| blob | 8b8aba656baaac08413be1525db1a6d5c1774b93 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="FastStart">
4 <chapterinfo>
5 &author.jht;
6 </chapterinfo>
8 <title>Fast Start: Cure for Impatience</title>
10 <para>
11 When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
12 someone wrote asking for example configurations &smbmdash; and lots of them. That is remarkably
13 difficult to do, without losing a lot of value that can be derived from presenting
14 many extracts from working systems. That is what the rest of this document does.
15 It does so with extensive descriptions of the configuration possibilities within the
16 context of the chapter that covers it. We hope that this chapter is the medicine
17 that has been requested.
18 </para>
20 <sect1>
21 <title>Features and Benefits</title>
23 <para>
24 Samba needs very little configuration to create a basic working system.
25 In this chapter we progress from the simple to the complex, for each providing
26 all steps and configuration file changes needed to make each work. Please note
27 that a comprehensively configured system will likely employ additional smart
28 features. The additional features are covered in the remainder of this document.
29 </para>
31 <para>
32 The examples used here have been obtained from a number of people who made
33 requests for example configurations. All identities have been obscured to protect
34 the guilty and any resemblance to unreal non-existent sites is deliberate.
35 </para>
37 </sect1>
39 <sect1>
40 <title>Description of Example Sites</title>
42 <para>
43 In the first set of configuration examples we consider the case of exceptionally simple
44 system requirements. There is a real temptation to make something that should require
45 little effort much too complex.
46 </para>
48 <para>
49 <link linkend="anon-ro"></link> documents the type of server that might be sufficient to serve CD-ROM
50 images, or reference document files for network client use. This configuration is also discussed in
51 <link linkend="StandAloneServer"></link>, <link linkend="RefDocServer"></link>.
52 The purpose for this configuration is to provide a shared volume that is read-only that anyone, even guests, can access.
53 </para>
55 <para>
56 The second example shows a minimal configuration for a print server that anyone can print
57 to as long as they have the correct printer drivers installed on their computer. This is a
58 mirror of the system described in <link linkend="StandAloneServer"></link>, <link linkend="SimplePrintServer"></link>.
59 </para>
61 <para>
62 The next example is of a secure office file and print server that will be accessible only
63 to users who have an account on the system. This server is meant to closely resemble a
64 Workgroup file and print server, but has to be more secure than an anonymous access machine.
65 This type of system will typically suit the needs of a small office. The server does not
66 provide network logon facilities, offers no Domain Control, instead it is just a network
67 attached storage (NAS) device and a print server.
68 </para>
70 <para>
71 Finally, we start looking at more complex systems that will either integrate into existing
72 Microsoft Windows networks, or replace them entirely. The examples provided cover domain
73 member servers as well as Samba Domain Control (PDC/BDC) and finally describes in detail
74 a large distributed network with branch offices in remote locations.
75 </para>
77 </sect1>
79 <sect1>
80 <title>Worked Examples</title>
82 <para>
83 The configuration examples are designed to cover everything necessary to get Samba
84 running. They do not cover basic operating system platform configuration, which is
85 clearly beyond the scope of this text.
86 </para>
88 <para>
89 It is also assumed that Samba has been correctly installed, either by way of installation
90 of the packages that are provided by the operating system vendor, or through other means.
91 </para>
93 <sect2>
94 <title>Stand-alone Server</title>
96 <para>
97 <indexterm><primary>Server Type</primary><secondary>Stand-alone</secondary></indexterm>
98 A Stand-alone Server implies no more than the fact that it is not a Domain Controller
99 and it does not participate in Domain Control. It can be a simple workgroup-like
100 server, or it may be a complex server that is a member of a domain security context.
101 </para>
103 <sect3 id="anon-ro">
104 <title>Anonymous Read-Only Document Server</title>
106 <para>
107 <indexterm><primary>read only</primary><secondary>server</secondary></indexterm>
108 The purpose of this type of server is to make available to any user
109 any documents or files that are placed on the shared resource. The
110 shared resource could be a CD-ROM drive, a CD-ROM image, or a file
111 storage area.
112 </para>
114 <para>
115 As the examples are developed, every attempt is made to progress the
116 system toward greater capability, just as one might expect would happen
117 in a real business office as that office grows in size and its needs
118 change.
119 </para>
121 <para>The configuration file is:</para>
123 <para><smbconfexample id="anon-example">
124 <title>Anonymous Read-Only Server Configuration</title>
125 <smbconfcomment>Global parameters</smbconfcomment>
126 <smbconfsection>[global]</smbconfsection>
127 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
128 <smbconfoption name="netbios name">HOBBIT</smbconfoption>
129 <smbconfoption name="security">share</smbconfoption>
131 <smbconfsection>[data]</smbconfsection>
132 <smbconfoption name="comment">Data</smbconfoption>
133 <smbconfoption name="path">/export</smbconfoption>
134 <smbconfoption name="read only">Yes</smbconfoption>
135 <smbconfoption name="guest ok">Yes</smbconfoption>
136 </smbconfexample>
137 </para>
139 <itemizedlist>
140 <listitem><para>
141 The file system share point will be <filename>/export</filename>.
142 </para></listitem>
144 <listitem><para>
145 All files will be owned by a user called Jack Baumbach.
146 Jack's login name will be <emphasis>jackb</emphasis>. His password will be
147 <emphasis>m0r3pa1n</emphasis> &smbmdash; of course, that's just the example we are
148 using; do not use this in a production environment because
149 all readers of this document will know it.
150 </para></listitem>
151 </itemizedlist>
153 <procedure>
154 <title>Installation Procedure &smbmdash; Read-Only Server</title>
155 <step><para>
156 Add user to system (with creation of the users' home directory):
157 <screen>
158 &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
159 </screen>
160 </para></step>
162 <step><para>
163 Create directory, and set permissions and ownership:
164 <screen>
165 &rootprompt;<userinput>mkdir /export</userinput>
166 &rootprompt;<userinput>chmod u+rwx,g+rx,o+rx /export</userinput>
167 &rootprompt;<userinput>chown jackb.users /export</userinput>
168 </screen>
169 </para></step>
171 <step><para>
172 Copy the files that should be shared to the <filename>/export</filename>
173 directory.
