docs/Samba-HOWTO-Collection/FastStart.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3                 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4
   5   <!-- entities files to use -->
   6   <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
   7   %global_entities;
   8
   9 ]>
  10
  11 <chapter id="FastStart">
  12 <chapterinfo>
  13         &author.jht;
  14 </chapterinfo>
  15
  16 <title>Fast Start: Cure for Impatience</title>
  17
  18 <para>
  19 When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
  20 someone wrote asking for example configurations &smbmdash; and lots of them. That is remarkably
  21 difficult to do, without losing a lot of value that can be derived from presenting
  22 many extracts from working systems. That is what the rest of this document does.
  23 It does so with extensive descriptions of the configuration possibilities within the
  24 context of the chapter that covers it. We hope that this chapter is the medicine
  25 that has been requested.
  26 </para>
  27
  28 <sect1>
  29 <title>Features and Benefits</title>
  30
  31 <para>
  32 Samba needs very little configuration to create a basic working system.
  33 In this chapter we progress from the simple to the complex, for each providing
  34 all steps and configuration file changes needed to make each work. Please note
  35 that a comprehensively configured system will likely employ additional smart
  36 features. The additional features are covered in the remainder of this document.
  37 </para>
  38
  39 <para>
  40 The examples used here have been obtained from a number of people who made
  41 requests for example configurations. All identities have been obscured to protect
  42 the guilty and any resemblance to unreal non-existent sites is deliberate.
  43 </para>
  44
  45 </sect1>
  46
  47 <sect1>
  48 <title>Description of Example Sites</title>
  49
  50 <para>
  51 In the first set of configuration examples we consider the case of exceptionally simple
  52 system requirements. There is a real temptation to make something that should require
  53 little effort much too complex.
  54 </para>
  55
  56 <para>
  57 <link linkend="anon-ro"></link> documents the type of server that might be sufficient to serve CD-ROM
  58 images, or reference document files for network client use. This configuration is also discussed in
  59 <link linkend="StandAloneServer"></link>, <link linkend="RefDocServer"></link>.
  60 The purpose for this configuration is to provide a shared volume that is read-only that anyone, even guests, can access.
  61 </para>
  62
  63 <para>
  64 The second example shows a minimal configuration for a print server that anyone can print
  65 to as long as they have the correct printer drivers installed on their computer. This is a
  66 mirror of the system described in <link linkend="StandAloneServer"></link>, <link linkend="SimplePrintServer"></link>.
  67 </para>
  68
  69 <para>
  70 The next example is of a secure office file and print server that will be accessible only
  71 to users who have an account on the system. This server is meant to closely resemble a
  72 Workgroup file and print server, but has to be more secure than an anonymous access machine.
  73 This type of system will typically suit the needs of a small office. The server does not
  74 provide network logon facilities, offers no Domain Control, instead it is just a network
  75 attached storage (NAS) device and a print server.
  76 </para>
  77
  78 <para>
  79 Finally, we start looking at more complex systems that will either integrate into existing
  80 Microsoft Windows networks, or replace them entirely. The examples provided cover domain
  81 member servers as well as Samba Domain Control (PDC/BDC) and finally describes in detail
  82 a large distributed network with branch offices in remote locations.
  83 </para>
  84
  85 </sect1>
  86
  87 <sect1>
  88 <title>Worked Examples</title>
  89
  90 <para>
  91 The configuration examples are designed to cover everything necessary to get Samba
  92 running. They do not cover basic operating system platform configuration, which is
  93 clearly beyond the scope of this text.
  94 </para>
  95
  96 <para>
  97 It is also assumed that Samba has been correctly installed, either by way of installation
  98 of the packages that are provided by the operating system vendor, or through other means.
  99 </para>
 100
 101         <sect2>
 102         <title>Stand-alone Server</title>
 103
 104         <para>
 105         <indexterm><primary>Server Type</primary><secondary>Stand-alone</secondary></indexterm>
 106         A Stand-alone Server implies no more than the fact that it is not a Domain Controller
 107         and it does not participate in Domain Control. It can be a simple workgroup-like
 108         server, or it may be a complex server that is a member of a domain security context.
 109         </para>
 110
 111                 <sect3 id="anon-ro">
 112                 <title>Anonymous Read-Only Document Server</title>
 113
 114                 <para>
 115                 <indexterm><primary>read only</primary><secondary>server</secondary></indexterm>
 116                 The purpose of this type of server is to make available to any user
 117                 any documents or files that are placed on the shared resource. The
 118                 shared resource could be a CD-ROM drive, a CD-ROM image, or a file
 119                 storage area.
 120                 </para>
 121
 122                 <para>
 123                 As the examples are developed, every attempt is made to progress the
 124                 system toward greater capability, just as one might expect would happen
 125                 in a real business office as that office grows in size and its needs
 126                 change.
 127                 </para>
 128
 129                 <para>The configuration file is:</para>
 130
 131                 <para><smbconfexample id="anon-example">
 132                                 <title>Anonymous Read-Only Server Configuration</title>
 133                 <smbconfcomment>Global parameters</smbconfcomment>
 134                 <smbconfsection>[global]</smbconfsection>
 135                 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 136                 <smbconfoption><name>netbios name</name><value>HOBBIT</value></smbconfoption>
 137                 <smbconfoption><name>security</name><value>share</value></smbconfoption>
 138
 139                 <smbconfsection>[data]</smbconfsection>
 140                 <smbconfoption><name>comment</name><value>Data</value></smbconfoption>
 141                 <smbconfoption><name>path</name><value>/export</value></smbconfoption>
 142                 <smbconfoption><name>read only</name><value>Yes</value></smbconfoption>
 143                 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 144                 </smbconfexample>
 145                 </para>
 146
 147                 <itemizedlist>
 148                         <listitem><para>
 149                         The file system share point will be <filename>/export</filename>.
 150                         </para></listitem>
 151
 152                         <listitem><para>
 153                         All files will be owned by a user called Jack Baumbach.
 154                         Jack's login name will be <emphasis>jackb</emphasis>. His password will be
 155                         <emphasis>m0r3pa1n</emphasis> &smbmdash; of course, that's just the example we are
 156                         using; do not use this in a production environment because
 157                         all readers of this document will know it.
 158                         </para></listitem>
 159                 </itemizedlist>
 160
 161                 <procedure>
 162                 <title>Installation Procedure &smbmdash; Read-Only Server</title>
 163                         <step><para>
 164                         Add user to system (with creation of the users' home directory):
 165 <screen>
 166 &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
 167 </screen>
 168                         </para></step>
 169
 170                         <step><para>
 171                         Create directory, and set permissions and ownership:
 172 <screen>
 173 &rootprompt;<userinput>mkdir /export</userinput>
 174 &rootprompt;<userinput>chmod u+rwx,g+rx,o+rx /export</userinput>
 175 &rootprompt;<userinput>chown jackb.users /export</userinput>
 176 </screen>
 177                         </para></step>
 178
 179                         <step><para>
 180                         Copy the files that should be shared to the <filename>/export</filename>
 181                         directory.
