
530 &rootprompt; useradd -m abmas
531 &rootprompt; passwd abmas
532 Changing password for abmas.
533 New password: XXXXXXXX
534 Re-enter new password: XXXXXXXX
535 Password changed
536 </screen>
537 where XXXXXXXX is a secret password.
538 </para></step>
540 <step><para>
541 Use the 3-Ware IDE RAID Controller firmware utilities to configure the four 200GB
542 drives as a single RAID level 5 drive, with one drive set aside as the hot spare.
543 (Refer to the 3-Ware RAID Controller Manual for the manufacturers' preferred procedure.)
544 The resulting drive has a capacity of approximately 500GB of usable space.
545 </para></step>
547 <step><para><indexterm>
548 <primary>permissions</primary>
549 </indexterm>
550 Create a mount point for the file system that can be used to store all data files.
551 Create a directory called <filename>/data</filename> as follows:
552 <screen>
553 &rootprompt; mkdir /data
554 &rootprompt; chmod 755 /data
555 </screen>
556 The 755 permissions on this directory (mount point) permit the owner to read, write and execute,
557 and the group and everyone else to read and execute only.
558 </para></step>
560 <step><para>
561 Use SUSE Linux system tools (refer to the SUSE Administrators Guide for correct
562 procedures) to format the partition with a suitable file system. The reiserfs file system
563 is suitable. Configure this drive to automount using the <filename>/data</filename>
564 directory as the mount point. It must be mounted before proceeding.
565 </para></step>
567 <step><para>
568 Under the directory called <filename>/data</filename> create two directories
569 named <filename>ftmfiles</filename> and <filename>officefiles</filename>, and set
570 ownership and permissions as follows:
571 <screen>
572 &rootprompt; mkdir -p /data/{ftmfiles,officefiles/{letters,invitations,misc}}
573 &rootprompt; chown -R abmas.office /data
574 &rootprompt; chmod -R ug+rwxs,o-w,o+rx /data
575 </screen>
576 These demonstrate compound operations. The <command>mkdir</command> command
577 creates in one step these directories:
578 <programlisting>
579 /data/fmtfiles
580 /data/officefiles
581 /data/officefiles/letters
582 /data/officefiles/invitations
583 /data/officefiles/misc
584 </programlisting>
585 The <command>chown</command> operation sets the owner to the user <constant>abmas</constant>
586 and the group to <constant>office</constant> on all directories just created. And
587 the <command>chmod</command> operation recursively sets the permissions so that
588 the owner and group have SUID/SGID with read/write/execute permission, and everyone else has
589 read and execute permission. This means that all files and directories are created
590 with the same owner and group as the directory in which they are created. Any new
591 directories created still have the same owner, group, and permissions as the
592 directory they are in. This should eliminate all permissions-based file access problems.
593 For more information on this subject, refer to <emphasis>TOSHARG</emphasis>, Chapter 13, <emphasis>File, Directory
594 and Share Access Controls</emphasis>, or refer to the UNIX man page for the
595 <command>chmod</command> and the <command>chown</command> commands.
597 </para></step>
599 <step><para>
600 Install the &smb.conf; file shown in <link linkend="charity-smbconf"/> in the
601 <filename>/etc/samba</filename> directory.
602 </para></step>
604 <step><para>
605 <indexterm><primary>smbd</primary></indexterm>
606 We must ensure that the <command>smbd</command> can resolve the name of the Samba
607 server to its IP address. Verify that the <filename>/etc/hosts</filename> file
608 contains the following entry:
609 <screen>
610 192.168.1.1 server
611 </screen>
612 </para></step>
614 <step><para>
615 Configure the printers with the IP address as shown in <link linkend="charitynet"/>.
616 Follow the instructions in the manufacturers' manual to permit printing to port 9100,
617 so that the CUPS spooler can print using raw mode protocols.