174 </para></step>
176 <step><para>
177 Install the Samba configuration file (<filename>/etc/samba/smb.conf</filename>)
178 as shown.
179 </para></step>
181 <step><para>
182 Test the configuration file:
183 <screen>
184 &rootprompt;<userinput>testparm</userinput>
185 </screen>
186 Note any error messages that might be produced. Do not proceed until you
187 obtain error-free output. An example of the output with the following file
188 will list the file.
189 <screen>
190 Load smb config files from /etc/samba/smb.conf
191 Processing section "[data]"
192 Loaded services file OK.
193 Server role: ROLE_STANDALONE
194 Press enter to see a dump of your service definitions
195 <userinput>[Press enter]</userinput>
197 # Global parameters
198 [global]
199 workgroup = MIDEARTH
200 netbios name = HOBBIT
201 security = share
203 [data]
204 comment = Data
205 path = /export
206 read only = Yes
207 guest only = Yes
208 </screen>
209 </para></step>
211 <step><para>
212 Start Samba using the method applicable to your operating system
213 platform.
214 </para></step>
216 <step><para>
217 Configure your Microsoft Windows client for workgroup <emphasis>MIDEARTH</emphasis>,
218 set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
219 then open Windows Explorer and visit the network neighborhood.
220 The machine HOBBIT should be visible. When you click this machine
221 icon, it should open up to reveal the <emphasis>data</emphasis> share. After
222 clicking the share it, should open up to reveal the files previously
223 placed in the <filename>/export</filename> directory.
224 </para></step>
225 </procedure>
227 <para>
228 The information above (following # Global parameters) provides the complete
229 contents of the <filename>/etc/samba/smb.conf</filename> file.
230 </para>
232 </sect3>
234 <sect3>
235 <title>Anonymous Read-Write Document Server</title>
237 <para>
238 <indexterm><primary>anonymous</primary><secondary>read-write server</secondary></indexterm>
239 We should view this configuration as a progression from the previous example.
240 The difference is that shared access is now forced to the user identity of jackb
241 and to the primary group jackb belongs to. One other refinement we can make is to
242 add the user <emphasis>jackb</emphasis> to the <filename>smbpasswd</filename> file.
243 To do this execute:
244 <screen>
245 &rootprompt;<userinput>smbpasswd -a jackb</userinput>
246 New SMB password: <userinput>m0r3pa1n</userinput>
247 Retype new SMB password: <userinput>m0r3pa1n</userinput>
248 Added user jackb.
249 </screen>
250 Addition of this user to the <filename>smbpasswd</filename> file allows all files
251 to be displayed in the Explorer Properties boxes as belonging to <emphasis>jackb</emphasis>
252 instead of to <emphasis>User Unknown</emphasis>.
253 </para>
255 <para>
256 The complete, modified &smb.conf; file is as shown in <link linkend="anon-rw"/>.
257 </para>
259 <para>
260 <smbconfexample id="anon-rw"><title>Modified Anonymous Read-Write smb.conf</title>
261 <smbconfcomment>Global parameters</smbconfcomment>
262 <smbconfsection>[global]</smbconfsection>
263 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
264 <smbconfoption name="netbios name">HOBBIT</smbconfoption>
265 <smbconfoption name="security">SHARE</smbconfoption>
267 <smbconfsection>[data]</smbconfsection>
268 <smbconfoption name="comment">Data</smbconfoption>
269 <smbconfoption name="path">/export</smbconfoption>
270 <smbconfoption name="force user">jackb</smbconfoption>
271 <smbconfoption name="force group">users</smbconfoption>
272 <smbconfoption name="read only">No</smbconfoption>
273 <smbconfoption name="guest ok">Yes</smbconfoption>
274 </smbconfexample>
275 </para>
277 </sect3>
279 <sect3>
280 <title>Anonymous Print Server</title>
282 <para>
283 <indexterm><primary>anonymous</primary><secondary>print server</secondary></indexterm>
284 An anonymous print server serves two purposes:
285 </para>
287 <itemizedlist>
288 <listitem><para>
289 It allows printing to all printers from a single location.
290 </para></listitem>
292 <listitem><para>
293 It reduces network traffic congestion due to many users trying
294 to access a limited number of printers.
295 </para></listitem>
296 </itemizedlist>
298 <para>
299 In the simplest of anonymous print servers, it is common to require the installation
300 of the correct printer drivers on the Windows workstation. In this case the print
301 server will be designed to just pass print jobs through to the spooler, and the spooler
302 should be configured to do raw pass-through to the printer. In other words, the print
303 spooler should not filter or process the data stream being passed to the printer.
304 </para>
306 <para>
307 In this configuration it is undesirable to present the Add Printer Wizard and we do
308 not want to have automatic driver download, so we will disable it in the following
309 configuration. <link linkend="anon-print"></link> is the resulting &smb.conf; file.
310 </para>
312 <para>
313 <smbconfexample id="anon-print"><title>Anonymous Print Server smb.conf</title>
314 <smbconfcomment>Global parameters</smbconfcomment>
315 <smbconfsection>[global]</smbconfsection>
316 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
317 <smbconfoption name="netbios name">LUTHIEN</smbconfoption>
318 <smbconfoption name="security">share</smbconfoption>
319 <smbconfoption name="printcap name">cups</smbconfoption>
320 <smbconfoption name="disable spoolss">Yes</smbconfoption>
321 <smbconfoption name="show add printer wizard">No</smbconfoption>
322 <smbconfoption name="printing">cups</smbconfoption>
324 <smbconfsection>[printers]</smbconfsection>
325 <smbconfoption name="comment">All Printers</smbconfoption>
326 <smbconfoption name="path">/var/spool/samba</smbconfoption>
327 <smbconfoption name="guest ok">Yes</smbconfoption>
328 <smbconfoption name="printable">Yes</smbconfoption>
329 <smbconfoption name="use client driver">Yes</smbconfoption>
330 <smbconfoption name="browseable">No</smbconfoption>
331 </smbconfexample>
332 </para>
334 <para>
335 The above configuration is not ideal. It uses no smart features, and it deliberately
336 presents a less than elegant solution. But it is basic, and it does print.