 182                         </para></step>
 183
 184                         <step><para>
 185                         Install the Samba configuration file (<filename>/etc/samba/smb.conf</filename>)
 186                         as shown.
 187                         </para></step>
 188
 189                         <step><para>
 190                         Test the configuration file:
 191 <screen>
 192 &rootprompt;<userinput>testparm</userinput>
 193 </screen>
 194                         Note any error messages that might be produced. Do not proceed until you
 195                         obtain error-free output. An example of the output with the following file
 196                         will list the file.
 197 <screen>
 198 Load smb config files from /etc/samba/smb.conf
 199 Processing section "[data]"
 200 Loaded services file OK.
 201 Server role: ROLE_STANDALONE
 202 Press enter to see a dump of your service definitions
 203 <userinput>[Press enter]</userinput>
 204
 205 # Global parameters
 206 [global]
 207         workgroup = MIDEARTH
 208         netbios name = HOBBIT
 209         security = share
 210
 211 [data]
 212         comment = Data
 213         path = /export
 214         read only = Yes
 215         guest only = Yes
 216 </screen>
 217                         </para></step>
 218
 219                         <step><para>
 220                         Start Samba using the method applicable to your operating system
 221                         platform.
 222                         </para></step>
 223
 224                         <step><para>
 225                         Configure your Microsoft Windows client for workgroup <emphasis>MIDEARTH</emphasis>,
 226                         set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
 227                         then open Windows Explorer and visit the network neighborhood.
 228                         The machine HOBBIT should be visible. When you click this machine
 229                         icon, it should open up to reveal the <emphasis>data</emphasis> share. After
 230                         clicking the share it, should open up to reveal the files previously
 231                         placed in the <filename>/export</filename> directory.
 232                         </para></step>
 233                 </procedure>
 234
 235                 <para>
 236                 The information above (following # Global parameters) provides the complete
 237                 contents of the <filename>/etc/samba/smb.conf</filename> file.
 238                 </para>
 239
 240                 </sect3>
 241
 242                 <sect3>
 243                 <title>Anonymous Read-Write Document Server</title>
 244
 245                 <para>
 246                 <indexterm><primary>anonymous</primary><secondary>read-write server</secondary></indexterm>
 247                 We should view this configuration as a progression from the previous example.
 248                 The difference is that shared access is now forced to the user identity of jackb
 249                 and to the primary group jackb belongs to. One other refinement we can make is to
 250                 add the user <emphasis>jackb</emphasis> to the <filename>smbpasswd</filename> file.
 251                 To do this execute:
 252 <screen>
 253 &rootprompt;<userinput>smbpasswd -a jackb</userinput>
 254 New SMB password: <userinput>m0r3pa1n</userinput>
 255 Retype new SMB password: <userinput>m0r3pa1n</userinput>
 256 Added user jackb.
 257 </screen>
 258                 Addition of this user to the <filename>smbpasswd</filename> file allows all files
 259                 to be displayed in the Explorer Properties boxes as belonging to <emphasis>jackb</emphasis>
 260                 instead of to <emphasis>User Unknown</emphasis>.
 261                 </para>
 262
 263                 <para>
 264                 The complete, modified &smb.conf; file is as shown in <link linkend="anon-rw"/>.
 265                 </para>
 266
 267                 <para>
 268 <smbconfexample id="anon-rw"><title>Modified Anonymous Read-Write smb.conf</title>
 269 <smbconfcomment>Global parameters</smbconfcomment>
 270 <smbconfsection>[global]</smbconfsection>
 271 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 272 <smbconfoption><name>netbios name</name><value>HOBBIT</value></smbconfoption>
 273 <smbconfoption><name>security</name><value>SHARE</value></smbconfoption>
 274
 275 <smbconfsection>[data]</smbconfsection>
 276 <smbconfoption><name>comment</name><value>Data</value></smbconfoption>
 277 <smbconfoption><name>path</name><value>/export</value></smbconfoption>
 278 <smbconfoption><name>force user</name><value>jackb</value></smbconfoption>
 279 <smbconfoption><name>force group</name><value>users</value></smbconfoption>
 280 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 281 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 282 </smbconfexample>
 283                 </para>
 284
 285                 </sect3>
 286
 287                 <sect3>
 288                 <title>Anonymous Print Server</title>
 289
 290                 <para>
 291                 <indexterm><primary>anonymous</primary><secondary>print server</secondary></indexterm>
 292                 An anonymous print server serves two purposes:
 293                 </para>
 294
 295                 <itemizedlist>
 296                         <listitem><para>
 297                         It allows printing to all printers from a single location.
 298                         </para></listitem>
 299
 300                         <listitem><para>
 301                         It reduces network traffic congestion due to many users trying
 302                         to access a limited number of printers.
 303                         </para></listitem>
 304                 </itemizedlist>
 305
 306                 <para>
 307                 In the simplest of anonymous print servers, it is common to require the installation
 308                 of the correct printer drivers on the Windows workstation. In this case the print
 309                 server will be designed to just pass print jobs through to the spooler, and the spooler
 310                 should be configured to do raw pass-through to the printer. In other words, the print
 311                 spooler should not filter or process the data stream being passed to the printer.
 312                 </para>
 313
 314                 <para>
 315                 In this configuration it is undesirable to present the Add Printer Wizard and we do
 316                 not want to have automatic driver download, so we will disable it in the following
 317                 configuration. <link linkend="anon-print"></link> is the resulting &smb.conf; file.
 318                 </para>
 319
 320                 <para>
 321 <smbconfexample id="anon-print"><title>Anonymous Print Server smb.conf</title>
 322 <smbconfcomment>Global parameters</smbconfcomment>
 323 <smbconfsection>[global]</smbconfsection>
 324 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 325 <smbconfoption><name>netbios name</name><value>LUTHIEN</value></smbconfoption>
 326 <smbconfoption><name>security</name><value>share</value></smbconfoption>
 327 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
 328 <smbconfoption><name>disable spoolss</name><value>Yes</value></smbconfoption>
 329 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
 330 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
 331
 332 <smbconfsection>[printers]</smbconfsection>
 333 <smbconfoption><name>comment</name><value>All Printers</value></smbconfoption>
 334 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
 335 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 336 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
 337 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
 338 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 339 </smbconfexample>
 340                 </para>
 341
 342                 <para>
 343                 The above configuration is not ideal. It uses no smart features, and it deliberately
 344                 presents a less than elegant solution. But it is basic, and it does print.
 345                 </para>
 346
 347                 <note><para>
 348                 Windows users will need to install a local printer and then change the print
 349                 to device after installation of the drivers. The print to device can then be set to
 350                 the network printer on this machine.
