docs/htmldocs/winbindd.8.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >winbindd</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="REFENTRY"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><H1
  16 ><A
  17 NAME="WINBINDD"
  18 >winbindd</A
  19 ></H1
  20 ><DIV
  21 CLASS="REFNAMEDIV"
  22 ><A
  23 NAME="AEN5"
  24 ></A
  25 ><H2
  26 >Name</H2
  27 >winbindd&nbsp;--&nbsp;Name Service Switch daemon for resolving names
  28         from NT servers</DIV
  29 ><DIV
  30 CLASS="REFSYNOPSISDIV"
  31 ><A
  32 NAME="AEN8"
  33 ></A
  34 ><H2
  35 >Synopsis</H2
  36 ><P
  37 ><B
  38 CLASS="COMMAND"
  39 >winbindd</B
  40 >  [-i] [-d &#60;debug level&#62;] [-s &#60;smb config file&#62;]</P
  41 ></DIV
  42 ><DIV
  43 CLASS="REFSECT1"
  44 ><A
  45 NAME="AEN14"
  46 ></A
  47 ><H2
  48 >DESCRIPTION</H2
  49 ><P
  50 >This program is part of the <A
  51 HREF="samba.7.html"
  52 TARGET="_top"
  53 >       Samba</A
  54 > suite.</P
  55 ><P
  56 ><B
  57 CLASS="COMMAND"
  58 >winbindd</B
  59 > is a daemon that provides
  60         a service for the Name Service Switch capability that is present
  61         in most modern C libraries.  The Name Service Switch allows user
  62         and system information to be obtained from different databases
  63         services such as NIS or DNS.  The exact behaviour can be configured
  64         throught the <TT
  65 CLASS="FILENAME"
  66 >/etc/nsswitch.conf</TT
  67 > file.
  68         Users and groups are allocated as they are resolved to a range
  69         of user and group ids specified by the administrator of the
  70         Samba system.</P
  71 ><P
  72 >The service provided by <B
  73 CLASS="COMMAND"
  74 >winbindd</B
  75 > is called `winbind' and
  76         can be used to resolve user and group information from a
  77         Windows NT server. The service can also provide authentication
  78         services via an associated PAM module. </P
  79 ><P
  80 >       The <TT
  81 CLASS="FILENAME"
  82 >pam_winbind</TT
  83 > module in the 2.2.2 release only
  84         supports the <TT
  85 CLASS="PARAMETER"
  86 ><I
  87 >auth</I
  88 ></TT
  89 > and <TT
  90 CLASS="PARAMETER"
  91 ><I
  92 >account</I
  93 ></TT
  94 >
  95         module-types.  The latter is simply
  96         performs a getpwnam() to verify that the system can obtain a uid for the
  97         user.  If the <TT
  98 CLASS="FILENAME"
  99 >libnss_winbind</TT
 100 > library has been correctly
 101         installed, this should always suceed.
 102         </P
 103 ><P
 104 >The following nsswitch databases are implemented by
 105         the winbindd service: </P
 106 ><P
 107 ></P
 108 ><DIV
 109 CLASS="VARIABLELIST"
 110 ><DL
 111 ><DT
 112 >hosts</DT
 113 ><DD
 114 ><P
 115 >User information traditionally stored in
 116                 the <TT
 117 CLASS="FILENAME"
 118 >hosts(5)</TT
 119 > file and used by
 120                 <B
 121 CLASS="COMMAND"
 122 >gethostbyname(3)</B
 123 > functions. Names are
 124                 resolved through the WINS server or by broadcast.