618 </para></step>
620 <step><para><indexterm>
621 <primary>lpadmin</primary>
622 </indexterm>
623 Configure the CUPS Print Queues as follows:
624 <screen>
625 &rootprompt; lpadmin -p PRINTQ -v socket://192.168.1.20:9100 -E
626 &rootprompt; lpadmin -p hplj5 -v socket://192.168.1.30:9100 -E
627 </screen>
628 This creates the necessary print queues with no assigned print filter.
629 </para></step>
631 <step><para>
632 <indexterm><primary>mime type</primary></indexterm><indexterm>
633 <primary>/etc/cups/mime.convs</primary>
634 </indexterm><indexterm>
635 <primary>application/octet-stream</primary>
636 </indexterm>
637 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
638 <screen>
639 application/octet-stream application/vnd.cups-raw 0 -
640 </screen>
641 </para></step>
643 <step><para><indexterm>
644 <primary>/etc/cups/mime.types</primary>
645 </indexterm>
646 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
647 <screen>
648 application/octet-stream
649 </screen>
650 </para></step>
652 <step><para>
653 <indexterm><primary>starting samba</primary></indexterm>
654 Use the standard system tool to start Samba and CUPS to configure them to restart
655 automatically at every system reboot. For example:
656 </para>
658 <para>
659 <indexterm><primary>starting samba</primary></indexterm>
660 <indexterm><primary>starting
661 CUPS</primary></indexterm><indexterm>
662 <primary>chkconfig</primary>
663 </indexterm>
664 <screen>
665 &rootprompt; chkconfig smb on
666 &rootprompt; chkconfig cups on
667 &rootprompt; /etc/rc.d/init.d/smb restart
668 &rootprompt; /etc/rc.d/init.d/cups restart
669 </screen>
670 </para></step>
672 </procedure>
674 <smbconfexample id="charity-smbconf">
675 <title>Charity Administration Office &smb.conf; File</title>
676 <smbconfcomment>Global Parameters</smbconfcomment>
677 <smbconfsection>[global]</smbconfsection>
678 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
679 <smbconfoption><name>security</name><value>SHARE</value></smbconfoption>
680 <smbconfoption><name>printing</name><value>CUPS</value></smbconfoption>
681 <smbconfoption><name>printcap name</name><value>CUPS</value></smbconfoption>
682 <smbconfoption><name>disable spoolss</name><value>Yes</value></smbconfoption>
683 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
684 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption>
686 <smbconfsection>[FTMFILES]</smbconfsection>
687 <smbconfoption><name>comment</name><value>Funds Tracking & Management Files</value></smbconfoption>
688 <smbconfoption><name>path</name><value>/data/ftmfiles</value></smbconfoption>
689 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
690 <smbconfoption><name>force user</name><value>abmas</value></smbconfoption>
691 <smbconfoption><name>force group</name><value>office</value></smbconfoption>
692 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
693 <smbconfoption><name>nt acl support</name><value>No</value></smbconfoption>
695 <smbconfsection>[office]</smbconfsection>
696 <smbconfoption><name>comment</name><value>General Office Files</value></smbconfoption>
697 <smbconfoption><name>path</name><value>/data/officefiles</value></smbconfoption>
698 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
699 <smbconfoption><name>force user</name><value>abmas</value></smbconfoption>
700 <smbconfoption><name>force group</name><value>office</value></smbconfoption>
701 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
702 <smbconfoption><name>nt acl support</name><value>No</value></smbconfoption>
704 <smbconfsection>[printers]</smbconfsection>
705 <smbconfoption><name>comment</name><value>Print Temporary Spool Configuration</value></smbconfoption>
706 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
707 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
708 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
709 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
710 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
711 </smbconfexample>
713 <procedure>
714 <title>Windows Client Configuration</title>
716 <step><para>
717 Configure clients to the network settings shown in <link linkend="charitynet"/>.
718 </para></step>
720 <step><para>
721 Ensure that the netmask used on the Windows clients matches that used
722 for the Samba server. All clients must have the same netmask. For example,
723 <constant>255.255.255.0</constant>.
724 </para></step>
726 <step><para>
727 <indexterm><primary>WINS</primary></indexterm>
728 On all Windows clients, set the WINS Server address to <constant>192.168.1.1</constant>,
729 the IP address of the server.
730 </para></step>
732 <step><para>
733 Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
734 </para></step>
736 <step><para><indexterm>
737 <secondary>logon</secondary>
738 </indexterm>
739 Install the <quote>Client for Microsoft Networks.</quote> Ensure that the only option
740 enabled in its properties is the option <quote>Logon and restore network connections.</quote>
741 </para></step>
743 <step><para>
744 Click <guibutton>OK</guibutton> when you are prompted to reboot the system. Reboot the
745 system, then logon using any user name and password you choose.
746 </para></step>
748 <step><para><indexterm>
749 <primary>My Network Places</primary>
750 </indexterm>
751 Verify on each client that the machine called <constant>SERVER</constant>
752 is visible in <guimenu>My Network Places</guimenu>, that it is
753 possible to connect to it and see the share <guimenuitem>office</guimenuitem>,
754 and that it is possible to open that share to reveal its contents.
755 </para></step>
757 <step><para><indexterm>
758 <primary>password caching</primary>
759 </indexterm><indexterm>
760 <primary>regedit</primary>
761 </indexterm>
762 Disable password caching on all Windows 9x/Me machines using the registry change file
763 shown in <link linkend="MEreg"/>. Be sure to remove all files that have the
764 <filename>PWL</filename> extension that are in the <filename>C:\WINDOWS</filename>
765 directory.