 351                 </para></note>
 352
 353                 <para>
 354                 Make sure that the directory <filename>/var/spool/samba</filename> is capable of being used
 355                 as intended. The following steps must be taken to achieve this:
 356                 </para>
 357
 358                 <itemizedlist>
 359                         <listitem><para>
 360                         The directory must be owned by the superuser (root) user and group:
 361 <screen>
 362 &rootprompt;<userinput>chown root.root /var/spool/samba</userinput>
 363 </screen>
 364                         </para></listitem>
 365
 366                         <listitem><para>
 367                         Directory permissions should be set for public read-write with the
 368                         sticky-bit set as shown:
 369 <screen>
 370 &rootprompt;<userinput>chmod a+rw TX /var/spool/samba</userinput>
 371 </screen>
 372                         </para></listitem>
 373                 </itemizedlist>
 374
 375
 376                 <note><para>
 377                 <indexterm><primary>MIME</primary><secondary>raw</secondary></indexterm>
 378                 <indexterm><primary>raw printing</primary></indexterm>
 379                 On CUPS enabled systems there is a facility to pass raw data directly to the printer without
 380                 intermediate processing via CUPS print filters. Where use of this mode of operation is desired
 381                 it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
 382                 handler in the <filename>/etc/mime.conv</filename> and <filename>/etc/mime.types</filename>
 383                 files. Refer to <link linkend="cups-raw"></link>.
 384                 </para></note>
 385
 386                 </sect3>
 387
 388                 <sect3>
 389                 <title>Secure Read-Write File and Print Server</title>
 390
 391                 <para>
 392                 We progress now from simple systems to a server that is slightly more complex.
 393                 </para>
 394
 395                 <para>
 396                 Our new server will require a public data storage area in which only authenticated
 397                 users (i.e., those with a local account) can store files, as well as a home directory.
 398                 There will be one printer that should be available for everyone to use.
 399                 </para>
 400
 401                 <para>
 402                 In this hypothetical environment (no espionage was conducted to obtain this data),
 403                 the site is demanding a simple environment that is <emphasis>secure enough</emphasis>
 404                 but not too difficult to use.
 405                 </para>
 406
 407                 <para>
 408                 Site users will be: Jack Baumbach, Mary Orville and Amed Sehkah. Each will have
 409                 a password (not shown in further examples). Mary will be the printer administrator and will
 410                 own all files in the public share.
 411                 </para>
 412
 413                 <para>
 414                 This configuration will be based on <emphasis>User Level Security</emphasis> that
 415                 is the default, and for which the default is to store Microsoft Windows-compatible
 416                 encrypted passwords in a file called <filename>/etc/samba/smbpasswd</filename>.
 417                 The default &smb.conf; entry that makes this happen is:
 418                 <smbconfoption><name>passdb backend</name><value>smbpasswd, guest</value></smbconfoption>. Since this is the default
 419                 it is not necessary to enter it into the configuration file. Note that guest backend is
 420                 added to the list of active passdb backends not matter was it specified directly in Samba configuration
 421                 file or not.
 422                 </para>
 423
 424
 425                 <procedure>
 426                 <title>Installing the Secure Office Server</title>
 427                         <step><para>
 428                 <indexterm><primary>office server</primary></indexterm>
 429                         Add all users to the Operating System:
 430 <screen>
 431 &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
 432 &rootprompt;<userinput>useradd -c "Mary Orville" -m -g users -p secret maryo</userinput>
 433 &rootprompt;<userinput>useradd -c "Amed Sehkah" -m -g users -p secret ameds</userinput>
 434 </screen>
 435                         </para></step>
 436
 437                         <step><para>
 438                         Configure the Samba &smb.conf; file as shown in <link linkend="OfficeServer"/>.
 439 <smbconfexample id="OfficeServer">
 440 <title>Secure Office Server smb.conf</title>
 441 <smbconfcomment>Global parameters</smbconfcomment>
 442 <smbconfsection>[global]</smbconfsection>
 443 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 444 <smbconfoption><name>netbios name</name><value>OLORIN</value></smbconfoption>
 445 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
 446 <smbconfoption><name>disable spoolss</name><value>Yes</value></smbconfoption>
 447 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
 448 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
 449
 450 <smbconfsection>[homes]</smbconfsection>
 451 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
 452 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
 453 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 454 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 455
 456 <smbconfsection>[public]</smbconfsection>
 457 <smbconfoption><name>comment</name><value>Data</value></smbconfoption>
 458 <smbconfoption><name>path</name><value>/export</value></smbconfoption>
 459 <smbconfoption><name>force user</name><value>maryo</value></smbconfoption>
 460 <smbconfoption><name>force group</name><value>users</value></smbconfoption>
 461 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 462 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 463
 464 <smbconfsection>[printers]</smbconfsection>
 465 <smbconfoption><name>comment</name><value>All Printers</value></smbconfoption>
 466 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
 467 <smbconfoption><name>printer admin</name><value>root, maryo</value></smbconfoption>
 468 <smbconfoption><name>create mask</name><value>0600</value></smbconfoption>
 469 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 470 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
 471 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
 472 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 473                         </smbconfexample>
 474                         </para></step>
 475
 476                         <step><para>
 477                         Initialize the Microsoft Windows password database with the new users:
 478 <screen>
 479 &rootprompt;<userinput>smbpasswd -a root</userinput>
 480 New SMB password: <userinput>bigsecret</userinput>
 481 Reenter smb password: <userinput>bigsecret</userinput>
 482 Added user root.
 483
 484 &rootprompt;<userinput>smbpasswd -a jackb</userinput>
 485 New SMB password: <userinput>m0r3pa1n</userinput>
 486 Retype new SMB password: <userinput>m0r3pa1n</userinput>
 487 Added user jackb.
 488
 489 &rootprompt;<userinput>smbpasswd -a maryo</userinput>
 490 New SMB password: <userinput>secret</userinput>
 491 Reenter smb password: <userinput>secret</userinput>
 492 Added user maryo.
 493
 494 &rootprompt;<userinput>smbpasswd -a ameds</userinput>
 495 New SMB password: <userinput>mysecret</userinput>
 496 Reenter smb password: <userinput>mysecret</userinput>
 497 Added user ameds.
 498 </screen>
 499                         </para></step>
 500
 501                         <step><para>
 502                         Install printer using the CUPS Web interface. Make certain that all
 503                         printers that will be shared with Microsoft Windows clients are installed
 504                         as raw printing devices.