337 </para>
339 <note><para>
340 Windows users will need to install a local printer and then change the print
341 to device after installation of the drivers. The print to device can then be set to
342 the network printer on this machine.
343 </para></note>
345 <para>
346 Make sure that the directory <filename>/var/spool/samba</filename> is capable of being used
347 as intended. The following steps must be taken to achieve this:
348 </para>
350 <itemizedlist>
351 <listitem><para>
352 The directory must be owned by the superuser (root) user and group:
353 <screen>
354 &rootprompt;<userinput>chown root.root /var/spool/samba</userinput>
355 </screen>
356 </para></listitem>
358 <listitem><para>
359 Directory permissions should be set for public read-write with the
360 sticky-bit set as shown:
361 <screen>
362 &rootprompt;<userinput>chmod a+rw TX /var/spool/samba</userinput>
363 </screen>
364 </para></listitem>
365 </itemizedlist>
368 <note><para>
369 <indexterm><primary>MIME</primary><secondary>raw</secondary></indexterm>
370 <indexterm><primary>raw printing</primary></indexterm>
371 On CUPS enabled systems there is a facility to pass raw data directly to the printer without
372 intermediate processing via CUPS print filters. Where use of this mode of operation is desired
373 it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
374 handler in the <filename>/etc/mime.conv</filename> and <filename>/etc/mime.types</filename>
375 files. Refer to <link linkend="cups-raw"></link>.
376 </para></note>
378 </sect3>
380 <sect3>
382 <title>Secure Read-Write File and Print Server</title>
384 <para>
385 We progress now from simple systems to a server that is slightly more complex.
386 </para>
388 <para>
389 Our new server will require a public data storage area in which only authenticated
390 users (i.e., those with a local account) can store files, as well as a home directory.
391 There will be one printer that should be available for everyone to use.
392 </para>
394 <para>
395 In this hypothetical environment (no espionage was conducted to obtain this data),
396 the site is demanding a simple environment that is <emphasis>secure enough</emphasis>
397 but not too difficult to use.
398 </para>
400 <para>
401 Site users will be: Jack Baumbach, Mary Orville and Amed Sehkah. Each will have
402 a password (not shown in further examples). Mary will be the printer administrator and will
403 own all files in the public share.
404 </para>
406 <para>
407 This configuration will be based on <emphasis>User Level Security</emphasis> that
408 is the default, and for which the default is to store Microsoft Windows-compatible
409 encrypted passwords in a file called <filename>/etc/samba/smbpasswd</filename>.
410 The default &smb.conf; entry that makes this happen is:
411 <smbconfoption name="passdb backend">smbpasswd, guest</smbconfoption>. Since this is the default
412 it is not necessary to enter it into the configuration file. Note that guest backend is
413 added to the list of active passdb backends not matter was it specified directly in Samba configuration
414 file or not.
415 </para>
418 <procedure>
419 <title>Installing the Secure Office Server</title>
420 <step><para>
421 <indexterm><primary>office server</primary></indexterm>
422 Add all users to the Operating System:
423 <screen>
424 &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
425 &rootprompt;<userinput>useradd -c "Mary Orville" -m -g users -p secret maryo</userinput>
426 &rootprompt;<userinput>useradd -c "Amed Sehkah" -m -g users -p secret ameds</userinput>
427 </screen>
428 </para></step>
430 <step><para>
431 Configure the Samba &smb.conf; file as shown in <link linkend="OfficeServer"/>.
432 <smbconfexample id="OfficeServer">
433 <title>Secure Office Server smb.conf</title>
434 <smbconfcomment>Global parameters</smbconfcomment>
435 <smbconfsection>[global]</smbconfsection>
436 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
437 <smbconfoption name="netbios name">OLORIN</smbconfoption>
438 <smbconfoption name="printcap name">cups</smbconfoption>
439 <smbconfoption name="disable spoolss">Yes</smbconfoption>
440 <smbconfoption name="show add printer wizard">No</smbconfoption>
441 <smbconfoption name="printing">cups</smbconfoption>
443 <smbconfsection>[homes]</smbconfsection>
444 <smbconfoption name="comment">Home Directories</smbconfoption>
445 <smbconfoption name="valid users">%S</smbconfoption>
446 <smbconfoption name="read only">No</smbconfoption>
447 <smbconfoption name="browseable">No</smbconfoption>
449 <smbconfsection>[public]</smbconfsection>
450 <smbconfoption name="comment">Data</smbconfoption>
451 <smbconfoption name="path">/export</smbconfoption>
452 <smbconfoption name="force user">maryo</smbconfoption>
453 <smbconfoption name="force group">users</smbconfoption>
454 <smbconfoption name="guest ok">Yes</smbconfoption>
455 <smbconfoption name="read only">No</smbconfoption>
457 <smbconfsection>[printers]</smbconfsection>
458 <smbconfoption name="comment">All Printers</smbconfoption>
459 <smbconfoption name="path">/var/spool/samba</smbconfoption>
460 <smbconfoption name="printer admin">root, maryo</smbconfoption>
461 <smbconfoption name="create mask">0600</smbconfoption>
462 <smbconfoption name="guest ok">Yes</smbconfoption>
463 <smbconfoption name="printable">Yes</smbconfoption>
464 <smbconfoption name="use client driver">Yes</smbconfoption>
465 <smbconfoption name="browseable">No</smbconfoption>
466 </smbconfexample>
467 </para></step>
469 <step><para>
470 Initialize the Microsoft Windows password database with the new users:
471 <screen>
472 &rootprompt;<userinput>smbpasswd -a root</userinput>
473 New SMB password: <userinput>bigsecret</userinput>
474 Reenter smb password: <userinput>bigsecret</userinput>
475 Added user root.
477 &rootprompt;<userinput>smbpasswd -a jackb</userinput>
478 New SMB password: <userinput>m0r3pa1n</userinput>
479 Retype new SMB password: <userinput>m0r3pa1n</userinput>
480 Added user jackb.
482 &rootprompt;<userinput>smbpasswd -a maryo</userinput>
483 New SMB password: <userinput>secret</userinput>
484 Reenter smb password: <userinput>secret</userinput>
485 Added user maryo.
487 &rootprompt;<userinput>smbpasswd -a ameds</userinput>
488 New SMB password: <userinput>mysecret</userinput>
489 Reenter smb password: <userinput>mysecret</userinput>
490 Added user ameds.
491 </screen>
492 </para></step>
494 <step><para>
495 Install printer using the CUPS Web interface. Make certain that all
496 printers that will be shared with Microsoft Windows clients are installed
497 as raw printing devices.