766 <example id="MEreg">
767 <title>Windows Me &smbmdash; Registry Edit File: Disable Password Caching</title>
768 <screen>
769 REGEDIT4
771 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
772 Windows\CurrrentVersion\Policies\Network]
773 "DisablePwdCaching"=dword:00000001
774 </screen>
775 </example>
776 The best way to apply this is to save the patch in a file called
777 <filename>ME-dpwc.reg</filename> and then execute:
778 <screen>
779 C:\WINDOWS: regedit ME-dpwc.reg
780 </screen>
781 </para></step>
783 <step><para>
784 Instruct all users to log onto the workstation using a name of their own
785 choosing, with a password of their own choosing. The Samba server has been
786 configured to ignore the username and password given.
787 </para></step>
789 <step><para>
790 On each Windows Me workstation, configure a network drive mapping to drive <filename>G:</filename>
791 that redirects to the uniform naming convention (UNC) resource
792 <filename>\\server\officefiles</filename>. Make this a permanent drive connection as follows:
793 <procedure>
794 <step><para>
795 <menuchoice>
796 <guimenu>(Right-click) My Network</guimenu>
797 <guimenuitem>Map Network Drive...</guimenuitem>
798 </menuchoice>
799 </para></step>
801 <step><para>
802 In the box labeled <quote>Drive:</quote>, type G.
803 </para></step>
805 <step><para>
806 In the box labeled <quote>Path:</quote>, enter
807 <filename>\\server\officefiles</filename>.
808 </para></step>
810 <step><para>
811 Click <guimenuitem>Reconnect at logon</guimenuitem>.
812 Click <guibutton>OK</guibutton>.
813 </para></step>
815 </procedure>
816 </para></step>
818 <step><para>
819 On each workstation, install the Funds Tracking and Management software following the
820 manufacturer's instructions.
821 <procedure>
822 <step><para>
823 During installation, you are prompted for the name of the Windows 98
824 server. Enter the name <constant>SERVER</constant>.
825 </para></step>
826 <step><para>
827 You are prompted for the name of the data share.
828 The prompt defaults to <constant>FTMFILES</constant>. Press enter to accept the default value.
829 </para></step>
830 <step><para>
831 You are now prompted for the print queue name. The default prompt is the name of
832 the server you entered (<constant>SERVER</constant> as follows:
833 <constant>\\SERVER\PRINTQ</constant>). Simply accept the default and press enter to
834 continue. The software now completes the installation.
835 </para></step>
836 </procedure>
837 </para></step>
839 <step><para>
840 Install an office automation software package of the customer's choice. Either Microsoft
841 Office 2003 Standard or OpenOffice 1.1.0 suffices for any functions the office may
842 need to perform. Repeat this on each workstation.
843 </para></step>
845 <step><para>
846 Install a printer on each using the following steps:
848 <procedure>
849 <step><para>
850 Click <menuchoice>
851 <guimenu>Start</guimenu>
852 <guimenuitem>Settings</guimenuitem>
853 <guimenuitem>Printers</guimenuitem>
854 <guiicon>Add Printer</guiicon>
855 <guibutton>Next</guibutton>
856 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
857 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
858 </para></step>
860 <step><para>
861 Click <guibutton>Next</guibutton>. In the panel labeled
862 <guimenuitem>Manufacturer:</guimenuitem>, select <constant>HP</constant>.
863 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
864 <constant>HP LaserJet 5/5M Postscript</constant>. Click <guibutton>Next</guibutton>.
865 </para></step>
867 <step><para>
868 In the panel labeled <guimenuitem>Available ports:</guimenuitem>, select
869 <constant>FILE:</constant>. Accept the default printer name by clicking
870 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
871 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
872 <guibutton>Finish</guibutton>.
873 </para></step>
875 <step><para>
876 You may be prompted for the name of a file to print to. If so, close the
877 dialog panel. Right-click <menuchoice>
878 <guiicon>HP LaserJet 5/5M Postscript</guiicon>
879 <guimenuitem>Properties</guimenuitem>
880 <guimenusub>Details (Tab)</guimenusub>
881 <guimenubutton>Add Port</guimenubutton>
882 </menuchoice>.
883 </para></step>
885 <step><para>
886 In the panel labeled <guimenuitem>Network</guimenuitem>, enter the name of
887 the print queue on the Samba server as follows: <constant>\\SERVER\hplj5</constant>.
888 Click <menuchoice>
889 <guibutton>OK</guibutton>
890 <guibutton>OK</guibutton>
891 </menuchoice> to complete the installation.
892 </para></step>
894 <step><para>
895 It is a good idea to test the functionality of the complete installation before
896 handing the newly configured network over to the Charity Administration Office
897 for production use.
898 </para></step>
900 </procedure>
902 </para></step>
904 </procedure>
906 </sect3>
908 <sect3>
909 <title>Validation</title>
911 <para>
912 Use the same validation process as was followed in <link linkend="validate1"/>.
913 </para>
915 </sect3>
917 </sect2>
919 <sect2 id="AccountingOffice">
920 <title>Accounting Office</title>
922 <para>
923 The office of Abmas Accounting Inc. is a 40-year-old family-run business. There are nine permanent
924 computer users. The network clients were upgraded two years ago. All computers run Windows 2000
925 Professional. This year the server will be upgraded from an old Windows NT4 server (actually
926 running Windows NT4 Workstation, which worked fine as there were fewer than 10 users) that has
927 run in workgroup (Stand-Alone) mode, to a new Linux server running Samba.