 125                 </P
 126 ></DD
 127 ><DT
 128 >passwd</DT
 129 ><DD
 130 ><P
 131 >User information traditionally stored in
 132                 the <TT
 133 CLASS="FILENAME"
 134 >passwd(5)</TT
 135 > file and used by
 136                 <B
 137 CLASS="COMMAND"
 138 >getpwent(3)</B
 139 > functions. </P
 140 ></DD
 141 ><DT
 142 >group</DT
 143 ><DD
 144 ><P
 145 >Group information traditionally stored in
 146                 the <TT
 147 CLASS="FILENAME"
 148 >group(5)</TT
 149 > file and used by
 150                 <B
 151 CLASS="COMMAND"
 152 >getgrent(3)</B
 153 > functions. </P
 154 ></DD
 155 ></DL
 156 ></DIV
 157 ><P
 158 >For example, the following simple configuration in the
 159         <TT
 160 CLASS="FILENAME"
 161 >/etc/nsswitch.conf</TT
 162 > file can be used to initially
 163         resolve user and group information from <TT
 164 CLASS="FILENAME"
 165 >/etc/passwd
 166         </TT
 167 > and <TT
 168 CLASS="FILENAME"
 169 >/etc/group</TT
 170 > and then from the
 171         Windows NT server. </P
 172 ><P
 173 ><TABLE
 174 BORDER="0"
 175 BGCOLOR="#E0E0E0"
 176 WIDTH="100%"
 177 ><TR
 178 ><TD
 179 ><PRE
 180 CLASS="PROGRAMLISTING"
 181 >passwd:         files winbind
 182 group:          files winbind
 183         </PRE
 184 ></TD
 185 ></TR
 186 ></TABLE
 187 ></P
 188 ><P
 189 >The following simple configuration in the
 190         <TT
 191 CLASS="FILENAME"
 192 >/etc/nsswitch.conf</TT
 193 > file can be used to initially
 194         resolve hostnames from <TT
 195 CLASS="FILENAME"
 196 >/etc/hosts</TT
 197 > and then from the
 198         WINS server.</P
 199 ></DIV
 200 ><DIV
 201 CLASS="REFSECT1"
 202 ><A
 203 NAME="AEN57"
 204 ></A
 205 ><H2
 206 >OPTIONS</H2
 207 ><P
 208 ></P
 209 ><DIV
 210 CLASS="VARIABLELIST"
 211 ><DL
 212 ><DT
 213 >-d debuglevel</DT
 214 ><DD
 215 ><P
 216 >Sets the debuglevel to an integer between
 217                 0 and 100. 0 is for no debugging and 100 is for reams and
 218                 reams. To submit a bug report to the Samba Team, use debug
 219                 level 100 (see BUGS.txt).   </P
 220 ></DD
 221 ><DT
 222 >-i</DT
 223 ><DD
 224 ><P
 225 >Tells <B
 226 CLASS="COMMAND"
 227 >winbindd</B
 228 > to not
 229                 become a daemon and detach from the current terminal. This
 230                 option is used by developers when interactive debugging
 231                 of <B
 232 CLASS="COMMAND"
 233 >winbindd</B
 234 > is required. </P
 235 ></DD
 236 ></DL
 237 ></DIV
 238 ></DIV
 239 ><DIV
 240 CLASS="REFSECT1"
 241 ><A
 242 NAME="AEN70"
 243 ></A
 244 ><H2
 245 >NAME AND ID RESOLUTION</H2
 246 ><P
 247 >Users and groups on a Windows NT server are assigned
 248         a relative id (rid) which is unique for the domain when the
 249         user or group is created.  To convert the Windows NT user or group
 250         into a unix user or group, a mapping between rids and unix user
 251         and group ids is required.  This is one of the jobs that <B
 252 CLASS="COMMAND"
 253 >       winbindd</B
 254 > performs. </P
 255 ><P
 256 >As winbindd users and groups are resolved from a server, user
 257         and group ids are allocated from a specified range.  This
 258         is done on a first come, first served basis, although all existing
 259         users and groups will be mapped as soon as a client performs a user
 260         or group enumeration command.  The allocated unix ids are stored
 261         in a database file under the Samba lock directory and will be
 262         remembered. </P
 263 ><P
 264 >WARNING: The rid to unix id database is the only location
 265         where the user and group mappings are stored by winbindd.  If this
 266         file is deleted or corrupted, there is no way for winbindd to
 267         determine which user and group ids correspond to Windows NT user
 268         and group rids. </P
 269 ></DIV
 270 ><DIV
 271 CLASS="REFSECT1"
 272 ><A
 273 NAME="AEN76"
 274 ></A
 275 ><H2
 276 >CONFIGURATION</H2
 277 ><P
 278 >Configuration of the <B
 279 CLASS="COMMAND"
 280 >winbindd</B
 281 > daemon
 282         is done through configuration parameters in the <TT
 283 CLASS="FILENAME"
 284 >smb.conf(5)
 285         </TT
 286 > file.  All parameters should be specified in the
 287         [global] section of smb.conf. </P
 288 ><P
 289 ></P
 290 ><DIV
 291 CLASS="VARIABLELIST"
 292 ><DL
 293 ><DT
 294 >winbind separator</DT
 295 ><DD
 296 ><P
 297 >The winbind separator option allows you
 298                 to specify how NT domain names and user names are combined
 299                 into unix user names when presented to users. By default,
 300                 <B
 301 CLASS="COMMAND"
 302 >winbindd</B
 303 > will use the traditional '\'
 304                 separator so that the unix user names look like
 305                 DOMAIN\username. In some cases this separator character may
 306                 cause problems as the '\' character has special meaning in
 307                 unix shells.  In that case you can use the winbind separator
 308                 option to specify an alternative separator character. Good
 309                 alternatives may be '/' (although that conflicts
 310                 with the unix directory separator) or a '+ 'character.
