docs/htmldocs/samba-pdc-howto.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >The Samba 2.2 PDC HowTo </TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="BOOK"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><DIV
  16 CLASS="BOOK"
  17 ><A
  18 NAME="SAMBA-PDC-HOWTO"
  19 ></A
  20 ><DIV
  21 CLASS="TITLEPAGE"
  22 ><H1
  23 CLASS="TITLE"
  24 ><A
  25 NAME="SAMBA-PDC-HOWTO"
  26 >The Samba 2.2 PDC HowTo</A
  27 ></H1
  28 ><H3
  29 CLASS="AUTHOR"
  30 ><A
  31 NAME="AEN4"
  32 >David Bannon</A
  33 ></H3
  34 ><DIV
  35 CLASS="AFFILIATION"
  36 ><SPAN
  37 CLASS="ORGNAME"
  38 >La Trobe University<BR></SPAN
  39 ></DIV
  40 ><HR></DIV
  41 ><HR><H1
  42 ><A
  43 NAME="AEN10"
  44 ></A
  45 ></H1
  46 ><P
  47 >Comments, corrections and additions to <TT
  48 CLASS="EMAIL"
  49 >&#60;<A
  50 HREF="mailto:dbannon@samba.org"
  51 >dbannon@samba.org</A
  52 >&#62;</TT
  53 ></P
  54 ><P
  55 >       This document explains how to setup Samba as a Primary Domain Controller and
  56         applies to version 2.2.0.
  57         Before
  58         using these functions make sure you understand what the controller can and cannot do.
  59         Please read the sections below in the Introduction.
  60         As 2.2.0 is incrementally updated
  61         this document will change or become out of date very quickly, make sure you are
  62         reading the most current version.
  63     </P
  64 ><P
  65 >Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1,
  66     Samba 2.0.7, TNG nor HEAD branch.</P
  67 ><P
  68 >It does apply to the current (post November 27th) cvs.</P
  69 ><P
  70 >       Also available is an updated version of Jerry Carter's NTDom <A
  71 HREF="samba-pdc-faq.html"
  72 TARGET="_top"
  73 >    FAQ</A
  74 > that will answer lots of
  75         the special 'tuning' questions that are not covered here. Over the next couple of weeks
  76         some of the items here will be moved to the FAQ.
  77     </P
  78 ><DIV
  79 CLASS="TOC"
  80 ><DL
  81 ><DT
  82 ><B
  83 >Table of Contents</B
  84 ></DT
  85 ><DT
  86 >1. <A
  87 HREF="#AEN20"
  88 >Introduction</A
  89 ></DT
  90 ><DD
  91 ><DL
  92 ><DT
  93 ><A
  94 HREF="#AEN28"
  95 >What can we do ?</A
  96 ></DT
  97 ><DT
  98 ><A
  99 HREF="#AEN44"
 100 >What can't we do ?</A
 101 ></DT
 102 ></DL
 103 ></DD
 104 ><DT
 105 >2. <A
 106 HREF="#AEN55"
 107 >Installing</A
 108 ></DT
 109 ><DD
 110 ><DL
 111 ><DT
 112 ><A
 113 HREF="#AEN59"
 114 >Start Up Script</A
 115 ></DT
 116 ><DT
 117 ><A
 118 HREF="#AEN66"
 119 >Config File</A
 120 ></DT
 121 ><DD
 122 ><DL
 123 ><DT
 124 ><A
 125 HREF="#AEN68"
 126 >A sample conf file</A
 127 ></DT
 128 ><DT
 129 ><A
 130 HREF="#AEN79"
 131 >PDC Config Parameters</A
 132 ></DT
 133 ></DL
 134 ></DD
 135 ><DT
 136 ><A
 137 HREF="#AEN115"
 138 >Special directories</A
 139 ></DT
 140 ></DL
 141 ></DD
 142 ><DT
 143 >3. <A
 144 HREF="#AEN126"
 145 >User and Machine Accounts</A
 146 ></DT
 147 ><DD
 148 ><DL
 149 ><DT
 150 ><A
 151 HREF="#AEN128"
 152 >Logon Accounts</A
 153 ></DT
 154 ><DT
 155 ><A
 156 HREF="#MACHINEACCOUNT"
 157 >Machine Accounts</A
 158 ></DT
 159 ><DT
 160 ><A
 161 HREF="#AEN163"
 162 >Joining the Domain</A
 163 ></DT
 164 ><DT
 165 ><A
 166 HREF="#AEN211"
 167 >User Accounts</A
 168 ></DT
 169 ><DT
 170 ><A
 171 HREF="#AEN223"
 172 >Domain Admin Accounts</A
 173 ></DT
 174 ></DL
 175 ></DD
 176 ><DT
 177 >4. <A
 178 HREF="#AEN231"
 179 >Profiles, Policies and Logon Scripts</A
 180 ></DT
 181 ><DD
 182 ><DL
 183 ><DT
 184 ><A
 185 HREF="#AEN233"
 186 >Profiles</A
 187 ></DT
 188 ><DT
 189 ><A
 190 HREF="#AEN240"
 191 >Policies</A
 192 ></DT
 193 ><DT
 194 ><A
 195 HREF="#AEN251"
 196 >Logon Scripts</A
 197 ></DT
 198 ></DL
 199 ></DD
 200 ><DT
 201 >5. <A
 202 HREF="#AEN272"
 203 >Passwords and Authentication</A
 204 ></DT
 205 ><DD
 206 ><DL
 207 ><DT
 208 ><A
 209 HREF="#AEN278"
 210 ></A
 211 ></DT
 212 ><DD
 213 ><DL
 214 ><DT
 215 ><A
 216 HREF="#AEN280"
 217 >Syncing Passwords</A
 218 ></DT
 219 ><DT
 220 ><A
 221 HREF="#AEN286"