928 </para>
930 <para>
931 The office does not want a Domain Server. Mr. Alan Meany wants to keep the Windows 2000 Professional
932 clients running as workgroup machines so that any staff member can take a machine home and keep
933 working. It has worked well so far and your task is to replace the old server. All users have
934 their own workstation logon (you configured it that way when the machines were installed).
935 Mr. Meany wants the new system to operate the same way as the old Windows NT4 server &smbmdash; users
936 cannot access each others' files, but he can access everyone's files. Each person's work files are
937 in a separate share on the server. Users logon to their Windows workstation with their username
938 and enter an assigned password; they do not need to enter a password when accessing their files
939 on the server.
940 </para>
942 <para><indexterm>
943 <primary>Red Hat Linux</primary>
944 </indexterm>
945 The new server will run Red Hat Linux 9.0. You should install Samba-3.0.2 and
946 copy all files off the old system to the new one. The existing Windows NT4 server has a parallel
947 port HP LaserJet 4 printer that is shared by all. The printer driver is installed on each
948 workstation. You must not change anything on the workstations. Mr. Meany gave instructions to
949 replace the server <quote>but leave everything else alone to avoid staff unrest.</quote>
950 </para>
952 <para>
953 You have tried to educate Mr. Meany and found that he has no interest to understand networking.
954 He believes that Windows for Workgroups 3.11 was <quote>the best server Microsoft ever sold
955 </quote> and that Windows NT and 2000 are <quote>too fang-dangled complex!</quote>
956 </para>
958 <sect3>
959 <title>Dissection and Discussion</title>
961 <para>
962 <indexterm><primary>security</primary><secondary>user mode</secondary></indexterm>
963 The requirements of this network installation are not unusual. The staff are not interested in the
964 details of networking. Passwords are never changed. In this example solution, we demonstrate the use
965 of User Mode security in a simple context. Directories should be set SGID to ensure that members
966 of a common group can access the contents. Each user has his or her own share to which only they
967 can connect. Mr. Meany's share will be a top level directory above the share point for each employee.
968 Mr. Meany is a member of the same group as his staff and is able to access their work files.
969 The well used HP LaserJet 4 is available as a service called <constant>hplj</constant>.
970 </para>
972 <para>
973 You have finished configuring the new hardware and have just completed installation of Red Hat Linux
974 9.0. Roll up your sleeves and let's get to work.
975 </para>
977 </sect3>
979 <sect3 id="AcctgNet">
980 <title>Implementation</title>
982 <para>
983 The workstations have fixed IP addresses. The old server runs Windows NT4 Workstation, so it
984 cannot be running as a WINS server. It is best that the new configuration preserves the same
985 configuration. The office does not use Internet access, so security really is not an issue.
986 </para>
988 <para>
989 The core information regarding the users, their passwords, the directory share point, and the
990 share name is given in <link linkend="acctingnet"/>. The overall network topology is shown in
991 <link linkend="acctingnet2"/>. All machines have been configured as indicated prior to the
992 start of Samba configuration. The following prescriptive steps may now commence.
993 </para>
995 <figure id="acctingnet2">
996 <title>Accounting Office Network Topology</title>
997 <mediaobject>
998 <imageobject role="latex">
999 <imagedata fileref="guide/images/AccountingNetwork.png" scale="100" scalefit="1"/>
1000 </imageobject>
1001 <imageobject>
1002 <imagedata fileref="guide/images/AccountingNetwork.png" scale="100" scalefit="1"/>
1003 </imageobject>
1004 </mediaobject>
1005 </figure>
1007 <table id="acctingnet">
1008 <title>Accounting Office Network Information</title>
1009 <tgroup cols="6">
1010 <colspec align="left"/>
1011 <colspec align="left"/>
1012 <colspec align="left"/>