498 </para></step>
500 <step><para>
501 Start Samba using the operating system administrative interface.
502 Alternately, this can be done manually by running:
503 <indexterm><primary>smbd</primary></indexterm>
504 <indexterm><primary>nmbd</primary></indexterm>
505 <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
506 <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
507 <screen>
508 &rootprompt;<userinput> nmbd; smbd;</userinput>
509 </screen>
510 </para></step>
512 <step><para>
513 Configure the <filename>/export</filename> directory:
514 <screen>
515 &rootprompt;<userinput>mkdir /export</userinput>
516 &rootprompt;<userinput>chown maryo.users /export</userinput>
517 &rootprompt;<userinput>chmod u=rwx,g=rwx,o-rwx /export</userinput>
518 </screen>
519 </para></step>
521 <step><para>
522 Check that Samba is running correctly:
523 <screen>
524 &rootprompt;<userinput>smbclient -L localhost -U%</userinput>
525 Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.0]
527 Sharename Type Comment
528 --------- ---- -------
529 public Disk Data
530 IPC$ IPC IPC Service (Samba-3.0.0)
531 ADMIN$ IPC IPC Service (Samba-3.0.0)
532 hplj4 Printer hplj4
534 Server Comment
535 --------- -------
536 OLORIN Samba-3.0.0
538 Workgroup Master
539 --------- -------
540 MIDEARTH OLORIN
541 </screen>
542 </para></step>
544 <step><para>
545 Connect to OLORIN as maryo:
546 <screen>
547 &rootprompt;<userinput>smbclient //olorin/maryo -Umaryo%secret</userinput>
548 OS=[UNIX] Server=[Samba-3.0.0]
549 smb: \> <userinput>dir</userinput>
550 . D 0 Sat Jun 21 10:58:16 2003
551 .. D 0 Sat Jun 21 10:54:32 2003
552 Documents D 0 Fri Apr 25 13:23:58 2003
553 DOCWORK D 0 Sat Jun 14 15:40:34 2003
554 OpenOffice.org D 0 Fri Apr 25 13:55:16 2003
555 .bashrc H 1286 Fri Apr 25 13:23:58 2003
556 .netscape6 DH 0 Fri Apr 25 13:55:13 2003
557 .mozilla DH 0 Wed Mar 5 11:50:50 2003
558 .kermrc H 164 Fri Apr 25 13:23:58 2003
559 .acrobat DH 0 Fri Apr 25 15:41:02 2003
561 55817 blocks of size 524288. 34725 blocks available
562 smb: \> <userinput>q</userinput>
563 </screen>
564 </para></step>
565 </procedure>
567 <para>
568 By now you should be getting the hang of configuration basics. Clearly, it is time to
569 explore slightly more complex examples. For the remainder of this chapter we will abbreviate
570 instructions since there are previous examples.
571 </para>
573 </sect3>
575 </sect2>
577 <sect2>
578 <title>Domain Member Server</title>
581 <para>
582 <indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
583 In this instance we will consider the simplest server configuration we can get away with
584 to make an accounting department happy. Let's be warned, the users are accountants and they
585 do have some nasty demands. There is a budget for only one server for this department.
586 </para>
588 <para>
589 The network is managed by an internal Information Services Group (ISG), to which we belong.
590 Internal politics are typical of a medium-sized organization; Human Resources is of the
591 opinion that they run the ISG because they are always adding and disabling users. Also,
592 departmental managers have to fight tooth and nail to gain basic network resources access for
593 their staff. Accounting is different though, they get exactly what they want. So this should
594 set the scene.
595 </para>
597 <para>
598 We will use the users from the last example. The accounting department
599 has a general printer that all departmental users may. There is also a check printer
600 that may be used only by the person who has authority to print checks. The Chief Financial
601 Officer (CFO) wants that printer to be completely restricted and for it to be located in the
602 private storage area in her office. It therefore must be a network printer.
603 </para>
605 <para>
606 Accounting department uses an accounting application called <emphasis>SpytFull</emphasis>
607 that must be run from a central application server. The software is licensed to run only off
608 one server, there are no workstation components, and it is run off a mapped share. The data
609 store is in a UNIX-based SQL backend. The UNIX gurus look after that, so is not our
610 problem.
611 </para>
613 <para>
614 The accounting department manager (maryo) wants a general filing system as well as a separate
615 file storage area for form letters (nastygrams). The form letter area should be read-only to
616 all accounting staff except the manager. The general filing system has to have a structured
617 layout with a general area for all staff to store general documents, as well as a separate
618 file area for each member of her team that is private to that person, but she wants full
619 access to all areas. Users must have a private home share for personal work-related files
620 and for materials not related to departmental operations.
621 </para>
623 <sect3>
624 <title>Example Configuration</title>
626 <para>
627 The server <emphasis>valinor</emphasis> will be a member server of the company domain.
628 Accounting will have only a local server. User accounts will be on the Domain Controllers
629 as will desktop profiles and all network policy files.
630 </para>
632 <procedure>
633 <step><para>
634 Do not add users to the UNIX/Linux server; all of this will run off the
635 central domain.
636 </para></step>
638 <step><para>
639 Configure &smb.conf; according to <link linkend="fast-member-server"/>
640 and <link linkend="fast-memberserver-shares"></link>.