 222 >Using PAM</A
 223 ></DT
 224 ><DT
 225 ><A
 226 HREF="#AEN292"
 227 >Authenticating other Samba Servers</A
 228 ></DT
 229 ></DL
 230 ></DD
 231 ></DL
 232 ></DD
 233 ><DT
 234 >6. <A
 235 HREF="#AEN298"
 236 >Background</A
 237 ></DT
 238 ><DD
 239 ><DL
 240 ><DT
 241 ><A
 242 HREF="#AEN300"
 243 ></A
 244 ></DT
 245 ><DD
 246 ><DL
 247 ><DT
 248 ><A
 249 HREF="#AEN302"
 250 >History</A
 251 ></DT
 252 ><DT
 253 ><A
 254 HREF="#AEN310"
 255 >The Future</A
 256 ></DT
 257 ><DT
 258 ><A
 259 HREF="#AEN322"
 260 >Getting further help</A
 261 ></DT
 262 ></DL
 263 ></DD
 264 ></DL
 265 ></DD
 266 ></DL
 267 ></DIV
 268 ><DIV
 269 CLASS="CHAPTER"
 270 ><HR><H1
 271 ><A
 272 NAME="AEN20"
 273 >Chapter 1. Introduction</A
 274 ></H1
 275 ><P
 276 >This document will show you one way of making Version 2.2.0
 277 of Samba perform some of the tasks of a
 278 NT Primary Domain Controller. The facilities described are built into Samba as a result of
 279 development work done over a number of years by a large number of people. These facilities
 280 are only just beginning to be officially supported and although they do appear to work reliably,
 281 if you use them then you take the risks upon your self.  This document does not cover the
 282 developmental versions of Samba, particularly
 283 <A
 284 HREF="http://www.samba-tng.org/"
 285 TARGET="_top"
 286 ><I
 287 CLASS="CITETITLE"
 288 >Samba-TNG</I
 289 ></A
 290 >
 291 &#13;</P
 292 ><P
 293 >Note that <A
 294 HREF="http://bioserve.latrobe.edu.au/samba"
 295 TARGET="_top"
 296 >Samba 2.0.7</A
 297 >
 298     supports significently less of the NT Domain facilities compared with 2.2.0
 299     </P
 300 ><P
 301 >       This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by
 302         John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide
 303         more detail and an insight to the development
 304         cycle and should be considered 'further reading'.&#13;</P
 305 ><DIV
 306 CLASS="SECT1"
 307 ><HR><H1
 308 CLASS="SECT1"
 309 ><A
 310 NAME="AEN28"
 311 >What can we do ?</A
 312 ></H1
 313 ><P
 314 ></P
 315 ><UL
 316 ><LI
 317 ><P
 318 >Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central
 319         password database. WRT W2K, please see the section about adding machine
 320         accounts and the Intro in the <A
 321 HREF="samba-pdc-faq.html"
 322 TARGET="_top"
 323 >FAQ</A
 324 >.</P
 325 ></LI
 326 ><LI
 327 ><P
 328 >Grant Administrator privileges to particular domain users on an
 329         NT or W2K workstation.</P
 330 ></LI
 331 ><LI
 332 ><P
 333 >Apply policies from a domain policy file to NT and W2K (?)
 334         workstation.</P
 335 ></LI
 336 ><LI
 337 ><P
 338 >Run the appropriate logon script when a user logs on to the domain
 339         .</P
 340 ></LI
 341 ><LI
 342 ><P
 343 >Maintain a user's local profile on the server.</P
 344 ></LI
 345 ><LI
 346 ><P
 347 >Validate a user using another system via smb (such as smb_pam) and
 348         soon winbind (?).</P
 349 ></LI
 350 ></UL
 351 ></DIV
 352 ><DIV
 353 CLASS="SECT1"
 354 ><HR><H1
 355 CLASS="SECT1"
 356 ><A
 357 NAME="AEN44"
 358 >What can't we do ?</A
 359 ></H1
 360 ><P
 361 ></P
 362 ><UL
 363 ><LI
 364 ><P
 365 > Become or work with a Backup Domain Controller (a BDC).</P
 366 ></LI
 367 ><LI
 368 ><P
 369 > Participate in any sort of trust relationship (with either Samba or NT
 370         Servers).</P
 371 ></LI
 372 ><LI
 373 ><P
 374 > Offer a list of domain users to User Manager for Domains
 375         on the Security Tab etc).</P
 376 ></LI
 377 ><LI
 378 ><P
 379 >Be a W2K type of Domain Controller. Samba PDC will behave like
 380         an NT PDC, W2K workstations connect in legacy mode.</P
 381 ></LI
 382 ></UL
 383 ></DIV
 384 ></DIV
 385 ><DIV
 386 CLASS="CHAPTER"
 387 ><HR><H1
 388 ><A
 389 NAME="AEN55"
 390 >Chapter 2. Installing</A
 391 ></H1
 392 ><P
 393 >Installing consists of the usual download, configure, make and make
 394         install process. These steps are well documented elsewhere.