 311                 The '+' character appears to be the best choice for 100%
 312                 compatibility with existing unix utilities, but may be an
 313                 aesthetically bad choice depending on your taste. </P
 314 ><P
 315 >Default: <B
 316 CLASS="COMMAND"
 317 >winbind separator = \ </B
 318 >
 319                 </P
 320 ><P
 321 >Example: <B
 322 CLASS="COMMAND"
 323 >winbind separator = + </B
 324 ></P
 325 ></DD
 326 ><DT
 327 >winbind uid</DT
 328 ><DD
 329 ><P
 330 >The winbind uid parameter specifies the
 331                 range of user ids that are allocated by the winbindd daemon.
 332                 This range of ids should have no existing local or NIS users
 333                 within it as strange conflicts can occur otherwise. </P
 334 ><P
 335 >Default: <B
 336 CLASS="COMMAND"
 337 >winbind uid = &#60;empty string&#62;
 338                 </B
 339 ></P
 340 ><P
 341 >Example: <B
 342 CLASS="COMMAND"
 343 >winbind uid = 10000-20000</B
 344 ></P
 345 ></DD
 346 ><DT
 347 >winbind gid</DT
 348 ><DD
 349 ><P
 350 >The winbind gid parameter specifies the
 351                 range of group ids that are allocated by the winbindd daemon.
 352                 This range of group ids should have no existing local or NIS
 353                 groups within it as strange conflicts can occur otherwise.</P
 354 ><P
 355 >Default: <B
 356 CLASS="COMMAND"
 357 >winbind gid = &#60;empty string&#62;
 358                 </B
 359 ></P
 360 ><P
 361 >Example: <B
 362 CLASS="COMMAND"
 363 >winbind gid = 10000-20000
 364                 </B
 365 > </P
 366 ></DD
 367 ><DT
 368 >winbind cache time</DT
 369 ><DD
 370 ><P
 371 >This parameter specifies the number of
 372                 seconds the winbindd daemon will cache user and group information
 373                 before querying a Windows NT server again. When a item in the
 374                 cache is older than this time winbindd will ask the domain
 375                 controller for the sequence number of the server's account database.