 505                         </para></step>
 506
 507                         <step><para>
 508                         Start Samba using the operating system administrative interface.
 509                         Alternately, this can be done manually by running:
 510                         <indexterm><primary>smbd</primary></indexterm>
 511                         <indexterm><primary>nmbd</primary></indexterm>
 512                         <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
 513                         <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
 514 <screen>
 515 &rootprompt;<userinput> nmbd; smbd;</userinput>
 516 </screen>
 517                         </para></step>
 518
 519                         <step><para>
 520                         Configure the <filename>/export</filename> directory:
 521 <screen>
 522 &rootprompt;<userinput>mkdir /export</userinput>
 523 &rootprompt;<userinput>chown maryo.users /export</userinput>
 524 &rootprompt;<userinput>chmod u=rwx,g=rwx,o-rwx /export</userinput>
 525 </screen>
 526                         </para></step>
 527
 528                         <step><para>
 529                         Check that Samba is running correctly:
 530 <screen>
 531 &rootprompt;<userinput>smbclient -L localhost -U%</userinput>
 532 Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.0]
 533
 534 Sharename      Type      Comment
 535 ---------      ----      -------
 536 public         Disk      Data
 537 IPC$           IPC       IPC Service (Samba-3.0.0)
 538 ADMIN$         IPC       IPC Service (Samba-3.0.0)
 539 hplj4          Printer   hplj4
 540
 541 Server               Comment
 542 ---------            -------
 543 OLORIN               Samba-3.0.0
 544
 545 Workgroup            Master
 546 ---------            -------
 547 MIDEARTH             OLORIN
 548 </screen>
 549                         </para></step>
 550
 551                         <step><para>
 552                         Connect to OLORIN as maryo:
 553 <screen>
 554 &rootprompt;<userinput>smbclient //olorin/maryo -Umaryo%secret</userinput>
 555 OS=[UNIX] Server=[Samba-3.0.0]
 556 smb: \> <userinput>dir</userinput>
 557 .                             D        0  Sat Jun 21 10:58:16 2003
 558 ..                            D        0  Sat Jun 21 10:54:32 2003
 559 Documents                      D        0  Fri Apr 25 13:23:58 2003
 560 DOCWORK                        D        0  Sat Jun 14 15:40:34 2003
 561 OpenOffice.org                 D        0  Fri Apr 25 13:55:16 2003
 562 .bashrc                        H     1286  Fri Apr 25 13:23:58 2003
 563 .netscape6                    DH        0  Fri Apr 25 13:55:13 2003
 564 .mozilla                      DH        0  Wed Mar  5 11:50:50 2003
 565 .kermrc                        H      164  Fri Apr 25 13:23:58 2003
 566 .acrobat                      DH        0  Fri Apr 25 15:41:02 2003
 567
 568                 55817 blocks of size 524288. 34725 blocks available
 569 smb: \> <userinput>q</userinput>
 570 </screen>
 571                         </para></step>
 572                 </procedure>
 573
 574                 </sect3>
 575
 576         <para>
 577         By now you should be getting the hang of configuration basics. Clearly, it is time to
 578         explore slightly more complex examples. For the remainder of this chapter we will abbreviate
 579         instructions since there are previous examples.
 580         </para>
 581
 582         </sect2>
 583
 584         <sect2>
 585         <title>Domain Member Server</title>
 586
 587
 588         <para>
 589         <indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
 590         In this instance we will consider the simplest server configuration we can get away with
 591         to make an accounting department happy. Let's be warned, the users are accountants and they
 592         do have some nasty demands. There is a budget for only one server for this department.
 593         </para>
 594
 595         <para>
 596         The network is managed by an internal Information Services Group (ISG), to which we belong.
 597         Internal politics are typical of a medium-sized organization; Human Resources is of the
 598         opinion that they run the ISG because they are always adding and disabling users. Also,
 599         departmental managers have to fight tooth and nail to gain basic network resources access for
 600         their staff. Accounting is different though, they get exactly what they want. So this should
 601         set the scene.
 602         </para>
 603
 604         <para>
 605         We will use the users from the last example. The accounting department
 606         has a general printer that all departmental users may. There is also a check printer
 607         that may be used only by the person who has authority to print checks. The Chief Financial
 608         Officer (CFO) wants that printer to be completely restricted and for it to be located in the
 609         private storage area in her office. It therefore must be a network printer.
 610         </para>
 611
 612         <para>
 613         Accounting department uses an accounting application called <emphasis>SpytFull</emphasis>
 614         that must be run from a central application server. The software is licensed to run only off
 615         one server, there are no workstation components, and it is run off a mapped share. The data
 616         store is in a UNIX-based SQL backend. The UNIX gurus look after that, so is not our
 617         problem.
 618         </para>
 619
 620         <para>
 621         The accounting department manager (maryo) wants a general filing system as well as a separate
 622         file storage area for form letters (nastygrams). The form letter area should be read-only to
 623         all accounting staff except the manager. The general filing system has to have a structured
 624         layout with a general area for all staff to store general documents, as well as a separate
 625         file area for each member of her team that is private to that person, but she wants full
 626         access to all areas. Users must have a private home share for personal work-related files
 627         and for materials not related to departmental operations.
 628         </para>
 629
 630                 <sect3>
 631                 <title>Example Configuration</title>
 632
 633                 <para>
 634                 The server <emphasis>valinor</emphasis> will be a member server of the company domain.
 635                 Accounting will have only a local server. User accounts will be on the Domain Controllers
 636                 as will desktop profiles and all network policy files.
 637                 </para>
 638
 639                 <procedure>
 640                         <step><para>
 641                         Do not add users to the UNIX/Linux server; all of this will run off the
 642                         central domain.
 643                         </para></step>
 644
 645                         <step><para>
 646                         Configure &smb.conf; according to <link linkend="fast-member-server"/>
 647                         and <link linkend="fast-memberserver-shares"></link>.
 648                         </para>
 649
 650                         <para>
 651                         <smbconfexample id="fast-member-server">
 652                         <title>Member server smb.conf (globals)</title>
 653 <smbconfcomment>Global parameters</smbconfcomment>
 654 <smbconfsection>[global]</smbconfsection>
 655 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 656 <smbconfoption><name>netbios name</name><value>VALINOR</value></smbconfoption>
 657 <smbconfoption><name>security</name><value>DOMAIN</value></smbconfoption>
 658 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
 659 <smbconfoption><name>disable spoolss</name><value>Yes</value></smbconfoption>
 660 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
 661 <smbconfoption><name>idmap uid</name><value>15000-20000</value></smbconfoption>
 662 <smbconfoption><name>idmap gid</name><value>15000-20000</value></smbconfoption>
 663 <smbconfoption><name>winbind separator</name><value>+</value></smbconfoption>
 664 <smbconfoption><name>winbind use default domain</name><value>Yes</value></smbconfoption>
 665 <smbconfoption><name>use sendfile</name><value>Yes</value></smbconfoption>
 666 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
 667                         </smbconfexample></para>
 668
 669                         <para>
 670                         <smbconfexample id="fast-memberserver-shares">
 671                         <title>Member server smb.conf (shares and services)</title>
 672 <smbconfsection>[homes]</smbconfsection>
 673 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
 674 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
 675 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 676 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 677
 678 <smbconfsection>[spytfull]</smbconfsection>
 679 <smbconfoption><name>comment</name><value>Accounting Application Only</value></smbconfoption>
 680 <smbconfoption><name>path</name><value>/export/spytfull</value></smbconfoption>
 681 <smbconfoption><name>valid users</name><value>@Accounts</value></smbconfoption>
 682 <smbconfoption><name>admin users</name><value>maryo</value></smbconfoption>
 683 <smbconfoption><name>read only</name><value>Yes</value></smbconfoption>
 684
 685 <smbconfsection>[public]</smbconfsection>
 686 <smbconfoption><name>comment</name><value>Data</value></smbconfoption>
 687 <smbconfoption><name>path</name><value>/export/public</value></smbconfoption>
 688 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 689
 690 <smbconfsection>[printers]</smbconfsection>
 691 <smbconfoption><name>comment</name><value>All Printers</value></smbconfoption>
 692 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
 693 <smbconfoption><name>printer admin</name><value>root, maryo</value></smbconfoption>
 694 <smbconfoption><name>create mask</name><value>0600</value></smbconfoption>
 695 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 696 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
 697 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
 698 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 699                         </smbconfexample>