 395         The <A
 396 HREF="samba-pdc-faq.html"
 397 TARGET="_top"
 398 >FAQ</A
 399 > discusses getting pre-release versions via CVS.
 400         Then you need to configure the server.</P
 401 ><DIV
 402 CLASS="SECT1"
 403 ><HR><H1
 404 CLASS="SECT1"
 405 ><A
 406 NAME="AEN59"
 407 >Start Up Script</A
 408 ></H1
 409 ><P
 410 >Skip this section if you have a working Samba already.
 411         Everyone has their own favourite startup script. Here is mine, offered with no warrantee
 412         at all !</P
 413 ><PRE
 414 CLASS="PROGRAMLISTING"
 415 >
 416
 417         #!/bin/sh
 418         # Script to control Samba server, David Bannon, 14-6-96
 419         #
 420         #
 421         PATH=/bin:/usr/sbin:/usr/bin
 422         export PATH
 423         case "$1" in
 424         'start')
 425                 if [ -f /usr/local/samba/bin/smbd ]
 426                 then
 427                         /usr/local/samba/bin/smbd -D
 428                         /usr/local/samba/bin/nmbd -D
 429                         echo "Starting Samba Server"
 430                 fi
 431                 ;;
 432         'conf')
 433                 if [ -f /usr/local/samba/lib/smb.conf ]
 434                 then
 435                         vi /usr/local/samba/lib/smb.conf
 436                 fi
 437                 ;;
 438         'pw')
 439                 if [ -f /usr/local/samba/private/smbpasswd ]
 440                 then
 441                         vi /usr/local/samba/private/smbpasswd
 442                 fi
 443                 ;;
 444         'who')
 445                 /usr/local/samba/bin/smbstatus -b
 446                 ;;
 447         'restart')
 448                 psline=`/bin/ps  x | grep smbd | grep -v grep`
 449
 450                 if [ "$psline" != "" ]
 451                 then
 452                         while [ "$psline" != "" ]
 453                         do
 454                                 psline=`/bin/ps x | fgrep smbd | grep -v grep`
 455                                 if [ "$psline" ]
 456                                 then
 457                                         set -- $psline
 458                                         pid=$1
 459                                         /bin/kill -HUP $pid
 460                                         echo "Stopped $pid line = $psline"
 461                                         sleep 2
 462                                 fi
 463                         done
 464                 fi
 465                 echo "Stopped Samba servers"
 466                 ;;
 467         'stop')
 468                 psline=`/bin/ps  x | grep smbd | grep -v grep`
 469
 470                 if [ "$psline" != "" ]
 471                 then
 472                         while [ "$psline" != "" ]
 473                         do
 474                                 psline=`/bin/ps x | fgrep smbd | grep -v grep`
 475                                 if [ "$psline" ]
 476                                 then
 477                                         set -- $psline
 478                                         pid=$1
 479                                         /bin/kill -9 $pid
 480                                         echo "Stopped $pid line = $psline"
 481                                         sleep 2
 482                                 fi
 483                         done
 484                 fi
 485                 echo "Stopped Samba servers"
 486                 psline=`/bin/ps x | grep nmbd | grep -v grep`
 487                 if [ "$psline" ]
 488                 then
 489                         set -- $psline
 490                         pid=$1
 491                         /bin/kill -9 $pid
 492                         echo "Stopped Name Server "
 493                 fi
 494                 echo "Stopped Name Servers"
 495                 ;;
 496         *)
 497                 echo "usage: samba {start | restart |stop | conf | pw | who}"
 498                 ;;
 499         esac
 500     </PRE
 501 ><P
 502 >       Use this script, or some other one, you will need to ensure its used while the machine
 503         is booting. (This typically involves <TT
 504 CLASS="FILENAME"
 505 >/etc/rc.d</TT
 506 >, we'll be
 507         assuming that there is a script called
 508         samba in <TT
 509 CLASS="FILENAME"
 510 >/etc/rc.d/init.d</TT
 511 > further down in this document.)</P
 512 ></DIV
 513 ><DIV
 514 CLASS="SECT1"
 515 ><HR><H1
 516 CLASS="SECT1"
 517 ><A
 518 NAME="AEN66"
 519 >Config File</A
 520 ></H1
 521 ><DIV
 522 CLASS="SECT2"
 523 ><H2
 524 CLASS="SECT2"
 525 ><A
 526 NAME="AEN68"
 527 >A sample conf file</A
 528 ></H2
 529 ><P
 530 >Here is a fairly minimal config file to do PDC. It will also make the server
 531         become the browse master for the
 532         specified domain (not necessary but usually desirable). You will need to change only
 533         two parameters to make this
 534         file work, <TT
 535 CLASS="FILENAME"
 536 >wins server</TT
 537 > and <TT
 538 CLASS="FILENAME"
 539 >workgroup</TT
 540 >, plus
 541     you will need to put your own name (not mine!) in the <TT
 542 CLASS="FILENAME"
 543 >domain admin users</TT
 544 > fields.