641 </para>
643 <para>
644 <smbconfexample id="fast-member-server">
645 <title>Member server smb.conf (globals)</title>
646 <smbconfcomment>Global parameters</smbconfcomment>
647 <smbconfsection>[global]</smbconfsection>
648 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
649 <smbconfoption name="netbios name">VALINOR</smbconfoption>
650 <smbconfoption name="security">DOMAIN</smbconfoption>
651 <smbconfoption name="printcap name">cups</smbconfoption>
652 <smbconfoption name="disable spoolss">Yes</smbconfoption>
653 <smbconfoption name="show add printer wizard">No</smbconfoption>
654 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
655 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
656 <smbconfoption name="winbind use default domain">Yes</smbconfoption>
657 <smbconfoption name="use sendfile">Yes</smbconfoption>
658 <smbconfoption name="printing">cups</smbconfoption>
659 </smbconfexample></para>
661 <para>
662 <smbconfexample id="fast-memberserver-shares">
663 <title>Member server smb.conf (shares and services)</title>
664 <smbconfsection>[homes]</smbconfsection>
665 <smbconfoption name="comment">Home Directories</smbconfoption>
666 <smbconfoption name="valid users">%S</smbconfoption>
667 <smbconfoption name="read only">No</smbconfoption>
668 <smbconfoption name="browseable">No</smbconfoption>
670 <smbconfsection>[spytfull]</smbconfsection>
671 <smbconfoption name="comment">Accounting Application Only</smbconfoption>
672 <smbconfoption name="path">/export/spytfull</smbconfoption>
673 <smbconfoption name="valid users">@Accounts</smbconfoption>
674 <smbconfoption name="admin users">maryo</smbconfoption>
675 <smbconfoption name="read only">Yes</smbconfoption>
677 <smbconfsection>[public]</smbconfsection>
678 <smbconfoption name="comment">Data</smbconfoption>
679 <smbconfoption name="path">/export/public</smbconfoption>
680 <smbconfoption name="read only">No</smbconfoption>
682 <smbconfsection>[printers]</smbconfsection>
683 <smbconfoption name="comment">All Printers</smbconfoption>
684 <smbconfoption name="path">/var/spool/samba</smbconfoption>
685 <smbconfoption name="printer admin">root, maryo</smbconfoption>
686 <smbconfoption name="create mask">0600</smbconfoption>
687 <smbconfoption name="guest ok">Yes</smbconfoption>
688 <smbconfoption name="printable">Yes</smbconfoption>
689 <smbconfoption name="use client driver">Yes</smbconfoption>
690 <smbconfoption name="browseable">No</smbconfoption>
691 </smbconfexample>
692 </para></step>
695 <step><para>
696 <indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
697 Join the domain. Note: Do not start Samba until this step has been completed!
698 <screen>
699 &rootprompt;<userinput>net rpc join -Uroot%'bigsecret'</userinput>
700 Joined domain MIDEARTH.
701 </screen>
702 </para></step>
704 <step><para>
705 Make absolutely certain that you disable (shut down) the <command>nscd</command>
706 daemon on any system on which <command>winbind</command> is configured to run.
707 </para></step>
709 <step><para>
710 Start Samba following the normal method for your operating system platform.
711 If you wish to this manually execute as root:
712 <indexterm><primary>smbd</primary></indexterm>
713 <indexterm><primary>nmbd</primary></indexterm>
714 <indexterm><primary>winbindd</primary></indexterm>
715 <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
716 <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
717 <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
718 <screen>
719 &rootprompt;<userinput>nmbd; smbd; winbindd;</userinput>
720 </screen>
721 </para></step>
723 <step><para>
724 Configure the name service switch control file on your system to resolve user and group names
725 via winbind. Edit the following lines in <filename>/etc/nsswitch.conf</filename>:
726 <programlisting>
727 passwd: files winbind
728 group: files winbind
729 hosts: files dns winbind
730 </programlisting>
731 </para></step>
733 <step><para>
734 Set the password for <command>wbinfo</command> to use:
735 <screen>
736 &rootprompt;<userinput>wbinfo --set-auth-user=root%'bigsecret'</userinput>
737 </screen>
738 </para></step>
740 <step><para>
741 Validate that domain user and group credentials can be correctly resolved by executing:
742 <screen>
743 &rootprompt;<userinput>wbinfo -u</userinput>
744 MIDEARTH\maryo
745 MIDEARTH\jackb
746 MIDEARTH\ameds
747 ...
748 MIDEARTH\root
750 &rootprompt;<userinput>wbinfo -g</userinput>
751 MIDEARTH\Domain Users
752 MIDEARTH\Domain Admins
753 MIDEARTH\Domain Guests
754 ...
755 MIDEARTH\Accounts
756 </screen>
757 </para></step>
759 <step><para>
760 Check that <command>winbind</command> is working. The following demonstrates correct
761 username resolution via the <command>getent</command> system utility:
762 <screen>
763 &rootprompt;<userinput>getent passwd maryo</userinput>
764 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
765 </screen>
766 </para></step>
768 <step><para>
769 A final test that we have this under control might be reassuring:
770 <screen>
771 &rootprompt;<userinput>touch /export/a_file</userinput>
772 &rootprompt;<userinput>chown maryo /export/a_file</userinput>
773 &rootprompt;<userinput>ls -al /export/a_file</userinput>
774 ...
775 -rw-r--r-- 1 maryo users 11234 Jun 21 15:32 a_file
776 ...
778 &rootprompt;<userinput>rm /export/a_file</userinput>
779 </screen>
780 </para></step>
782 <step><para>
783 Configuration is now mostly complete, so this is an opportune time
784 to configure the directory structure for this site:
785 <screen>
786 &rootprompt;<userinput>mkdir -p /export/{spytfull,public}</userinput>
787 &rootprompt;<userinput>chmod ug=rwxS,o=x /export/{spytfull,public}</userinput>
788 &rootprompt;<userinput>chown maryo.Accounts /export/{spytfull,public}</userinput>
789 </screen>
790 </para></step>
791 </procedure>
793 </sect3>
795 </sect2>
797 <sect2>
798 <title>Domain Controller</title>
801 <para>
802 <indexterm><primary>Server Type</primary><secondary>Domain Controller</secondary></indexterm>
803 For the remainder of this chapter the focus is on the configuration of Domain Control.
804 The examples that follow are for two implementation strategies. Remember, our objective is
805 to create a simple but working solution. The remainder of this book should help to highlight
806 opportunity for greater functionality and the complexity that goes with it.
807 </para>
809 <para>
810 A Domain Controller configuration can be achieved with a simple configuration using the new
811 tdbsam password backend. This type of configuration is good for small
812 offices, but has limited scalability (cannot be replicated) and performance can be expected
813 to fall as the size and complexity of the domain increases.