 700                         </para></step>
 701
 702
 703                         <step><para>
 704 <indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
 705                         Join the domain. Note: Do not start Samba until this step has been completed!
 706 <screen>
 707 &rootprompt;<userinput>net rpc join -Uroot%'bigsecret'</userinput>
 708 Joined domain MIDEARTH.
 709 </screen>
 710                         </para></step>
 711
 712                         <step><para>
 713                         Make absolutely certain that you disable (shut down) the <command>nscd</command>
 714                         daemon on any system on which <command>winbind</command> is configured to run.
 715                         </para></step>
 716
 717                         <step><para>
 718                         Start Samba following the normal method for your operating system platform.
 719                         If you wish to this manually execute as root:
 720                         <indexterm><primary>smbd</primary></indexterm>
 721                         <indexterm><primary>nmbd</primary></indexterm>
 722                         <indexterm><primary>winbindd</primary></indexterm>
 723                         <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
 724                         <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
 725                         <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
 726 <screen>
 727 &rootprompt;<userinput>nmbd; smbd; winbindd;</userinput>
 728 </screen>
 729                         </para></step>
 730
 731                         <step><para>
 732                         Configure the name service switch control file on your system to resolve user and group names
 733                         via winbind. Edit the following lines in <filename>/etc/nsswitch.conf</filename>:
 734 <programlisting>
 735 passwd: files winbind
 736 group:  files winbind
 737 hosts:  files dns winbind
 738 </programlisting>
 739                         </para></step>
 740
 741                         <step><para>
 742                         Set the password for <command>wbinfo</command> to use:
 743 <screen>
 744 &rootprompt;<userinput>wbinfo --set-auth-user=root%'bigsecret'</userinput>
 745 </screen>
 746                         </para></step>
 747
 748                         <step><para>
 749                         Validate that domain user and group credentials can be correctly resolved by executing:
 750 <screen>
 751 &rootprompt;<userinput>wbinfo -u</userinput>
 752 MIDEARTH+maryo
 753 MIDEARTH+jackb
 754 MIDEARTH+ameds
 755 ...
 756 MIDEARTH+root
 757
 758 &rootprompt;<userinput>wbinfo -g</userinput>
 759 MIDEARTH+Domain Users
 760 MIDEARTH+Domain Admins
 761 MIDEARTH+Domain Guests
 762 ...
 763 MIDEARTH+Accounts
 764 </screen>
 765                         </para></step>
 766
 767                         <step><para>
 768                         Check that <command>winbind</command> is working. The following demonstrates correct
 769                         username resolution via the <command>getent</command> system utility:
 770 <screen>
 771 &rootprompt;<userinput>getent passwd maryo</userinput>
 772 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
 773 </screen>
 774                         </para></step>
 775
 776                         <step><para>
 777                         A final test that we have this under control might be reassuring:
 778 <screen>
 779 &rootprompt;<userinput>touch /export/a_file</userinput>
 780 &rootprompt;<userinput>chown maryo /export/a_file</userinput>
 781 &rootprompt;<userinput>ls -al /export/a_file</userinput>
 782 ...
 783 -rw-r--r--    1 maryo    users       11234 Jun 21 15:32 a_file
 784 ...
 785
 786 &rootprompt;<userinput>rm /export/a_file</userinput>
 787 </screen>
 788                         </para></step>
 789
 790                         <step><para>
 791                         Configuration is now mostly complete, so this is an opportune time
 792                         to configure the directory structure for this site:
 793 <screen>
 794 &rootprompt;<userinput>mkdir -p /export/{spytfull,public}</userinput>
 795 &rootprompt;<userinput>chmod ug=rwxS,o=x /export/{spytfull,public}</userinput>
 796 &rootprompt;<userinput>chown maryo.Accounts /export/{spytfull,public}</userinput>
 797 </screen>
 798                         </para></step>
 799                 </procedure>
 800
 801                 </sect3>
 802
 803         </sect2>
 804
 805         <sect2>
 806         <title>Domain Controller</title>
 807
 808
 809         <para>
 810         <indexterm><primary>Server Type</primary><secondary>Domain Controller</secondary></indexterm>
 811         For the remainder of this chapter the focus is on the configuration of Domain Control.
 812         The examples that follow are for two implementation strategies. Remember, our objective is
 813         to create a simple but working solution. The remainder of this book should help to highlight
 814         opportunity for greater functionality and the complexity that goes with it.
 815         </para>
 816
 817         <para>
 818         A Domain Controller configuration can be achieved with a simple configuration using the new
 819         tdbsam password backend. This type of configuration is good for small
 820         offices, but has limited scalability (cannot be replicated) and performance can be expected
 821         to fall as the size and complexity of the domain increases.
 822         </para>
 823
 824         <para>
 825         The use of tdbsam is best limited to sites that do not need
 826         more than a primary Domain Controller (PDC). As the size of a domain grows the need
 827         for additional Domain Controllers becomes apparent. Do not attempt to under-resource
 828         a Microsoft Windows network environment; Domain Controllers provide essential
 829         authentication services. The following are symptoms of an under-resourced Domain Control
 830         environment:
 831         </para>
 832
 833         <itemizedlist>
 834                 <listitem><para>
 835                  Domain logons intermittently fail.
 836                 </para></listitem>
 837
 838                 <listitem><para>
 839                 File access on a Domain Member server intermittently fails, giving a permission denied
 840                 error message.
 841                 </para></listitem>
 842         </itemizedlist>
 843
 844         <para>
 845         A more scalable Domain Control authentication backend option might use
 846         Microsoft Active Directory, or an LDAP-based backend. Samba-3 provides
 847         for both options as a Domain Member server. As a PDC Samba-3 is not able to provide
 848         an exact alternative to the functionality that is available with Active Directory.
 849         Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
 850         </para>
 851
 852         <para>
 853         The tdbsam authentication backend provides no facility to replicate
 854         the contents of the database, except by external means. (i.e., there is no self-contained protocol
 855         in Samba-3 for Security Account Manager database [SAM] replication.)