 545         Some of the parameters are discussed further down this document.</P
 546 ><P
 547 >Assuming you have used the default install directories, this file should appear as
 548         <TT
 549 CLASS="FILENAME"
 550 >/usr/local/samba/lib/smb.conf</TT
 551 >. It should not be
 552         writable by anyone except root.</P
 553 ><DIV
 554 CLASS="NOTE"
 555 ><BLOCKQUOTE
 556 CLASS="NOTE"
 557 ><P
 558 ><B
 559 >Note: </B
 560 >The 'add user script' parameter is a work-around, watch for changes !</P
 561 ></BLOCKQUOTE
 562 ></DIV
 563 ><PRE
 564 CLASS="PROGRAMLISTING"
 565 >
 566
 567         [global]
 568         security = user
 569         status = yes
 570         workgroup = { Your domain name here }
 571         wins server = { ip of a wins server if you have one }
 572         encrypt passwords = yes
 573         domain logons =yes
 574         logon script = scripts\%U.bat
 575         domain admin group = @adm
 576         add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$
 577         guest account = ftp
 578         share modes=no
 579         os level=65
 580         [homes]
 581         guest ok = no
 582         read only = no
 583         create mask = 0700
 584         directory mask = 0700
 585         oplocks = false
 586         locking = no
 587         [netlogon]
 588         path = /usr/local/samba/netlogon
 589         writeable = no
 590         guest ok = no
 591    </PRE
 592 ></DIV
 593 ><DIV
 594 CLASS="SECT2"
 595 ><HR><H2
 596 CLASS="SECT2"
 597 ><A
 598 NAME="AEN79"
 599 >PDC Config Parameters</A
 600 ></H2
 601 ><P
 602 ></P
 603 ><DIV
 604 CLASS="VARIABLELIST"
 605 ><P
 606 ><B
 607 >There are a huge range of parameters that may appear in a smb.conf file. Some
 608         that may be of interest to a PDC are :</B
 609 ></P
 610 ><DL
 611 ><DT
 612 >add user script</DT
 613 ><DD
 614 ><P
 615 >This parameter specifies a script (or program) that will be run
 616         to add a user to the system. Here it is being used to add a machine, not a user.
 617         This is probably not very nice and may change. But it does work !</P
 618 ><P
 619 >For this example, I have a group called 'machines', entries can be added to
 620     <TT
 621 CLASS="FILENAME"
 622 >/etc/passwd</TT
 623 > using a programme called <TT
 624 CLASS="FILENAME"
 625 >/usr/adduser</TT
 626 > and
 627     the other parameters are chosen as suitable for a machine account. Works for
 628     RH Linux, your system may require changes.</P
 629 ></DD
 630 ><DT
 631 >domain admin group = @adm</DT
 632 ><DD
 633 ><P
 634 >This parameter specifies a unix group whose members will be granted
 635     admin privileges on a NT workstation when
 636         logged onto that workstation. See the section called <A
 637 HREF="#AEN223"
 638 >    Domain Admin</A
 639 > Accounts.</P
 640 ></DD
 641 ><DT
 642 >domain admin users = user1 users2</DT
 643 ><DD
 644 ><P
 645 >It appears that this parameter does not funtion correctly at present.
 646     Use the 'domain admin group' instread. This parameter specifies a unix user who will
 647     be granted admin privileges
 648         on a NT workstation when
 649         logged onto that workstation. See the section called <A
 650 HREF="#AEN223"
 651 >    Domain Admin</A
 652 > Accounts.</P
 653 ></DD
 654 ><DT
 655 >encrypt passwords = yes</DT
 656 ><DD
 657 ><P
 658 >This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that
 659         turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you
 660         should) you must use encrypted passwords.</P
 661 ></DD
 662 ><DT
 663 >logon script = scripts\%U.bat</DT
 664 ><DD
 665 ><P
 666 >This will make samba look for a logon script named after the user
 667         (eg joeblow.bat).
 668          See the section further on called <A
 669 HREF="#AEN251"
 670 >Logon Scripts</A
 671 ></P
 672 ><DIV
 673 CLASS="NOTE"
 674 ><BLOCKQUOTE
 675 CLASS="NOTE"
 676 ><P
 677 ><B
 678 >Note: </B
 679 >Note that the slash is like this '\', not like this '/'.