814 </para>
816 <para>
817 The use of tdbsam is best limited to sites that do not need
818 more than a primary Domain Controller (PDC). As the size of a domain grows the need
819 for additional Domain Controllers becomes apparent. Do not attempt to under-resource
820 a Microsoft Windows network environment; Domain Controllers provide essential
821 authentication services. The following are symptoms of an under-resourced Domain Control
822 environment:
823 </para>
825 <itemizedlist>
826 <listitem><para>
827 Domain logons intermittently fail.
828 </para></listitem>
830 <listitem><para>
831 File access on a Domain Member server intermittently fails, giving a permission denied
832 error message.
833 </para></listitem>
834 </itemizedlist>
836 <para>
837 A more scalable Domain Control authentication backend option might use
838 Microsoft Active Directory, or an LDAP-based backend. Samba-3 provides
839 for both options as a Domain Member server. As a PDC Samba-3 is not able to provide
840 an exact alternative to the functionality that is available with Active Directory.
841 Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
842 </para>
844 <para>
845 The tdbsam authentication backend provides no facility to replicate
846 the contents of the database, except by external means. (i.e., there is no self-contained protocol
847 in Samba-3 for Security Account Manager database [SAM] replication.)
848 </para>
850 <note><para>
851 If you need more than one Domain Controller, do not use a tdbsam authentication backend.
852 </para></note>
854 <sect3>
855 <title>Example: Engineering Office</title>
857 <para>
858 The engineering office network server we present here is designed to demonstrate use
859 of the new tdbsam password backend. The tdbsam
860 facility is new to Samba-3. It is designed to provide many user and machine account controls
861 that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
862 </para>
864 <procedure>
865 <step><para>
866 A working PDC configuration using the tdbsam
867 password backend can be found in <link linkend="fast-engoffice-global"></link> together with
868 <link linkend="fast-engoffice-shares"></link>:
869 </para>
871 <para>
872 <indexterm><primary>pdbedit</primary></indexterm>
873 <smbconfexample id="fast-engoffice-global">
874 <title>Engineering Office smb.conf (globals)</title>
875 <smbconfsection>[global]</smbconfsection>
876 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
877 <smbconfoption name="netbios name">FRODO</smbconfoption>
878 <smbconfoption name="passdb backend">tdbsam</smbconfoption>
879 <smbconfoption name="printcap name">cups</smbconfoption>
880 <smbconfoption name="add user script">/usr/sbin/useradd -m %u</smbconfoption>
881 <smbconfoption name="delete user script">/usr/sbin/userdel -r %u</smbconfoption>
882 <smbconfoption name="add group script">/usr/sbin/groupadd %g</smbconfoption>
883 <smbconfoption name="delete group script">/usr/sbin/groupdel %g</smbconfoption>
884 <smbconfoption name="add user to group script">/usr/sbin/usermod -G %g %u</smbconfoption>
885 <smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false \</smbconfoption>
886 <member><parameter> -d /var/lib/nobody %u</parameter></member>
887 <smbconfcomment>Note: The following specifies the default logon script.</smbconfcomment>
888 <smbconfcomment>Per user logon scripts can be specified in the user account using pdbedit </smbconfcomment>
889 <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
890 <smbconfcomment>This sets the default profile path. Set per user paths with pdbedit</smbconfcomment>
891 <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
892 <smbconfoption name="logon drive">H:</smbconfoption>
893 <smbconfoption name="logon home">\\%L\%U</smbconfoption>
894 <smbconfoption name="domain logons">Yes</smbconfoption>
895 <smbconfoption name="os level">35</smbconfoption>
896 <smbconfoption name="preferred master">Yes</smbconfoption>
897 <smbconfoption name="domain master">Yes</smbconfoption>
898 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
899 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
900 <smbconfoption name="printing">cups</smbconfoption>
901 </smbconfexample>
903 <smbconfexample id="fast-engoffice-shares">
904 <title>Engineering Office smb.conf (shares and services)</title>
905 <smbconfsection>[homes]</smbconfsection>
906 <smbconfoption name="comment">Home Directories</smbconfoption>
907 <smbconfoption name="valid users">%S</smbconfoption>
908 <smbconfoption name="read only">No</smbconfoption>
909 <smbconfoption name="browseable">No</smbconfoption>
911 <smbconfcomment>Printing auto-share (makes printers available thru CUPS)</smbconfcomment>
912 <smbconfsection>[printers]</smbconfsection>
913 <smbconfoption name="comment">All Printers</smbconfoption>
914 <smbconfoption name="path">/var/spool/samba</smbconfoption>
915 <smbconfoption name="printer admin">root, maryo</smbconfoption>
916 <smbconfoption name="create mask">0600</smbconfoption>
917 <smbconfoption name="guest ok">Yes</smbconfoption>
918 <smbconfoption name="printable">Yes</smbconfoption>
919 <smbconfoption name="browseable">No</smbconfoption>
921 <smbconfsection>[print$]</smbconfsection>
922 <smbconfoption name="comment">Printer Drivers Share</smbconfoption>
923 <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
924 <smbconfoption name="write list">maryo, root</smbconfoption>
925 <smbconfoption name="printer admin">maryo, root</smbconfoption>
927 <smbconfcomment>Needed to support domain logons</smbconfcomment>
928 <smbconfsection>[netlogon]</smbconfsection>
929 <smbconfoption name="comment">Network Logon Service</smbconfoption>
930 <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
931 <smbconfoption name="admin users">root, maryo</smbconfoption>
932 <smbconfoption name="guest ok">Yes</smbconfoption>
933 <smbconfoption name="browseable">No</smbconfoption>
935 <smbconfcomment>For profiles to work, create a user directory under the path</smbconfcomment>
936 <smbconfcomment> shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</smbconfcomment>
937 <smbconfsection>[Profiles]</smbconfsection>
938 <smbconfoption name="comment">Roaming Profile Share</smbconfoption>
939 <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
940 <smbconfoption name="read only">No</smbconfoption>
941 <smbconfoption name="profile acls">Yes</smbconfoption>
943 <smbconfcomment>Other resource (share/printer) definitions would follow below.</smbconfcomment>
944 <member>...</member>
945 </smbconfexample>
946 </para></step>
948 <step><para>
949 Create UNIX group accounts as needed using a suitable operating system tool:
950 <screen>
951 &rootprompt;<userinput>groupadd ntadmins</userinput>
952 &rootprompt;<userinput>groupadd designers</userinput>
953 &rootprompt;<userinput>groupadd engineers</userinput>
954 &rootprompt;<userinput>groupadd qateam</userinput>
955 </screen>
956 </para></step>
958 <step><para>
959 Create user accounts on the system using the appropriate tool
960 provided with the operating system. Make sure all user home directories
961 are created also. Add users to groups as required for access control
962 on files, directories, printers, and as required for use in the Samba
963 environment.