 856         </para>
 857
 858         <note><para>
 859         If you need more than one Domain Controller, do not use a tdbsam authentication backend.
 860         </para></note>
 861
 862                 <sect3>
 863                 <title>Example: Engineering Office</title>
 864
 865                 <para>
 866                 The engineering office network server we present here is designed to demonstrate use
 867                 of the new tdbsam password backend. The tdbsam
 868                 facility is new to Samba-3. It is designed to provide many user and machine account controls
 869                 that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
 870                 </para>
 871
 872                 <procedure>
 873                         <step><para>
 874                         A working PDC configuration using the tdbsam
 875                         password backend can be found in <link linkend="fast-engoffice-global"></link> together with
 876                         <link linkend="fast-engoffice-shares"></link>:
 877                         </para>
 878
 879                         <para>
 880 <indexterm><primary>pdbedit</primary></indexterm>
 881                         <smbconfexample id="fast-engoffice-global">
 882                         <title>Engineering Office smb.conf (globals)</title>
 883 <smbconfsection>[global]</smbconfsection>
 884 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
 885 <smbconfoption><name>netbios name</name><value>FRODO</value></smbconfoption>
 886 <smbconfoption><name>passdb backend</name><value>tdbsam</value></smbconfoption>
 887 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
 888 <smbconfoption><name>add user script</name><value>/usr/sbin/useradd -m %u</value></smbconfoption>
 889 <smbconfoption><name>delete user script</name><value>/usr/sbin/userdel -r %u</value></smbconfoption>
 890 <smbconfoption><name>add group script</name><value>/usr/sbin/groupadd %g</value></smbconfoption>
 891 <smbconfoption><name>delete group script</name><value>/usr/sbin/groupdel %g</value></smbconfoption>
 892 <smbconfoption><name>add user to group script</name><value>/usr/sbin/usermod -G %g %u</value></smbconfoption>
 893 <smbconfoption><name>add machine script</name><value>/usr/sbin/useradd -s /bin/false \</value></smbconfoption>
 894 <member><parameter>        -d /dev/null %u</parameter></member>
 895 <smbconfcomment>Note: The following specifies the default logon script.</smbconfcomment>
 896 <smbconfcomment>Per user logon scripts can be specified in the user account using pdbedit </smbconfcomment>
 897 <smbconfoption><name>logon script</name><value>scripts\logon.bat</value></smbconfoption>
 898 <smbconfcomment>This sets the default profile path. Set per user paths with pdbedit</smbconfcomment>
 899 <smbconfoption><name>logon path</name><value>\\%L\Profiles\%U</value></smbconfoption>
 900 <smbconfoption><name>logon drive</name><value>H:</value></smbconfoption>
 901 <smbconfoption><name>logon home</name><value>\\%L\%U</value></smbconfoption>
 902 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
 903 <smbconfoption><name>os level</name><value>35</value></smbconfoption>
 904 <smbconfoption><name>preferred master</name><value>Yes</value></smbconfoption>
 905 <smbconfoption><name>domain master</name><value>Yes</value></smbconfoption>
 906 <smbconfoption><name>idmap uid</name><value>15000-20000</value></smbconfoption>
 907 <smbconfoption><name>idmap gid</name><value>15000-20000</value></smbconfoption>
 908 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
 909                         </smbconfexample>
 910
 911                         <smbconfexample id="fast-engoffice-shares">
 912                         <title>Engineering Office smb.conf (shares and services)</title>
 913 <smbconfsection>[homes]</smbconfsection>
 914 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
 915 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
 916 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 917 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 918
 919 <smbconfcomment>Printing auto-share (makes printers available thru CUPS)</smbconfcomment>
 920 <smbconfsection>[printers]</smbconfsection>
 921 <smbconfoption><name>comment</name><value>All Printers</value></smbconfoption>
 922 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
 923 <smbconfoption><name>printer admin</name><value>root, maryo</value></smbconfoption>
 924 <smbconfoption><name>create mask</name><value>0600</value></smbconfoption>
 925 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 926 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
 927 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 928
 929 <smbconfsection>[print$]</smbconfsection>
 930 <smbconfoption><name>comment</name><value>Printer Drivers Share</value></smbconfoption>
 931 <smbconfoption><name>path</name><value>/var/lib/samba/drivers</value></smbconfoption>
 932 <smbconfoption><name>write list</name><value>maryo, root</value></smbconfoption>
 933 <smbconfoption><name>printer admin</name><value>maryo, root</value></smbconfoption>
 934
 935 <smbconfcomment>Needed to support domain logons</smbconfcomment>
 936 <smbconfsection>[netlogon]</smbconfsection>
 937 <smbconfoption><name>comment</name><value>Network Logon Service</value></smbconfoption>
 938 <smbconfoption><name>path</name><value>/var/lib/samba/netlogon</value></smbconfoption>
 939 <smbconfoption><name>admin users</name><value>root, maryo</value></smbconfoption>
 940 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
 941 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
 942
 943 <smbconfcomment>For profiles to work, create a user directory under the path</smbconfcomment>
 944 <smbconfcomment> shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</smbconfcomment>
 945 <smbconfsection>[Profiles]</smbconfsection>
 946 <smbconfoption><name>comment</name><value>Roaming Profile Share</value></smbconfoption>
 947 <smbconfoption><name>path</name><value>/var/lib/samba/profiles</value></smbconfoption>
 948 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
 949 <smbconfoption><name>profile acls</name><value>Yes</value></smbconfoption>
 950
 951 <smbconfcomment>Other resource (share/printer) definitions would follow below.</smbconfcomment>
 952 <member>...</member>
 953                         </smbconfexample>
 954                         </para></step>
 955
 956                         <step><para>
 957                         Create UNIX group accounts as needed using a suitable operating system tool:
 958 <screen>
 959 &rootprompt;<userinput>groupadd ntadmins</userinput>
 960 &rootprompt;<userinput>groupadd designers</userinput>
 961 &rootprompt;<userinput>groupadd engineers</userinput>
 962 &rootprompt;<userinput>groupadd qateam</userinput>
 963 </screen>
 964                         </para></step>
 965
 966                         <step><para>
 967                         Create user accounts on the system using the appropriate tool
 968                         provided with the operating system. Make sure all user home directories
 969                         are created also. Add users to groups as required for access control
 970                         on files, directories, printers, and as required for use in the Samba
 971                         environment.
 972                         </para></step>
 973
 974
 975                         <step><para>
 976 <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
 977 <indexterm><primary>initGroups.sh</primary></indexterm>
 978                         Assign each of the UNIX groups to NT groups:
 979                         (It may be useful to copy this text to a shell script called
 980                         <filename>initGroups.sh</filename>.)