 680         NT is happy with both, win95 is not !</P
 681 ></BLOCKQUOTE
 682 ></DIV
 683 ></DD
 684 ><DT
 685 >logon path</DT
 686 ><DD
 687 ><P
 688 >Lets you specify where you would like users profiles kept. The default, that is in the users
 689         home directory, does encourage a bit of fiddling.</P
 690 ></DD
 691 ></DL
 692 ></DIV
 693 ></DIV
 694 ></DIV
 695 ><DIV
 696 CLASS="SECT1"
 697 ><HR><H1
 698 CLASS="SECT1"
 699 ><A
 700 NAME="AEN115"
 701 >Special directories</A
 702 ></H1
 703 ><P
 704 >You need to create a couple of special files and directories. Its nice
 705         to have some of the binaries handy too, so I create links to them. Assuming
 706         you have used the default samba location and have not
 707         changed the locations mentioned in the sample config file, do the following :</P
 708 ><PRE
 709 CLASS="PROGRAMLISTING"
 710 >
 711
 712         mkdir /usr/local/samba/netlogon
 713         mkdir /usr/local/samba/netlogon/scripts
 714         mkdir /usr/local/samba/private
 715         touch /usr/local/samba/private/smbpasswd
 716         chmod go-rwx /usr/local/samba/private/smbpasswd
 717         cd /usr/local/sbin
 718         ln -s /usr/local/samba/bin/smbpasswd
 719         ln -s /usr/local/samba/bin/smbclient
 720         ln -s /etc/rc.d/init.d/samba</PRE
 721 ><P
 722 >Make sure permissions are appropriate !</P
 723 ><P
 724 >OK, if you have used the scripts above and have a path to where the links are do this to start up
 725         the Samba Server :</P
 726 ><P
 727 ><B
 728 CLASS="COMMAND"
 729 >samba start</B
 730 ></P
 731 ><P
 732 >Instead, you might like to reboot the machine to make sure that you
 733         got the init stuff right. Any way, a quick look in the logs
 734         <TT
 735 CLASS="FILENAME"
 736 >/usr/local/samba/var/log.smbd</TT
 737 > and <TT
 738 CLASS="FILENAME"
 739 >       /usr/local/samba/var/log/nmbd</TT
 740 >
 741         will give you an idea of what's happening. Assuming all is well, lets create
 742         some accounts...</P
 743 ></DIV
 744 ></DIV
 745 ><DIV
 746 CLASS="CHAPTER"
 747 ><HR><H1
 748 ><A
 749 NAME="AEN126"
 750 >Chapter 3. User and Machine Accounts</A
 751 ></H1
 752 ><DIV
 753 CLASS="SECT1"
 754 ><H1
 755 CLASS="SECT1"
 756 ><A
 757 NAME="AEN128"
 758 >Logon Accounts</A
 759 ></H1
 760 ><P
 761 ><I
 762 CLASS="EMPHASIS"
 763 >This section is very nearly out of date already !</I
 764 >  It
 765         appears that while you are reading it, Jean Francois Micou is making it
 766         redundant ! Jean Francois is adding facilities to add users
 767         (via User Manager) and machines (when joining the domain) and it looks like these facilities will
 768         make it into the official release of 2.2.</P
 769 ><P
 770 >Every user and NTws (and other samba servers) that will be on the domain
 771         must have its own passwd entry in both <TT
 772 CLASS="FILENAME"
 773 >/etc/passwd</TT
 774 > and
 775         <TT
 776 CLASS="FILENAME"
 777 >/usr/local/samba/private/smbpasswd</TT
 778 > .
 779         The <TT
 780 CLASS="FILENAME"
 781 >/etc/passwd</TT
 782 > entry is really
 783         only to reserve a user ID. The NT encrypted password is stored in
 784         <TT
 785 CLASS="FILENAME"
 786 >/usr/local/samba/private/smbpasswd</TT
 787 >.
 788         (Note that win95/98 machines don't need an account as they don't do
 789         any security aware things.)</P
 790 ><P
 791 >Samba 2.2 will now create these entries for us. Carefull set up is required
 792         and there may well be some changes to this system before its released.
 793         </P
 794 ></DIV
 795 ><DIV
 796 CLASS="SECT1"
 797 ><HR><H1
 798 CLASS="SECT1"
 799 ><A
 800 NAME="MACHINEACCOUNT"
 801 >Machine Accounts</A
 802 ></H1
 803 ><DIV
 804 CLASS="NOTE"
 805 ><BLOCKQUOTE
 806 CLASS="NOTE"
 807 ><P
 808 ><B
 809 >Note: </B
 810 >There is an entry in the ntdom <A
 811 HREF="samba-pdc-faq.html"
 812 TARGET="_top"
 813 >FAQ</A
 814 > explaining how to create
 815         machine entries manually.</P
 816 ></BLOCKQUOTE
 817 ></DIV
 818 ><P
 819 ></P
 820 ><DIV
 821 CLASS="VARIABLELIST"
 822 ><P
 823 ><B
 824 ><I
 825 CLASS="EMPHASIS"
 826 >At present</I
 827 > to have the machine accounts created when a machine joins
 828         the domain a number of conditions must be met :</B
 829 ></P
 830 ><DL
 831 ><DT
 832 >Only root can do it !</DT
 833 ><DD
 834 ><P
 835 >There must be an entry in <TT
 836 CLASS="FILENAME"
 837 >/usr/local/samba/private/smbpasswd</TT
 838 >
 839         for root and root must be mentioned in <TT
 840 CLASS="FILENAME"
 841 >domain admins</TT
 842 >. This may
 843         be fixed some time in the future so any 'domain admin' can do it. If you don't
 844         like having root as a windows logon account, make the machine
 845         entries manually (both of them).</P
 846 ></DD
 847 ><DT
 848 >Use the <TT
 849 CLASS="FILENAME"
 850 >add user script</TT
 851 ></DT
 852 ><DD
 853 ><P
 854 >Again, this looks a bit like a 'work around'. Use a suitable
 855         command line to add a machine account <A
 856 HREF="#AEN68"
 857 >see above</A
 858 >,
 859         and pass it %m$, that is %m to get machine name plus the '$'. Now, this
 860         means you cannot use the <TT
 861 CLASS="FILENAME"
 862 >add user script</TT
 863 > to really add users .... </P
 864 ></DD
 865 ><DT
 866 >Only for W2K</DT
 867 ><DD
 868 ><P
 869 >This automatic creation of machine accounts does not work for
 870     NT4ws at present. Watch this space.</P
 871 ></DD
 872 ></DL
 873 ></DIV
 874 ></DIV
 875 ><DIV
 876 CLASS="SECT1"
 877 ><HR><H1
 878 CLASS="SECT1"
 879 ><A
 880 NAME="AEN163"
 881 >Joining the Domain</A
 882 ></H1
 883 ><P
 884 >You must have either added the machine account entries manually (NT4 ws)
 885         or set up the automatic system (W2K), <A
 886 HREF="#MACHINEACCOUNT"
 887 >see Machine Accounts</A
 888 >
 889         before proceeding.</P
 890 ><P
 891 ></P
 892 ><DIV
 893 CLASS="VARIABLELIST"
 894 ><DL
 895 ><DT
 896 ><B
 897 CLASS="COMMAND"
 898 >Windows NT</B
 899 ></DT
 900 ><DD
 901 ><P
 902 ></P
 903 ><UL
 904 ><LI
 905 ><P
 906 > (<I
 907 CLASS="EMPHASIS"
 908 >this step may not be necessary some time in the near future</I
 909 >).