 376                 If the sequence number has not changed then the cached item is
 377                 marked as valid for a further <TT
 378 CLASS="PARAMETER"
 379 ><I
 380 >winbind cache time
 381                 </I
 382 ></TT
 383 > seconds.  Otherwise the item is fetched from the
 384                 server. This means that as long as the account database is not
 385                 actively changing winbindd will only have to send one sequence
 386                 number query packet every <TT
 387 CLASS="PARAMETER"
 388 ><I
 389 >winbind cache time
 390                 </I
 391 ></TT
 392 > seconds. </P
 393 ><P
 394 >Default: <B
 395 CLASS="COMMAND"
 396 >winbind cache time = 15</B
 397 >
 398                 </P
 399 ></DD
 400 ><DT
 401 >winbind enum users</DT
 402 ><DD
 403 ><P
 404 >On large installations it may be necessary
 405                 to suppress the enumeration of users through the <B
 406 CLASS="COMMAND"
 407 >               setpwent()</B
 408 >, <B
 409 CLASS="COMMAND"
 410 >getpwent()</B
 411 > and
 412                 <B
 413 CLASS="COMMAND"
 414 >endpwent()</B
 415 > group of system calls.  If
 416                 the <TT
 417 CLASS="PARAMETER"
 418 ><I
 419 >winbind enum users</I
 420 ></TT
 421 > parameter is false,
 422                 calls to the <B
 423 CLASS="COMMAND"
 424 >getpwent</B
 425 > system call will not
 426                 return any data. </P
 427 ><P
 428 ><EM
 429 >Warning:</EM
 430 > Turning off user enumeration
 431                 may cause some programs to behave oddly.  For example, the <B
 432 CLASS="COMMAND"
 433 >finger</B
 434 >
 435                 program relies on having access to the full user list when
 436                 searching  for matching usernames. </P
 437 ><P
 438 >Default: <B
 439 CLASS="COMMAND"
 440 >winbind enum users = yes </B
 441 ></P
 442 ></DD
 443 ><DT
 444 >winbind enum groups</DT
 445 ><DD
 446 ><P
 447 >On large installations it may be necessary
 448                 to suppress the enumeration of groups through the <B
 449 CLASS="COMMAND"
 450 >               setgrent()</B
 451 >, <B
 452 CLASS="COMMAND"
 453 >getgrent()</B
 454 > and
 455                 <B
 456 CLASS="COMMAND"
 457 >endgrent()</B
 458 > group of system calls.  If
 459                 the <TT
 460 CLASS="PARAMETER"
 461 ><I
 462 >winbind enum groups</I
 463 ></TT
 464 > parameter is
 465                 false, calls to the <B
 466 CLASS="COMMAND"
 467 >getgrent()</B
 468 > system
 469                 call will not return any data. </P
 470 ><P
 471 ><EM
 472 >Warning:</EM
 473 > Turning off group
 474                 enumeration may cause some programs to behave oddly.
 475                 </P
 476 ><P
 477 >Default: <B
 478 CLASS="COMMAND"
 479 >winbind enum groups = no </B
 480 >
 481                 </P
 482 ></DD
 483 ><DT
 484 >template homedir</DT
 485 ><DD
 486 ><P
 487 >When filling out the user information
 488                 for a Windows NT user, the <B
 489 CLASS="COMMAND"
 490 >winbindd</B
 491 > daemon
 492                 uses this parameter to fill in the home directory for that user.
 493                 If the string <TT
 494 CLASS="PARAMETER"
 495 ><I
 496 >%D</I
 497 ></TT
 498 > is present it is
 499                 substituted with the user's Windows NT domain name.  If the
 500                 string <TT
 501 CLASS="PARAMETER"
 502 ><I
 503 >%U</I
 504 ></TT
 505 > is present it is substituted
 506                 with the user's Windows NT user name. </P
 507 ><P
 508 >Default: <B
 509 CLASS="COMMAND"
 510 >template homedir = /home/%D/%U </B
 511 >
 512                 </P
 513 ></DD
 514 ><DT
 515 >template shell</DT
 516 ><DD
 517 ><P
 518 >When filling out the user information for
 519                 a Windows NT user, the <B
 520 CLASS="COMMAND"
 521 >winbindd</B
 522 > daemon
 523                 uses this parameter to fill in the shell for that user.