1013 <colspec align="left"/>
1014 <colspec align="left"/>
1015 <colspec align="left"/>
1016 <thead>
1017 <row>
1018 <entry>User</entry>
1019 <entry>Login-ID</entry>
1020 <entry>Password</entry>
1021 <entry>Share Name</entry>
1022 <entry>Directory</entry>
1023 <entry>Wkst</entry>
1024 </row>
1025 </thead>
1026 <tbody>
1027 <row>
1028 <entry>Alan Meany</entry>
1029 <entry>alan</entry>
1030 <entry>alm1961</entry>
1031 <entry>alan</entry>
1032 <entry>/data</entry>
1033 <entry>PC1</entry>
1034 </row>
1035 <row>
1036 <entry>James Meany</entry>
1037 <entry>james</entry>
1038 <entry>jimm1962</entry>
1039 <entry>james</entry>
1040 <entry>/data/james</entry>
1041 <entry>PC2</entry>
1042 </row>
1043 <row>
1044 <entry>Jeannie Meany</entry>
1045 <entry>jeannie</entry>
1046 <entry>jema1965</entry>
1047 <entry>jeannie</entry>
1048 <entry>/data/jeannie</entry>
1049 <entry>PC3</entry>
1050 </row>
1051 <row>
1052 <entry>Suzy Millicent</entry>
1053 <entry>suzy</entry>
1054 <entry>suzy1967</entry>
1055 <entry>suzy</entry>
1056 <entry>/data/suzy</entry>
1057 <entry>PC4</entry>
1058 </row>
1059 <row>
1060 <entry>Ursula Jenning</entry>
1061 <entry>ujen</entry>
1062 <entry>ujen1974</entry>
1063 <entry>ursula</entry>
1064 <entry>/data/ursula</entry>
1065 <entry>PC5</entry>
1066 </row>
1067 <row>
1068 <entry>Peter Pan</entry>
1069 <entry>peter</entry>
1070 <entry>pete1984</entry>
1071 <entry>peter</entry>
1072 <entry>/data/peter</entry>
1073 <entry>PC6</entry>
1074 </row>
1075 <row>
1076 <entry>Dale Roland</entry>
1077 <entry>dale</entry>
1078 <entry>dale1986</entry>
1079 <entry>dale</entry>
1080 <entry>/data/dale</entry>
1081 <entry>PC7</entry>
1082 </row>
1083 <row>
1084 <entry>Bertrand E Paoletti</entry>
1085 <entry>eric</entry>
1086 <entry>eric1993</entry>
1087 <entry>eric</entry>
1088 <entry>/data/eric</entry>
1089 <entry>PC8</entry>
1090 </row>
1091 <row>
1092 <entry>Russell Lewis</entry>
1093 <entry>russ</entry>
1094 <entry>russ2001</entry>
1095 <entry>russell</entry>
1096 <entry>/data/russell</entry>
1097 <entry>PC9</entry>
1098 </row>
1099 </tbody>
1100 </tgroup>
1101 </table>
1103 <?latex \newpage ?>
1105 <procedure>
1106 <title>Migration from Windows NT4 Workstation System to Samba-3</title>
1108 <step><para><indexterm>
1109 <primary>migration</primary>
1110 </indexterm>
1111 Rename the old server from <constant>CASHPOOL</constant> to <constant>STABLE</constant>
1112 by logging onto the console as the <constant>Administrator</constant>. Restart the machine
1113 following system prompts.
1114 </para></step>
1116 <step><para>
1117 Name the new server <constant>CASHPOOL</constant> using the standard configuration method.
1118 Restart the machine following system prompts.
1119 </para></step>
1121 <step><para>
1122 Install the latest Samba-3 binary Red Hat Linux RPM that is available from the
1123 Samba FTP site.
1124 </para></step>
1126 <step><para><indexterm>
1127 <primary>group account</primary>
1128 </indexterm><indexterm>
1129 <primary>groupadd</primary>
1130 </indexterm>
1131 Add a group account for the office to use. Execute the following:
1132 <screen>
1133 &rootprompt; groupadd accts
1134 </screen>
1135 </para></step>
1137 <step><para>
1138 Install the &smb.conf; file shown<footnote>This example makes use of the
1139 <parameter>smbpasswd</parameter> file. It does so in an obtuse way since the use of
1140 the <parameter>passdb backend</parameter> has not been specified in the &smb.conf;
1141 file. This means that you are depending on correct default behavior.</footnote>
1142 in <link linkend="acctconf"/>.
1143 </para></step>
1145 <step><para><indexterm>
1146 <primary>useradd</primary>
1147 </indexterm><indexterm>
1148 <primary>passwd</primary>
1149 </indexterm><indexterm>
1150 <primary>smbpasswd</primary>
1151 </indexterm>
1152 For each user who uses this system (see <link linkend="acctingnet"/>),
1153 execute the following:
1154 <screen>
1155 &rootprompt; useradd -m -G accts -c "Name of User" "LoginID"
1156 &rootprompt; passwd "LoginID"
1157 Changing password for user "LoginID"
1158 New Password: XXXXXXXXX <-- the password from the table
1159 Retype new password: XXXXXXXXX
1160 &rootprompt; smbpasswd -a "LoginID"