 910         On the samba server that is the PDC, add a machine account manually
 911         as per the instructions in the <A
 912 HREF="samba-pdc-faq.html"
 913 TARGET="_top"
 914 >FAQ</A
 915 >
 916         Then give the command <B
 917 CLASS="COMMAND"
 918 >smbpasswd -a -m {machine}</B
 919 > substituting in the
 920         client machine name.</P
 921 ></LI
 922 ><LI
 923 ><P
 924 > Logon to the NTws in question as a local admin, go to the
 925         <B
 926 CLASS="COMMAND"
 927 >Control Panel, Network IdentificationTag</B
 928 >.</P
 929 ></LI
 930 ><LI
 931 ><P
 932 > Press the <B
 933 CLASS="COMMAND"
 934 >Change</B
 935 > button.</P
 936 ></LI
 937 ><LI
 938 ><P
 939 > Enter the Domain name (from the 'Workgroup' parameter, smb.conf)
 940         in the Domain Field.</P
 941 ></LI
 942 ><LI
 943 ><P
 944 > Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'.
 945         Allow to reboot.</P
 946 ></LI
 947 ></UL
 948 ></DD
 949 ><DT
 950 ><B
 951 CLASS="COMMAND"
 952 >Windows 2000</B
 953 ></DT
 954 ><DD
 955 ><P
 956 ></P
 957 ><UL
 958 ><LI
 959 ><P
 960 >Logon to the W2k machine as Administrator, go to the Control
 961         Panel and double click on <B
 962 CLASS="COMMAND"
 963 >Network and Dialup Connections</B
 964 >.
 965         </P
 966 ></LI
 967 ><LI
 968 ><P
 969 >Pull down the <B
 970 CLASS="COMMAND"
 971 >Advanced</B
 972 > menu and choose
 973         <B
 974 CLASS="COMMAND"
 975 >Network Identification</B
 976 >. Press <B
 977 CLASS="COMMAND"
 978 >Properties
 979         </B
 980 >. </P
 981 ></LI
 982 ><LI
 983 ><P
 984 >Choose <B
 985 CLASS="COMMAND"
 986 >Domain</B
 987 > and enter the domain name. Press 'OK'.</P
 988 ></LI
 989 ><LI
 990 ><P
 991 >Now enter a user name and password for a Domain Admin
 992         <I
 993 CLASS="EMPHASIS"
 994 >(Who must be root until a pre-release bug is fixed)</I
 995 > and press
 996         'OK'.</P
 997 ></LI
 998 ><LI
 999 ><P
1000 >Wait for the confirmation, reboot when prompted.</P
1001 ></LI
1002 ></UL
1003 ><P
1004 >To remove a W2K machine from the domain, follow the first two steps then
1005     choose <B
1006 CLASS="COMMAND"
1007 >Workgroup</B
1008 >, enter a work group name (or just WORKGROUP) and follow
1009     the prompts.</P
1010 ></DD
1011 ></DL
1012 ></DIV
1013 ></DIV
1014 ><DIV
1015 CLASS="SECT1"
1016 ><HR><H1
1017 CLASS="SECT1"
1018 ><A
1019 NAME="AEN211"
1020 >User Accounts</A
1021 ></H1
1022 ><P
1023 ><I
1024 CLASS="EMPHASIS"
1025 >Again, doing it manually (cos' the auto way is not working pre-release).
1026         </I
1027 >
1028         In our simple case every domain user should have an account on the PDC. The
1029         account may have a null shell if they are not allowed to log on to the unix
1030         prompt. Again they need an entry in both the <TT
1031 CLASS="FILENAME"
1032 >/etc/passwd</TT
1033 > and
1034         <TT
1035 CLASS="FILENAME"
1036 >/usr/local/samba/private/smbpasswd</TT
1037 >. Again a password is
1038         not necessary in <TT
1039 CLASS="FILENAME"
1040 >/etc/passwd</TT
1041 > but the location
1042         of the home directory is honoured.