 524                 </P
 525 ><P
 526 >Default: <B
 527 CLASS="COMMAND"
 528 >template shell = /bin/false </B
 529 >
 530                 </P
 531 ></DD
 532 ></DL
 533 ></DIV
 534 ></DIV
 535 ><DIV
 536 CLASS="REFSECT1"
 537 ><A
 538 NAME="AEN158"
 539 ></A
 540 ><H2
 541 >EXAMPLE SETUP</H2
 542 ><P
 543 >To setup winbindd for user and group lookups plus
 544         authentication from a domain controller use something like the
 545         following setup. This was tested on a RedHat 6.2 Linux box. </P
 546 ><P
 547 >In <TT
 548 CLASS="FILENAME"
 549 >/etc/nsswitch.conf</TT
 550 > put the
 551         following:</P
 552 ><P
 553 ><TABLE
 554 BORDER="0"
 555 BGCOLOR="#E0E0E0"
 556 WIDTH="100%"
 557 ><TR
 558 ><TD
 559 ><PRE
 560 CLASS="PROGRAMLISTING"
 561 >passwd:     files winbind
 562 group:      files winbind
 563         </PRE
 564 ></TD
 565 ></TR
 566 ></TABLE
 567 ></P
 568 ><P
 569 >In <TT
 570 CLASS="FILENAME"
 571 >/etc/pam.d/*</TT
 572 > replace the
 573         <TT
 574 CLASS="PARAMETER"
 575 ><I
 576 >auth</I
 577 ></TT
 578 > lines with something like this: </P
 579 ><P
 580 ><TABLE
 581 BORDER="0"
 582 BGCOLOR="#E0E0E0"
 583 WIDTH="100%"
 584 ><TR
 585 ><TD
 586 ><PRE
 587 CLASS="PROGRAMLISTING"
 588 >auth       required    /lib/security/pam_securetty.so
 589 auth       required     /lib/security/pam_nologin.so
 590 auth       sufficient   /lib/security/pam_winbind.so
 591 auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
 592         </PRE
 593 ></TD
 594 ></TR
 595 ></TABLE
 596 ></P
 597 ><P
 598 >Note in particular the use of the <TT
 599 CLASS="PARAMETER"
 600 ><I
 601 >sufficient</I
 602 ></TT
 603 >
 604         keyword and the <TT
 605 CLASS="PARAMETER"
 606 ><I
 607 >use_first_pass</I
 608 ></TT
 609 > keyword. </P
 610 ><P
 611 >Now replace the account lines with this: </P
 612 ><P
 613 ><B
 614 CLASS="COMMAND"
 615 >account    required    /lib/security/pam_winbind.so
 616         </B
 617 ></P
 618 ><P
 619 >The next step is to join the domain. To do that use the
 620         <B
 621 CLASS="COMMAND"
 622 >smbpasswd</B
 623 > program like this:  </P
 624 ><P
 625 ><B
 626 CLASS="COMMAND"
 627 >smbpasswd -j DOMAIN -r PDC -U
 628         Administrator</B
 629 ></P
 630 ><P
 631 >The username after the <TT
 632 CLASS="PARAMETER"
 633 ><I
 634 >-U</I
 635 ></TT
 636 > can be any
 637         Domain user that has administrator privileges on the machine.
 638         Substitute your domain name for "DOMAIN" and the name of your PDC
 639         for "PDC".</P
 640 ><P
 641 >Next copy <TT
 642 CLASS="FILENAME"
 643 >libnss_winbind.so</TT
 644 > to
 645         <TT
 646 CLASS="FILENAME"
 647 >/lib</TT
 648 > and <TT
 649 CLASS="FILENAME"
 650 >pam_winbind.so</TT
 651 >
 652         to <TT
 653 CLASS="FILENAME"
 654 >/lib/security</TT
 655 >.  A symbolic link needs to be
 656         made from <TT
 657 CLASS="FILENAME"
 658 >/lib/libnss_winbind.so</TT
 659 > to
 660         <TT
 661 CLASS="FILENAME"
 662 >/lib/libnss_winbind.so.2</TT
 663 >.  If you are using an
 664         older version of glibc then the target of the link should be
 665         <TT
 666 CLASS="FILENAME"
 667 >/lib/libnss_winbind.so.1</TT
 668 >.</P
 669 ><P
 670 >Finally, setup a <TT
 671 CLASS="FILENAME"
 672 >smb.conf</TT
 673 > containing directives like the
 674         following:  </P
 675 ><P
 676 ><TABLE
 677 BORDER="0"
 678 BGCOLOR="#E0E0E0"
 679 WIDTH="100%"
 680 ><TR
 681 ><TD
 682 ><PRE
 683 CLASS="PROGRAMLISTING"
 684 >[global]
 685         winbind separator = +