1161 New SMB password: XXXXXXXXX <-- the password from the table
1162 Retype new SMB password: XXXXXXXXX
1163 Added user "LoginID"
1164 </screen>
1165 </para></step>
1167 <step><para><indexterm>
1168 <primary>data storage</primary>
1169 </indexterm>
1170 Create the directory structure for the file shares by executing the following:
1171 <screen>
1172 &rootprompt; mkdir -p /data
1173 &rootprompt; chown alan /data
1174 &rootprompt; for i in james suzy ursula peter dale eric jeannie russell
1175 > do
1176 > mkdir -p /data/$i
1177 > chown $i /data/$i
1178 > done
1179 &rootprompt; chgrp -R accts /data
1180 &rootprompt; chmod -R ug+rwxs,o-r+x /data
1181 </screen>
1182 The data storage structure is now prepared for use.
1183 </para></step>
1185 <step><para><indexterm>
1186 <primary>lpadmin</primary>
1187 </indexterm>
1188 Configure the CUPS Print Queues as follows:
1189 <screen>
1190 &rootprompt; lpadmin -p hplj -v parallel:/dev/lp0 -E
1191 </screen>
1192 This creates the necessary print queues with no assigned print filter.
1193 </para></step>
1195 <step><para>
1196 <indexterm><primary>mime types</primary></indexterm><indexterm>
1197 <primary>/etc/cups/mime.convs</primary>
1198 </indexterm>
1199 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
1200 <screen>
1201 application/octet-stream application/vnd.cups-raw 0 -
1202 </screen>
1203 </para></step>
1205 <step><para><indexterm>
1206 <primary>/etc/cups/mime.types</primary>
1207 </indexterm><indexterm>
1208 <primary>application/octet-stream</primary>
1209 </indexterm>
1210 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
1211 <screen>
1212 application/octet-stream
1213 </screen>
1214 </para></step>
1216 <step><para>
1217 <indexterm><primary>starting samba</primary></indexterm>
1218 Use the standard system tool to start Samba and CUPS to configure them to restart
1219 automatically at every system reboot. For example:
1220 </para>
1222 <para>
1223 <indexterm><primary>starting samba</primary></indexterm>
1224 <indexterm><primary>starting
1225 CUPS</primary></indexterm><indexterm>
1226 <primary>chkconfig</primary>
1227 </indexterm>
1228 <screen>
1229 &rootprompt; chkconfig smb on
1230 &rootprompt; chkconfig cups on
1231 &rootprompt; /etc/rc.d/init.d/smb restart
1232 &rootprompt; /etc/rc.d/init.d/cups restart
1233 </screen>
1234 </para></step>
1236 <step><para>
1237 On Alan's workstation, use Windows explorer to migrate the files from the old server
1238 to the new server. The new server should appear in the <guimenu>Network Neighborhood</guimenu>
1239 with the name of the old server (<constant>CASHPOOL</constant>).
1241 <procedure>
1243 <step><para>
1244 Logon to Alan's workstation as the user <constant>alan</constant>.
1245 </para></step>
1247 <step><para>
1248 Launch a second instance of Windows explorer and navigate to the share called
1249 <guiicon>files</guiicon> on the server called <guimenu>STABLE</guimenu>.
1250 </para></step>
1252 <step><para>
1253 Click in the right panel, and press <guimenu>Ctrl-A</guimenu> to select all files and
1254 directories. Press <guimenu>Ctrl-C</guimenu> to instruct Windows that you wish to
1255 copy all selected items.
1256 </para></step>
1258 <step><para>
1259 Launch the Windows explorer, and navigate to the share called <guiicon>files</guiicon>
1260 on the server called <guimenu>CASHPOOL</guimenu>. Click in the right panel, and then press
1261 <guimenu>Ctrl-V</guimenu> to commence the copying process.
1262 </para></step>
1264 </procedure>
1265 </para></step>
1267 <step><para>
1268 Verify that the files are being copied correctly from the Windows NT4 machine to the Samba-3 server.
1269 This is best done on the Samba-3 server. Check the contents of the directory tree under
1270 <filename>/data</filename>. This can be done by executing the following command:
1271 <screen>
1272 &rootprompt; ls -aR /data
1273 </screen>
1274 Make certain to check the ownership and permissions on all files. If in doubt, execute the following:
1275 <screen>
1276 &rootprompt; chown alan /data
1277 &rootprompt; for i in james suzy ursula peter dale eric jeannie russell
1278 > do
1279 > chown $i /data/$i
1280 > done
1281 &rootprompt; chgrp -R accts /data
1282 &rootprompt; chmod -R ug+rwxs,o-r+x /data
1283 </screen>
1284 </para></step>
1286 <step><para>
1287 The migration of all data should now be complete. It is time to validate the installation.
1288 For this, you should make sure all applications, including printing, work before asking the
1289 customer to test drive the new network.