1043         To make an entry for a user called Joe Blow you would typically do the following :</P
1044 ><P
1045 ><B
1046 CLASS="COMMAND"
1047 >adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow</B
1048 ></P
1049 ><P
1050 ><B
1051 CLASS="COMMAND"
1052 >smbpasswd -a joeblow</B
1053 ></P
1054 ><P
1055 >And you will prompted to enter a password for Joe. Ideally he will be
1056         hovering over your shoulder and will, when asked, type in a password of
1057         his choice. There are a number of scripts and systems to ease the migration of users
1058         from somewhere to samba. Better start looking !</P
1059 ></DIV
1060 ><DIV
1061 CLASS="SECT1"
1062 ><HR><H1
1063 CLASS="SECT1"
1064 ><A
1065 NAME="AEN223"
1066 >Domain Admin Accounts</A
1067 ></H1
1068 ><P
1069 >Certain operations demand that the logged on user has Administrator
1070         privileges, typically installing software and
1071         doing maintenance tasks. It is very simple to appoint some users as Domain Admins,
1072         most likely yourself. Make
1073         sure you trust the appointee !</P
1074 ><P
1075 >Samba 2.2 recognizes particular users as being
1076         domain admins and tells the NTws when it thinks that it has got one logged on.
1077         In the smb.conf file we declare
1078         that the <TT
1079 CLASS="FILENAME"
1080 >Domain Admin group = @adm</TT
1081 >.
1082         Any user who is a menber of the unix group 'adm' is treated as a Domain Admin by a NTws when
1083         logged onto the Domain. They will have full Administrator rights
1084         including the rights to change permissions on files and run the system
1085         utilities such as Disk Administrator. Add users to the group by editing <TT
1086 CLASS="FILENAME"
1087 >    /etc/group/</TT
1088 >. You do not need to use the 'adm' group, choose any one you like.</P
1089 ><P
1090 >Further, and this is very new, they will be allowed to create a
1091         new machine account when first connecting a new NT or W2K machine to
1092         the domain. <I
1093 CLASS="EMPHASIS"
1094 >However, at present, ie pre-release, only a Domain Admin who
1095         also happens to be root can do so. </I
1096 ></P
1097 ></DIV
1098 ></DIV
1099 ><DIV
1100 CLASS="CHAPTER"
1101 ><HR><H1
1102 ><A
1103 NAME="AEN231"
1104 >Chapter 4. Profiles, Policies and Logon Scripts</A
1105 ></H1
1106 ><DIV
1107 CLASS="SECT1"
1108 ><H1
1109 CLASS="SECT1"
1110 ><A
1111 NAME="AEN233"
1112 >Profiles</A
1113 ></H1
1114 ><P
1115 >NT Profiles should work if you have followed the setup so far.
1116         A user's profile contains a whole lot of their personal settings,
1117         the contents of their desktop, personal 'My Documents' and so on.
1118         When they log off, all of the profile is copied to their directory
1119         on the server and is downloaded again when they logon on again, possibly
1120         on another client machine.</P
1121 ><P
1122 >Sounds great but can be a bit of a bug bear sometimes. Users let
1123         their profiles get too big and then complain about how long it takes
1124         to log on each time. This sample setup only supports NT profiles,
1125         rumor has it that it is also possible to do the same on Win95, my
1126         users don't know and I'm not telling them.</P
1127 ><DIV
1128 CLASS="NOTE"
1129 ><BLOCKQUOTE
1130 CLASS="NOTE"
1131 ><P
1132 ><B
1133 >Note: </B
1134 >There is more info about Profiles (including for W95/98)
1135         in the <A
1136 HREF="samba-pdc-faq.html"
1137 TARGET="_top"
1138 >FAQ</A
1139 >.</P
1140 ></BLOCKQUOTE
1141 ></DIV
1142 ></DIV
1143 ><DIV
1144 CLASS="SECT1"
1145 ><HR><H1
1146 CLASS="SECT1"
1147 ><A
1148 NAME="AEN240"
1149 >Policies</A
1150 ></H1
1151 ><P
1152 >Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol
1153         file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws.
1154         Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or
1155         maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles
1156         on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor
1157         that comes with NTws.</P
1158 ><DIV
1159 CLASS="NOTE"
1160 ><BLOCKQUOTE
1161 CLASS="NOTE"
1162 ><P
1163 ><B
1164 >Note: </B
1165 >See the <A
1166 HREF="samba-pdc-faq.html"
1167 TARGET="_top"
1168 >FAQ</A
1169 > for pointers on how to get a suitable Policy Editor.</P
1170 ></BLOCKQUOTE
1171 ></DIV
1172 ><P
1173 >The Policy Editor (and associated files) will create a
1174         <TT
1175 CLASS="FILENAME"
1176 >ntconfig.pol</TT
1177 > file using the
1178         parameters Microsoft thought of and parameters you specify by making your own
1179         template file.</P
1180 ><P
1181 >In our example configuration here, Samba will expect to find
1182         the <TT
1183 CLASS="FILENAME"
1184 >ntconfig.pol</TT
1185 > file in
1186         <TT
1187 CLASS="FILENAME"
1188 >/usr/local/samba/netlogon</TT
1189 >. Needless to say (I hope !),
1190         it is vitally important that ordinary users don't have
1191         write permission to the Policy files.</P
1192 ></DIV
1193 ><DIV
1194 CLASS="SECT1"
1195 ><HR><H1
1196 CLASS="SECT1"
1197 ><A
1198 NAME="AEN251"
1199 >Logon Scripts</A
1200 ></H1
1201 ><P
1202 >In the sample config file above there is a line
1203         <TT
1204 CLASS="FILENAME"
1205 >logon script = scripts\%U.bat</TT
1206 ></P
1207 ><DIV
1208 CLASS="NOTE"
1209 ><BLOCKQUOTE
1210 CLASS="NOTE"
1211 ><P
1212 ><B
1213 >Note: </B
1214 >Note that the slash is like this '\' not like this '/'.