964 </para></step>
967 <step><para>
968 <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
969 <indexterm><primary>initGroups.sh</primary></indexterm>
970 Assign each of the UNIX groups to NT groups:
971 (It may be useful to copy this text to a shell script called
972 <filename>initGroups.sh</filename>.)
973 <smbfile name="initGroups.sh">
974 <title>Shell script for initializing group mappings</title>
975 <programlisting>
976 #!/bin/bash
977 #### Keep this as a shell script for future re-use
979 # First assign well known groups
980 net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins
981 net groupmap modify ntgroup="Domain Users" unixgroup=users
982 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
984 # Now for our added Domain Groups
985 net groupmap add ntgroup="Designers" unixgroup=designers type=d
986 net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
987 net groupmap add ntgroup="QA Team" unixgroup=qateam type=d
988 </programlisting>
989 </smbfile>
990 </para></step>
992 <step><para>
993 Create the <filename>scripts</filename> directory for use in the
994 <smbconfsection>[NETLOGON]</smbconfsection> share:
995 <screen>
996 &rootprompt;<userinput>mkdir -p /var/lib/samba/netlogon/scripts</userinput>
997 </screen>
998 Place the logon scripts that will be used (batch or cmd scripts)
999 in this directory.
1000 </para></step>
1001 </procedure>
1003 <para>
1004 The above configuration provides a functional Primary Domain Control (PDC)
1005 system to which must be added file shares and printers as required.
1006 </para>
1008 </sect3>
1010 <sect3>
1011 <title>A Big Organization</title>
1013 <para>
1014 In this section we finally get to review in brief a Samba-3 configuration that
1015 uses a Light Weight Directory Access (LDAP)-based authentication backend. The
1016 main reasons for this choice are to provide the ability to host primary
1017 and Backup Domain Control (BDC), as well as to enable a higher degree of
1018 scalability to meet the needs of a very distributed environment.
1019 </para>
1021 <sect4>
1022 <title>The Primary Domain Controller</title>
1024 <para>
1025 This is an example of a minimal configuration to run a Samba-3 PDC
1026 using an LDAP authentication backend. It is assumed that the operating system
1027 has been correctly configured.
1028 </para>
1030 <para>
1031 The Idealx scripts (or equivalent) are needed to manage LDAP based Posix and/or
1032 SambaSamAccounts. The Idealx scripts may be downloaded from the <ulink url="http://www.idealx.org">
1033 Idealx</ulink> Web site. They may also be obtained from the Samba tarball. Linux
1034 distributions tend to install the Idealx scripts in the
1035 <filename>/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</filename> directory.
1036 Idealx scripts version <constant>smbldap-tools-0.8.2</constant> are known to work well.
1037 </para>
1039 <procedure>
1040 <step><para>
1041 Obtain from the Samba sources <filename>~/examples/LDAP/samba.schema</filename>
1042 and copy it to the <filename>/etc/openldap/schema/</filename> directory.
1043 </para></step>
1045 <step><para>
1046 Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
1047 The <filename>/etc/openldap/slapd.conf</filename> file:
1048 <indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
1049 <smbfile name="slapd.conf"><title>Example slapd.conf file</title>
1050 <programlisting>
1051 # Note commented out lines have been removed
1052 include /etc/openldap/schema/core.schema
1053 include /etc/openldap/schema/cosine.schema
1054 include /etc/openldap/schema/inetorgperson.schema
1055 include /etc/openldap/schema/nis.schema
1056 include /etc/openldap/schema/samba.schema
1058 pidfile /var/run/slapd/slapd.pid
1059 argsfile /var/run/slapd/slapd.args
1061 database bdb
1062 suffix "dc=quenya,dc=org"
1063 rootdn "cn=Manager,dc=quenya,dc=org"
1064 rootpw {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
1065 # The password for the above is 'nastyon3'
1067 directory /var/lib/ldap
1069 index objectClass eq
1070 index cn pres,sub,eq
1071 index sn pres,sub,eq
1072 index uid pres,sub,eq
1073 index displayName pres,sub,eq
1074 index uidNumber eq
1075 index gidNumber eq
1076 index memberUid eq
1077 index sambaSID eq
1078 index sambaPrimaryGroupSID eq
1079 index sambaDomainName eq
1080 index default sub
1081 </programlisting>
1082 </smbfile>
1083 </para></step>
1085 <step><para>
1086 Create the following file <filename>samba-ldap-init.ldif</filename>:
1087 <indexterm><primary>samba-ldap-init.ldif</primary></indexterm>
1088 <smbfile name="samba-ldap-init.ldif">
1089 <programlisting>
1090 # Organization for SambaXP Demo
1091 dn: dc=quenya,dc=org
1092 objectclass: dcObject
1093 objectclass: organization
1094 dc: quenya
1095 o: SambaXP Demo
1096 description: The SambaXP Demo LDAP Tree
1098 # Organizational Role for Directory Management
1099 dn: cn=Manager,dc=quenya,dc=org
1100 objectclass: organizationalRole
1101 cn: Manager
1102 description: Directory Manager
1104 # Setting up the container for users
1105 dn: ou=People, dc=quenya, dc=org
1106 objectclass: top
1107 objectclass: organizationalUnit
1108 ou: People
1110 # Set up an admin handle for People OU
1111 dn: cn=admin, ou=People, dc=quenya, dc=org
1112 cn: admin
1113 objectclass: top
1114 objectclass: organizationalRole
1115 objectclass: simpleSecurityObject
1116 userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
1117 # The password for above is 'mordonL8'
1118 </programlisting>
1119 </smbfile>
1120 </para></step>
1122 <step><para>
1123 Load the initial data above into the LDAP database:
1124 <screen>
1125 &rootprompt;<userinput>slapadd -v -l initdb.ldif</userinput>
1126 </screen>
1127 </para></step>
1129 <step><para>
1130 Start the LDAP server using the appropriate tool or method for
1131 the operating system platform on which it is installed.