1290 </para></step>
1292 </procedure>
1294 <smbconfexample id="acctconf">
1295 <title>Accounting Office Network &smb.conf; File</title>
1296 <smbconfcomment>Global parameters</smbconfcomment>
1297 <smbconfsection>[global]</smbconfsection>
1298 <smbconfoption><name>workgroup</name><value>BILLMORE</value></smbconfoption>
1299 <smbconfoption><name>printing</name><value>CUPS</value></smbconfoption>
1300 <smbconfoption><name>printcap name</name><value>CUPS</value></smbconfoption>
1301 <smbconfoption><name>disable spoolss</name><value>Yes</value></smbconfoption>
1302 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
1304 <smbconfsection>[files]</smbconfsection>
1305 <smbconfoption><name>comment</name><value>Work area files</value></smbconfoption>
1306 <smbconfoption><name>path</name><value>/data/%U</value></smbconfoption>
1307 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
1308 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1310 <smbconfsection>[master]</smbconfsection>
1311 <smbconfoption><name>comment</name><value>Master work area files</value></smbconfoption>
1312 <smbconfoption><name>path</name><value>/data</value></smbconfoption>
1313 <smbconfoption><name>valid users</name><value>alan</value></smbconfoption>
1314 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1316 <smbconfsection>[printers]</smbconfsection>
1317 <smbconfoption><name>comment</name><value>Print Temporary Spool Configuration</value></smbconfoption>
1318 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
1319 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
1320 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
1321 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
1322 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
1323 </smbconfexample>
1325 </sect3>
1326 </sect2>
1327 </sect1>
1329 <sect1>
1330 <title>Questions and Answers</title>
1332 <para>
1333 The following questions and answers draw from the examples in this chapter.
1334 Many design decisions are impacted by the configurations chosen. The intent
1335 is to expose some of the hidden implications.
1336 </para>
1338 <qandaset defaultlabel="chap02qa" type="number">
1339 <qandaentry>
1340 <question>
1342 <para>
1343 What makes an anonymous Samba server more simple than an non-anonymous Samba server?
1344 </para>
1346 </question>
1347 <answer>
1349 <para>
1350 In the anonymous server, the only account used is the <constant>guest</constant> account.
1351 In a non-anonymous configuration, it is necessary to add real user accounts to both the
1352 UNIX system and to the Samba configuration. Non-anonymous servers require additional
1353 administration.
1354 </para>
1356 </answer>
1357 </qandaentry>
1359 <qandaentry>
1360 <question>
1362 <para>
1363 How is the operation of the parameter <parameter>force user</parameter> different from
1364 setting the root directory of the share SUID?
1365 </para>
1367 </question>
1368 <answer>
1370 <para>
1371 The parameter <parameter>force user</parameter> causes all operations on the share to assume the UID
1372 of the forced user. The new default GID that applies is the primary GID of the forced user.
1373 This gives all users of this resource the actual privilege of the forced user.
1374 </para>
1376 <para>
1377 When a directory is set SUID, the operating system forces files that are written within it
1378 to be owned by the owner of the directory. While this happens, the user who is using the share
1379 has only the level of privilege he or she is assigned within the operating system context.
1380 </para>
1382 <para>
1383 The parameter <parameter>force user</parameter> has potential security implications that go
1384 beyond the actual share root directory. Be careful and wary of using this parameter.
1385 </para>
1387 </answer>
1388 </qandaentry>
1390 <qandaentry>
1391 <question>
1393 <para>
1394 When would you use both the per share parameter <parameter>force user</parameter> as well
1395 as setting the share root directory SUID?
1396 </para>
1398 </question>
1399 <answer>
1401 <para>
1402 You would use both parameters when it is necessary to guarantee that all share handling operations
1403 are conducted as the forced user, while all file and directory creation are done as the SUID
1404 directory owner.
1405 </para>
1407 </answer>
1408 </qandaentry>
1410 <qandaentry>
1411 <question>
1413 <para>
1414 What is better about CUPS printing than LPRng printing?
1415 </para>
1417 </question>
1418 <answer>
1420 <para>
1421 CUPS is a print spooling system that has integrated remote management facilities, provides completely
1422 automated print processing/preprocessing, and has the potential to be configured to automatically
1423 apply print preprocessing filters to ensure that a print job submitted is correctly rendered for the
1424 target printer. CUPS includes an image file RIP that supports printing of image files to
1425 non-PostScript printers. CUPS has lots of bells and whistles and is more like a super-charged MS Windows
1426 NT/200x print monitor and processor. Its complexity can be eliminated or turbo-charged to suit
1427 any fancy.
1428 </para>
1430 <para>
1431 The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print
1432 spooler functionality. It provides the same interface and meets RFC1179 requirements. LPRng is capable
1433 of being configured to act like CUPS, but it is in principle a replacement for the old Berkeley lpr/lpd
1434 spooler. LPRng is generally preferred by those who are familiar with Berkeley lpr/lpd.
1435 </para>
1437 <para>
1438 Which is better is a matter of personal taste. It depends on what you want to do and how you want to
1439 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system.
1440 </para>
1442 </answer>
1443 </qandaentry>
1445 <qandaentry>
1446 <question>
1448 <para>
1449 When should Windows client IP addresses be hard coded?
1450 </para>
1452 </question>
1453 <answer>
1455 <para>
1456 When there are few MS Windows clients, little client change, no mobile users, and users are not
1457 inclined to tamper with network settings, it is a safe and convenient matter to hard-code Windows
1458 client TCP/IP settings. Given that it is possible to lock down the Windows desktop and remove
1459 user ability to access network configuration controls, fixed configuration eliminates the need
1460 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network
1461 failure.