 981                         <smbfile name="initGroups.sh">
 982                                 <title>Shell script for initializing group mappings</title>
 983                         <programlisting>
 984 #!/bin/bash
 985 #### Keep this as a shell script for future re-use
 986
 987 # First assign well known groups
 988 net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins rid=512
 989 net groupmap modify ntgroup="Domain Users"  unixgroup=users    rid=513
 990 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody   rid=514
 991
 992 # Now for our added Domain Groups
 993 net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=1112
 994 net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=1113
 995 net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=1114
 996 </programlisting>
 997 </smbfile>
 998                         </para></step>
 999
1000                         <step><para>
1001                         Create the <filename>scripts</filename> directory for use in the
1002                         <smbconfsection>[NETLOGON]</smbconfsection> share:
1003 <screen>
1004 &rootprompt;<userinput>mkdir -p /var/lib/samba/netlogon/scripts</userinput>
1005 </screen>
1006                         Place the logon scripts that will be used (batch or cmd scripts)
1007                         in this directory.
1008                         </para></step>
1009                 </procedure>
1010
1011                 <para>
1012                 The above configuration provides a functional Primary Domain Control (PDC)
1013                 system to which must be added file shares and printers as required.
1014                 </para>
1015
1016                 </sect3>
1017
1018                 <sect3>
1019                 <title>A Big Organization</title>
1020
1021                 <para>
1022                 In this section we finally get to review in brief a Samba-3 configuration that
1023                 uses a Light Weight Directory Access (LDAP)-based authentication backend. The
1024                 main reasons for this choice are to provide the ability to host primary
1025                 and Backup Domain Control (BDC), as well as to enable a higher degree of
1026                 scalability to meet the needs of a very distributed environment.
1027                 </para>
1028
1029                         <sect4>
1030                         <title>The Primary Domain Controller</title>
1031
1032                         <para>
1033                         This is an example of a minimal configuration to run a Samba-3 PDC
1034                         using an LDAP authentication backend. It is assumed that the operating system
1035                         has been correctly configured.
1036                         </para>
1037
1038                         <para>
1039                         The Idealx scripts (or equivalent) are needed to manage LDAP based Posix and/or
1040                         SambaSamAccounts. The Idealx scripts may be downloaded from the <ulink url="http://www.idealx.org">
1041                         Idealx</ulink> Web site. They may also be obtained from the Samba tarball. Linux
1042                         distributions tend to install the Idealx scripts in the
1043                         <filename>/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</filename> directory.
1044                         Idealx scripts version <constant>smbldap-tools-0.8.2</constant> are known to work well.
1045                         </para>
1046
1047                         <procedure>
1048                                 <step><para>
1049                                 Obtain from the Samba sources <filename>~/examples/LDAP/samba.schema</filename>
1050                                 and copy it to the <filename>/etc/openldap/schema/</filename> directory.
1051                                 </para></step>
1052
1053                                 <step><para>
1054                                 Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
1055                                 The <filename>/etc/openldap/slapd.conf</filename> file:
1056 <indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
1057 <smbfile name="slapd.conf"><title>Example slapd.conf file</title>
1058 <programlisting>
1059 # Note commented out lines have been removed
1060 include         /etc/openldap/schema/core.schema
1061 include         /etc/openldap/schema/cosine.schema
1062 include         /etc/openldap/schema/inetorgperson.schema
1063 include         /etc/openldap/schema/nis.schema
1064 include         /etc/openldap/schema/samba.schema
1065
1066 pidfile         /var/run/slapd/slapd.pid
1067 argsfile        /var/run/slapd/slapd.args
1068
1069 database        bdb
1070 suffix          "dc=quenya,dc=org"
1071 rootdn          "cn=Manager,dc=quenya,dc=org"
1072 rootpw          {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
1073 # The password for the above is 'nastyon3'
1074
1075 directory     /var/lib/ldap
1076
1077 index   objectClass     eq
1078 index cn                      pres,sub,eq
1079 index sn                      pres,sub,eq
1080 index uid                     pres,sub,eq
1081 index displayName             pres,sub,eq
1082 index uidNumber               eq
1083 index gidNumber               eq
1084 index memberUid               eq
1085 index   sambaSID              eq
1086 index   sambaPrimaryGroupSID  eq
1087 index   sambaDomainName       eq
1088 index   default               sub
1089 </programlisting>
1090 </smbfile>
1091                                 </para></step>
1092
1093                                 <step><para>
1094                                 Create the following file <filename>samba-ldap-init.ldif</filename>:
1095                                 <indexterm><primary>samba-ldap-init.ldif</primary></indexterm>
1096                                 <smbfile name="samba-ldap-init.ldif">
1097 <programlisting>
1098 # Organization for SambaXP Demo
1099 dn: dc=quenya,dc=org
1100 objectclass: dcObject
1101 objectclass: organization
1102 dc: quenya
1103 o: SambaXP Demo
1104 description: The SambaXP Demo LDAP Tree
1105
1106 # Organizational Role for Directory Management
1107 dn: cn=Manager,dc=quenya,dc=org
1108 objectclass: organizationalRole
1109 cn: Manager
1110 description: Directory Manager
1111
1112 # Setting up the container for users
1113 dn: ou=People, dc=quenya, dc=org
1114 objectclass: top
1115 objectclass: organizationalUnit
1116 ou: People
1117
1118 # Set up an admin handle for People OU
1119 dn: cn=admin, ou=People, dc=quenya, dc=org
1120 cn: admin
1121 objectclass: top
1122 objectclass: organizationalRole
1123 objectclass: simpleSecurityObject
1124 userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
1125 # The password for above is 'mordonL8'
1126 </programlisting>
1127 </smbfile>
1128                                 </para></step>
1129
1130                                 <step><para>
1131                                 Load the initial data above into the LDAP database:
1132 <screen>
1133 &rootprompt;<userinput>slapadd -v -l initdb.ldif</userinput>
1134 </screen>
1135                                 </para></step>
1136
1137                                 <step><para>
1138                                 Start the LDAP server using the appropriate tool or method for
1139                                 the operating system platform on which it is installed.
1140                                 </para></step>
1141
1142                                 <step><para>
1143                                 Install the Idealx script files in the <filename>/usr/local/sbin</filename> directory,
1144                                 then configure the smbldap_conf.pm file to match your system configuration.
1145                                 </para></step>
1146
1147                                 <step><para>
1148                                 The &smb.conf; file that drives this backend can be found in example <link linkend="fast-ldap"/>.