 686         winbind cache time = 10
 687         template shell = /bin/bash
 688         template homedir = /home/%D/%U
 689         winbind uid = 10000-20000
 690         winbind gid = 10000-20000
 691         workgroup = DOMAIN
 692         security = domain
 693         password server = *
 694         </PRE
 695 ></TD
 696 ></TR
 697 ></TABLE
 698 ></P
 699 ><P
 700 >Now start winbindd and you should find that your user and
 701         group database is expanded to include your NT users and groups,
 702         and that you can login to your unix box as a domain user, using
 703         the DOMAIN+user syntax for the username. You may wish to use the
 704         commands <B
 705 CLASS="COMMAND"
 706 >getent passwd</B
 707 > and <B
 708 CLASS="COMMAND"
 709 >getent group
 710         </B
 711 > to confirm the correct operation of winbindd.</P
 712 ></DIV
 713 ><DIV
 714 CLASS="REFSECT1"
 715 ><A
 716 NAME="AEN197"
 717 ></A
 718 ><H2
 719 >NOTES</H2
 720 ><P
 721 >The following notes are useful when configuring and
 722         running <B
 723 CLASS="COMMAND"
 724 >winbindd</B
 725 >: </P
 726 ><P
 727 ><B
 728 CLASS="COMMAND"
 729 >nmbd</B
 730 > must be running on the local machine
 731         for <B
 732 CLASS="COMMAND"
 733 >winbindd</B
 734 > to work. <B
 735 CLASS="COMMAND"
 736 >winbindd</B
 737 >
 738         queries the list of trusted domains for the Windows NT server
 739         on startup and when a SIGHUP is received.  Thus, for a running <B
 740 CLASS="COMMAND"
 741 >       winbindd</B
 742 > to become aware of new trust relationships between
 743         servers, it must be sent a SIGHUP signal. </P
 744 ><P
 745 >Client processes resolving names through the <B
 746 CLASS="COMMAND"
 747 >winbindd</B
 748 >
 749         nsswitch module read an environment variable named <TT
 750 CLASS="ENVAR"
 751 >       $WINBINDD_DOMAIN</TT
 752 >.  If this variable contains a comma separated
 753         list of Windows NT domain names, then winbindd will only resolve users
 754         and groups within those Windows NT domains. </P
 755 ><P
 756 >PAM is really easy to misconfigure.  Make sure you know what
 757         you are doing when modifying PAM configuration files.  It is possible
 758         to set up PAM such that you can no longer log into your system. </P
 759 ><P
 760 >If more than one UNIX machine is running <B
 761 CLASS="COMMAND"
 762 >winbindd</B
 763 >,
 764         then in general the user and groups ids allocated by winbindd will not
 765         be the same.  The user and group ids will only be valid for the local
 766         machine.</P
 767 ><P
 768 >If the the Windows NT RID to UNIX user and group id mapping
 769         file is damaged or destroyed then the mappings will be lost. </P
 770 ></DIV
 771 ><DIV
 772 CLASS="REFSECT1"
 773 ><A
 774 NAME="AEN213"
 775 ></A
 776 ><H2
 777 >SIGNALS</H2
 778 ><P
 779 >The following signals can be used to manipulate the
 780         <B
 781 CLASS="COMMAND"
 782 >winbindd</B
 783 > daemon. </P
 784 ><P
 785 ></P
 786 ><DIV
 787 CLASS="VARIABLELIST"
 788 ><DL
 789 ><DT
 790 >SIGHUP</DT
 791 ><DD
 792 ><P
 793 >Reload the <TT
 794 CLASS="FILENAME"
 795 >smb.conf(5)</TT
 796 >
 797                 file and apply any parameter changes to the running
 798                 version of winbindd.  This signal also clears any cached
 799                 user and group information.  The list of other domains trusted
 800                 by winbindd is also reloaded.  </P
 801 ></DD
 802 ><DT
 803 >SIGUSR1</DT
 804 ><DD