1462 </para>
1464 </answer>
1465 </qandaentry>
1467 <qandaentry>
1468 <question>
1470 <para>
1471 Under what circumstances would it be best to use a DHCP server?
1472 </para>
1474 </question>
1475 <answer>
1477 <para>
1478 In network configurations where there are mobile users, or where Windows client PCs move around
1479 (particularly between offices or between subnets), it makes complete sense to control all Windows
1480 client configurations using a DHCP server. Additionally, when users do tamper with the network
1481 settings, the use of DHCP can be used to normalize all client settings.
1482 </para>
1484 <para>
1485 One of the least appreciated benefits of using a DHCP server to assign all network client
1486 device TCP/IP settings is that it makes it a pain-free process to change network TCP/IP
1487 settings, change network addressing, or enhance the ability of client devices to
1488 benefit from new network services.
1489 </para>
1491 <para>
1492 Another benefit of modern DHCP servers is the ability of the DHCP server to register dynamically
1493 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in
1494 a large Windows network environment.
1495 </para>
1497 </answer>
1498 </qandaentry>
1500 <qandaentry>
1501 <question>
1503 <para>
1504 What is the purpose of setting the parameter <parameter>guest ok</parameter> on a share?
1505 </para>
1507 </question>
1508 <answer>
1510 <para>
1511 If this parameter is yes for a service, then no password is required to connect to the service.
1512 Privileges are those of the guest account.
1513 </para>
1515 </answer>
1516 </qandaentry>
1518 <qandaentry>
1519 <question>
1521 <para>
1522 When would you set the global parameter <parameter>disable spoolss</parameter>?
1523 </para>
1525 </question>
1526 <answer>
1528 <para>
1529 Setting this parameter to <constant>Yes</constant> disables Samba's support for the SPOOLSS set of
1530 MS-RPC's and yields behavior identical to Samba 2.0.x. Windows NT/2000 clients can downgrade to
1531 using LanMan style printing commands. Windows 9x/ME are unaffected by the parameter. However, this
1532 disables the ability to upload printer drivers to a Samba server via the Windows NT/200x Add Printer
1533 Wizard or by using the NT printer properties dialog window. It also disables the capability of
1534 Windows NT/200x clients to download print drivers from the Samba host on demand. Be extremely careful about
1535 setting this parameter.
1536 </para>
1538 <para>
1539 The alternate parameter <parameter>use client driver</parameter> applies only to Windows NT/200x clients. It has no
1540 effect on Windows 95/98/ME clients. When serving a printer to Windows NT/200x clients without first installing a valid
1541 printer driver on the Samba host, the client is required to install a local printer driver. From this point on,
1542 the client treats the printer as a local printer and not a network printer connection. This is much the same behavior
1543 that occurs when <parameter>disable spoolss = yes</parameter>.
1544 </para>
1546 <para>
1547 Under normal circumstances, the NT/200x client attempts to open the network printer using MS-RPC. Because the client
1548 considers the printer to be local, it attempts to issue the OpenPrinterEx() call requesting access rights associated
1549 with the logged on user. If the user possesses local administrator rights but not root privilege on the Samba host (often
1550 the case), the OpenPrinterEx() call fails. The result is that the client now displays an "Access Denied; Unable
1551 to connect" message in the printer queue window (even though jobs may be printed successfully). This parameter MUST
1552 not be enabled on a print share that has valid print driver installed on the Samba server.
1553 </para>
1555 </answer>
1556 </qandaentry>
1558 <qandaentry>
1559 <question>
1561 <para>
1562 Why would you disable password caching on Windows 9x/Me clients?
1563 </para>
1565 </question>
1566 <answer>
1568 <para>
1569 Windows 9x/Me workstations that are set at default (password caching enabled) store the username and
1570 password in files located in the Windows master directory. Such files can be scavenged (read off a client
1571 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed.
1572 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled.
1573 </para>
1575 </answer>
1576 </qandaentry>
1578 <qandaentry>
1579 <question>
1581 <para>
1582 The example of Abmas Accounting Inc. uses User Mode security. How does this provide anonymous access?
1583 </para>
1585 </question>
1586 <answer>
1588 <para>
1589 The example used does not provide anonymous access. Since the clients are all Windows 2000 Professional,
1590 and given that users are logging onto their machines, by default the client attempts to connect to
1591 a remote server using currently logged in user credentials. By ensuring that the user's login ID and
1592 password is the same as those set on the Samba server, access is transparent and does not require
1593 separate user authentication.
1594 </para>
1596 </answer>
1597 </qandaentry>
1599 </qandaset>
1601 </sect1>
1603 </chapter>