1149                                 </para>
1150
1151                                 <para>
1152 <smbconfexample id="fast-ldap">
1153 <title>LDAP backend smb.conf for PDC</title>
1154 <smbconfcomment>Global parameters</smbconfcomment>
1155 <smbconfsection>[global]</smbconfsection>
1156 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
1157 <smbconfoption><name>netbios name</name><value>FRODO</value></smbconfoption>
1158 <smbconfoption><name>passdb backend</name><value>ldapsam:ldap://localhost</value></smbconfoption>
1159 <smbconfoption><name>username map</name><value>/etc/samba/smbusers</value></smbconfoption>
1160 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
1161 <smbconfoption><name>add user script</name><value>/usr/local/sbin/smbldap-useradd.pl -m '%u'</value></smbconfoption>
1162 <smbconfoption><name>delete user script</name><value>/usr/local/sbin/smbldap-userdel.pl %u</value></smbconfoption>
1163 <smbconfoption><name>add group script</name><value>/usr/local/sbin/smbldap-groupadd.pl -p '%g'</value></smbconfoption>
1164 <smbconfoption><name>delete group script</name><value>/usr/local/sbin/smbldap-groupdel.pl '%g'</value></smbconfoption>
1165 <smbconfoption><name>add user to group script</name><value>/usr/local/sbin/ \</value></smbconfoption>
1166 <member><parameter>smbldap-groupmod.pl -m '%g' '%u'</parameter></member>
1167 <smbconfoption><name>delete user from group script</name><value>/usr/local/sbin/ \</value></smbconfoption>
1168 <member><parameter>smbldap-groupmod.pl -x '%g' '%u'</parameter></member>
1169 <smbconfoption><name>set primary group script</name><value>/usr/local/sbin/ \</value></smbconfoption>
1170 <member><parameter>smbldap-usermod.pl -g '%g' '%u'</parameter></member>
1171 <smbconfoption><name>add machine script</name><value>/usr/local/sbin/smbldap-useradd.pl -w '%u'</value></smbconfoption>
1172 <smbconfoption><name>logon script</name><value>scripts\logon.bat</value></smbconfoption>
1173 <smbconfoption><name>logon path</name><value>\\%L\Profiles\%U</value></smbconfoption>
1174 <smbconfoption><name>logon drive</name><value>H:</value></smbconfoption>
1175 <smbconfoption><name>logon home</name><value>\\%L\%U</value></smbconfoption>
1176 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
1177 <smbconfoption><name>os level</name><value>35</value></smbconfoption>
1178 <smbconfoption><name>preferred master</name><value>Yes</value></smbconfoption>
1179 <smbconfoption><name>domain master</name><value>Yes</value></smbconfoption>
1180 <smbconfoption><name>ldap suffix</name><value>dc=quenya,dc=org</value></smbconfoption>
1181 <smbconfoption><name>ldap machine suffix</name><value>ou=People</value></smbconfoption>
1182 <smbconfoption><name>ldap user suffix</name><value>ou=People</value></smbconfoption>
1183 <smbconfoption><name>ldap group suffix</name><value>ou=People</value></smbconfoption>
1184 <smbconfoption><name>ldap idmap suffix</name><value>ou=People</value></smbconfoption>
1185 <smbconfoption><name>ldap admin dn</name><value>cn=Manager</value></smbconfoption>
1186 <smbconfoption><name>ldap ssl</name><value>no</value></smbconfoption>
1187 <smbconfoption><name>ldap passwd sync</name><value>Yes</value></smbconfoption>
1188 <smbconfoption><name>idmap uid</name><value>15000-20000</value></smbconfoption>
1189 <smbconfoption><name>idmap gid</name><value>15000-20000</value></smbconfoption>
1190 <smbconfoption><name>winbind separator</name><value>+</value></smbconfoption>
1191 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
1192 <member>...</member>
1193 </smbconfexample>
1194                                 </para></step>
1195
1196                                 <step><para>
1197                                 Add the LDAP password to the <filename>secrets.tdc</filename> file so Samba can update
1198                                 the LDAP database:
1199 <screen>
1200 &rootprompt;<userinput>smbpasswd -w mordonL8</userinput>
1201 </screen>
1202                                 </para></step>
1203
1204                                 <step><para>
1205                                 Add users and groups as required. Users and groups added using Samba tools
1206                                 will automatically be added to both the LDAP backend as well as to the operating
1207                                 system as required.
1208                                 </para></step>
1209
1210                         </procedure>
1211
1212                         </sect4>
1213
1214                         <sect4>
1215                         <title>Backup Domain Controller</title>
1216
1217                         <para>
1218                         <link linkend="fast-bdc"/> shows the example configuration for the BDC.
1219                         </para>
1220
1221                         <procedure>
1222                                 <step><para>
1223                                 Decide if the BDC should have its own LDAP server or not. If the BDC is to be
1224                                 the LDAP server change the following &smb.conf; as indicated. The default
1225                                 configuration in <link linkend="fast-bdc"/> uses a central LDAP server.
1226 <smbconfexample id="fast-bdc">
1227 <title>Remote LDAP BDC smb.conf</title>
1228 <smbconfcomment>Global parameters</smbconfcomment>
1229 <smbconfsection>[global]</smbconfsection>
1230 <smbconfoption><name>workgroup</name><value>MIDEARTH</value></smbconfoption>
1231 <smbconfoption><name>netbios name</name><value>GANDALF</value></smbconfoption>
1232 <smbconfoption><name>passdb backend</name><value>ldapsam:ldap://frodo.quenya.org</value></smbconfoption>
1233 <smbconfoption><name>username map</name><value>/etc/samba/smbusers</value></smbconfoption>
1234 <smbconfoption><name>printcap name</name><value>cups</value></smbconfoption>
1235 <smbconfoption><name>logon script</name><value>scripts\logon.bat</value></smbconfoption>
1236 <smbconfoption><name>logon path</name><value>\\%L\Profiles\%U</value></smbconfoption>
1237 <smbconfoption><name>logon drive</name><value>H:</value></smbconfoption>
1238 <smbconfoption><name>logon home</name><value>\\%L\%U</value></smbconfoption>
1239 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
1240 <smbconfoption><name>os level</name><value>33</value></smbconfoption>
1241 <smbconfoption><name>preferred master</name><value>Yes</value></smbconfoption>
1242 <smbconfoption><name>domain master</name><value>No</value></smbconfoption>
1243 <smbconfoption><name>ldap suffix</name><value>dc=quenya,dc=org</value></smbconfoption>
1244 <smbconfoption><name>ldap machine suffix</name><value>ou=People</value></smbconfoption>
1245 <smbconfoption><name>ldap user suffix</name><value>ou=People</value></smbconfoption>
1246 <smbconfoption><name>ldap group suffix</name><value>ou=People</value></smbconfoption>
1247 <smbconfoption><name>ldap idmap suffix</name><value>ou=People</value></smbconfoption>
1248 <smbconfoption><name>ldap admin dn</name><value>cn=Manager</value></smbconfoption>
1249 <smbconfoption><name>ldap ssl</name><value>no</value></smbconfoption>
1250 <smbconfoption><name>ldap passwd sync</name><value>Yes</value></smbconfoption>
1251 <smbconfoption><name>idmap uid</name><value>15000-20000</value></smbconfoption>
1252 <smbconfoption><name>idmap gid</name><value>15000-20000</value></smbconfoption>
1253 <smbconfoption><name>winbind separator</name><value>+</value></smbconfoption>
1254 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
1255 <member>...</member>
1256 </smbconfexample>
1257                                 </para></step>
1258
1259                                 <step><para>
1260                                 Configure the NETLOGON and PROFILES directory as for the PDC in <link linkend="fast-bdc"/>.
1261                                 </para></step>
1262                         </procedure>
1263
1264                         </sect4>
1265
1266                 </sect3>
1267
1268         </sect2>
1269
1270 </sect1>
1271
1272 </chapter>