1132 </para></step>
1134 <step><para>
1135 Install the Idealx script files in the <filename>/usr/local/sbin</filename> directory,
1136 then configure the smbldap_conf.pm file to match your system configuration.
1137 </para></step>
1139 <step><para>
1140 The &smb.conf; file that drives this backend can be found in example <link linkend="fast-ldap"/>.
1141 </para>
1143 <para>
1144 <smbconfexample id="fast-ldap">
1145 <title>LDAP backend smb.conf for PDC</title>
1146 <smbconfcomment>Global parameters</smbconfcomment>
1147 <smbconfsection>[global]</smbconfsection>
1148 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
1149 <smbconfoption name="netbios name">FRODO</smbconfoption>
1150 <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
1151 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
1152 <smbconfoption name="printcap name">cups</smbconfoption>
1153 <smbconfoption name="add user script">/usr/local/sbin/smbldap-useradd.pl -m '%u'</smbconfoption>
1154 <smbconfoption name="delete user script">/usr/local/sbin/smbldap-userdel.pl %u</smbconfoption>
1155 <smbconfoption name="add group script">/usr/local/sbin/smbldap-groupadd.pl -p '%g'</smbconfoption>
1156 <smbconfoption name="delete group script">/usr/local/sbin/smbldap-groupdel.pl '%g'</smbconfoption>
1157 <smbconfoption name="add user to group script">/usr/local/sbin/ \</smbconfoption>
1158 <member><parameter>smbldap-groupmod.pl -m '%g' '%u'</parameter></member>
1159 <smbconfoption name="delete user from group script">/usr/local/sbin/ \</smbconfoption>
1160 <member><parameter>smbldap-groupmod.pl -x '%g' '%u'</parameter></member>
1161 <smbconfoption name="set primary group script">/usr/local/sbin/ \</smbconfoption>
1162 <member><parameter>smbldap-usermod.pl -g '%g' '%u'</parameter></member>
1163 <smbconfoption name="add machine script">/usr/local/sbin/smbldap-useradd.pl -w '%u'</smbconfoption>
1164 <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
1165 <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
1166 <smbconfoption name="logon drive">H:</smbconfoption>
1167 <smbconfoption name="logon home">\\%L\%U</smbconfoption>
1168 <smbconfoption name="domain logons">Yes</smbconfoption>
1169 <smbconfoption name="os level">35</smbconfoption>
1170 <smbconfoption name="preferred master">Yes</smbconfoption>
1171 <smbconfoption name="domain master">Yes</smbconfoption>
1172 <smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
1173 <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
1174 <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
1175 <smbconfoption name="ldap group suffix">ou=People</smbconfoption>
1176 <smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
1177 <smbconfoption name="ldap admin dn">cn=Manager</smbconfoption>
1178 <smbconfoption name="ldap ssl">no</smbconfoption>
1179 <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
1180 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
1181 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
1182 <smbconfoption name="printing">cups</smbconfoption>
1183 <member>...</member>
1184 </smbconfexample>
1185 </para></step>
1187 <step><para>
1188 Add the LDAP password to the <filename>secrets.tdb</filename> file so Samba can update
1189 the LDAP database:
1190 <screen>
1191 &rootprompt;<userinput>smbpasswd -w mordonL8</userinput>
1192 </screen>
1193 </para></step>
1195 <step><para>
1196 Add users and groups as required. Users and groups added using Samba tools
1197 will automatically be added to both the LDAP backend as well as to the operating
1198 system as required.
1199 </para></step>
1201 </procedure>
1203 </sect4>
1205 <sect4>
1206 <title>Backup Domain Controller</title>
1208 <para>
1209 <link linkend="fast-bdc"/> shows the example configuration for the BDC.
1210 </para>
1212 <procedure>
1213 <step><para>
1214 Decide if the BDC should have its own LDAP server or not. If the BDC is to be
1215 the LDAP server change the following &smb.conf; as indicated. The default
1216 configuration in <link linkend="fast-bdc"/> uses a central LDAP server.
1217 <smbconfexample id="fast-bdc">
1218 <title>Remote LDAP BDC smb.conf</title>
1219 <smbconfcomment>Global parameters</smbconfcomment>
1220 <smbconfsection>[global]</smbconfsection>
1221 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
1222 <smbconfoption name="netbios name">GANDALF</smbconfoption>
1223 <smbconfoption name="passdb backend">ldapsam:ldap://frodo.quenya.org</smbconfoption>
1224 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
1225 <smbconfoption name="printcap name">cups</smbconfoption>
1226 <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
1227 <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
1228 <smbconfoption name="logon drive">H:</smbconfoption>
1229 <smbconfoption name="logon home">\\%L\%U</smbconfoption>
1230 <smbconfoption name="domain logons">Yes</smbconfoption>
1231 <smbconfoption name="os level">33</smbconfoption>
1232 <smbconfoption name="preferred master">Yes</smbconfoption>
1233 <smbconfoption name="domain master">No</smbconfoption>
1234 <smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
1235 <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
1236 <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
1237 <smbconfoption name="ldap group suffix">ou=People</smbconfoption>
1238 <smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
1239 <smbconfoption name="ldap admin dn">cn=Manager</smbconfoption>
1240 <smbconfoption name="ldap ssl">no</smbconfoption>
1241 <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
1242 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
1243 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
1244 <smbconfoption name="printing">cups</smbconfoption>
1245 <member>...</member>
1246 </smbconfexample>
1247 </para></step>
1249 <step><para>
1250 Configure the NETLOGON and PROFILES directory as for the PDC in <link linkend="fast-bdc"/>.
1251 </para></step>
1252 </procedure>
1254 </sect4>
1256 </sect3>
1258 </sect2>
1260 </sect1>
1262 </chapter>