 805 ><P
 806 >The SIGUSR1 signal will cause <B
 807 CLASS="COMMAND"
 808 >               winbindd</B
 809 > to write status information to the winbind
 810                 log file including information about the number of user and
 811                 group ids allocated by <B
 812 CLASS="COMMAND"
 813 >winbindd</B
 814 >.</P
 815 ><P
 816 >Log files are stored in the filename specified by the
 817                 log file parameter.</P
 818 ></DD
 819 ></DL
 820 ></DIV
 821 ></DIV
 822 ><DIV
 823 CLASS="REFSECT1"
 824 ><A
 825 NAME="AEN230"
 826 ></A
 827 ><H2
 828 >FILES</H2
 829 ><P
 830 ></P
 831 ><DIV
 832 CLASS="VARIABLELIST"
 833 ><DL
 834 ><DT
 835 ><TT
 836 CLASS="FILENAME"
 837 >/etc/nsswitch.conf(5)</TT
 838 ></DT
 839 ><DD
 840 ><P
 841 >Name service switch configuration file.</P
 842 ></DD
 843 ><DT
 844 >/tmp/.winbindd/pipe</DT
 845 ><DD
 846 ><P
 847 >The UNIX pipe over which clients communicate with
 848                 the <B
 849 CLASS="COMMAND"
 850 >winbindd</B
 851 > program.  For security reasons, the
 852                 winbind client will only attempt to connect to the winbindd daemon
 853                 if both the <TT
 854 CLASS="FILENAME"
 855 >/tmp/.winbindd</TT
 856 > directory
 857                 and <TT
 858 CLASS="FILENAME"
 859 >/tmp/.winbindd/pipe</TT
 860 > file are owned by
 861                 root. </P
 862 ></DD
 863 ><DT
 864 >/lib/libnss_winbind.so.X</DT
 865 ><DD
 866 ><P
 867 >Implementation of name service switch library.
 868                 </P
 869 ></DD
 870 ><DT
 871 >$LOCKDIR/winbindd_idmap.tdb</DT
 872 ><DD
 873 ><P
 874 >Storage for the Windows NT rid to UNIX user/group
 875                 id mapping.  The lock directory is specified when Samba is initially
 876                 compiled using the <TT
 877 CLASS="PARAMETER"
 878 ><I
 879 >--with-lockdir</I
 880 ></TT
 881 > option.
 882                 This directory is by default <TT
 883 CLASS="FILENAME"
 884 >/usr/local/samba/var/locks
 885                 </TT
 886 >. </P
 887 ></DD
 888 ><DT
 889 >$LOCKDIR/winbindd_cache.tdb</DT
 890 ><DD
 891 ><P
 892 >Storage for cached user and group information.
 893                 </P
 894 ></DD
 895 ></DL
 896 ></DIV
 897 ></DIV
 898 ><DIV
 899 CLASS="REFSECT1"
 900 ><A
 901 NAME="AEN259"
 902 ></A
 903 ><H2
 904 >VERSION</H2
 905 ><P
 906 >This man page is correct for version 2.2 of
 907         the Samba suite.</P
 908 ></DIV
 909 ><DIV
 910 CLASS="REFSECT1"
 911 ><A
 912 NAME="AEN262"
 913 ></A
 914 ><H2
 915 >SEE ALSO</H2
 916 ><P
 917 ><TT
 918 CLASS="FILENAME"
 919 >nsswitch.conf(5)</TT
 920 >,
 921         <A
 922 HREF="samba.7.html"
 923 TARGET="_top"
 924 >samba(7)</A
 925 >,
 926         <A
 927 HREF="wbinfo.1.html"
 928 TARGET="_top"
 929 >wbinfo(1)</A
 930 >,
 931         <A
 932 HREF="smb.conf.5.html"
 933 TARGET="_top"
 934 >smb.conf(5)</A
 935 ></P
 936 ></DIV
 937 ><DIV
 938 CLASS="REFSECT1"
 939 ><A
 940 NAME="AEN269"
 941 ></A
 942 ><H2
 943 >AUTHOR</H2
 944 ><P
 945 >The original Samba software and related utilities
 946         were created by Andrew Tridgell. Samba is now developed
 947         by the Samba Team as an Open Source project similar
 948         to the way the Linux kernel is developed.</P
 949 ><P
 950 ><B
 951 CLASS="COMMAND"
 952 >wbinfo</B
 953 > and <B
 954 CLASS="COMMAND"
 955 >winbindd</B
 956 >
 957         were written by Tim Potter.</P
 958 ><P
 959 >The conversion to DocBook for Samba 2.2 was done
 960         by Gerald Carter</P
 961 ></DIV
 962 ></BODY
 963 ></HTML
 964 >