1215         NT is happy with both, win95 is not !</P
1216 ></BLOCKQUOTE
1217 ></DIV
1218 ><P
1219 >This allows you to run a dos batch file every time someone logs on. The batch
1220         file is located on the server, in the sample install mentioned here,
1221         its in <TT
1222 CLASS="FILENAME"
1223 >/usr/local/samba/netlogon/scripts</TT
1224 > and
1225         is named after the user with <TT
1226 CLASS="FILENAME"
1227 >.bat</TT
1228 > appended, eg Joe
1229         Blow's script is called <TT
1230 CLASS="FILENAME"
1231 >/usr/local/samba/netlogon/scripts/joeblow.bat</TT
1232 >.</P
1233 ><DIV
1234 CLASS="NOTE"
1235 ><BLOCKQUOTE
1236 CLASS="NOTE"
1237 ><P
1238 ><B
1239 >Note: </B
1240 >There is a suggestion that user names longer than 8 characters may cause
1241         problems with some systems being unable to run logon scripts. This is confirmed in earlier
1242     versions when connecting using W95, comments about other combinations ??</P
1243 ></BLOCKQUOTE
1244 ></DIV
1245 ><P
1246 >You could use a line like this <TT
1247 CLASS="FILENAME"
1248 >logon script = default.bat</TT
1249 > and samba
1250     will supply <TT
1251 CLASS="FILENAME"
1252 >/usr/local/samba/netlogon/default.bat</TT
1253 > for any client and every
1254     user. Maybe you could use %m and get a client machine dependant logon script.
1255     You get the idea...</P
1256 ><P
1257 >Note that the file is a dos batch file not a Unix script. It runs dos commands on the client
1258         computer with the logon user's permissions. It must be a dos file with each line ending with
1259         the dos cr/lf not a nice clean newline. Generally,
1260         its best to create the initial file on a DOS system and copy it across.</P
1261 ><P
1262 >There is lots of very clever uses of the Samba replaceable variables such
1263         ( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to
1264         give you control over which script runs when a particular person logs
1265         on. (Gee, it would be nice to have a default.bat run when nothing else is available.)</P
1266 ><P
1267 >Again, it is vitally important that ordinary users don't have write
1268         permission to other peoples, or even probably their own, logon script files.</P
1269 ><P
1270 >A typical logon script is reproduced below. Note that it runs separate
1271         commands for win95 and NT, that's because NT has slightly different behaviour
1272         when using the <TT
1273 CLASS="FILENAME"
1274 >net use ..</TT
1275 > command. Its useful for lots of
1276         other situations too. I don't know what syntax to use for win98, I don't use it
1277         here.</P
1278 ><PRE
1279 CLASS="PROGRAMLISTING"
1280 >
1281
1282                 rem Default logon script, create links to this file.
1283
1284                 net time \\bioserve /set /yes
1285                 @echo off
1286                 if %OS%.==Windows_NT. goto WinNT
1287
1288                 :Win95
1289                 net use k: \\trillion\bio_prog
1290                 net use p: \\bcfile\homes
1291                 goto end
1292                 :WinNT
1293                 net use k: \\trillion\bio_prog /persistent:no
1294                 net use p: \\bcfile\homes /persistent:no
1295
1296                 :end
1297         </PRE
1298 ></DIV
1299 ></DIV
1300 ><DIV
1301 CLASS="CHAPTER"
1302 ><HR><H1
1303 ><A
1304 NAME="AEN272"
1305 >Chapter 5. Passwords and Authentication</A
1306 ></H1
1307 ><P
1308 >So far our configuration assumes that ordinary users don't have unix logon access. A change
1309         to the <A
1310 HREF="#AEN211"
1311 ><TT
1312 CLASS="FILENAME"
1313 >adduser</TT
1314 ></A
1315 > line above would allow unix logon
1316         but it would be with passwords that may
1317         be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users
1318         that they need to change their passwords in two seperate places is not fun.
1319         Further, even if they cannot do a unix logon there are other processes that
1320         might require authentication. We have a nice securely encrypted password in
1321         <TT
1322 CLASS="FILENAME"
1323 >/usr/local/samba/private/smbpasswd</TT
1324 >, why not use it ?</P
1325 ><DIV
1326 CLASS="SECT1"
1327 ><HR><H1
1328 CLASS="SECT1"
1329 ><A
1330 NAME="AEN278"
1331 ></A
1332 ></H1
1333 ><DIV
1334 CLASS="SECT2"
1335 ><H2
1336 CLASS="SECT2"
1337 ><A
1338 NAME="AEN280"
1339 >Syncing Passwords</A
1340 ></H2
1341 ><P
1342 >Yes, its possible and seems the easiest  way (initially anyway).
1343     The <A
1344 HREF="samba-pdc-faq.html"
1345 TARGET="_top"
1346 >FAQ</A
1347 > details how to
1348     do so in the sections <I
1349 CLASS="EMPHASIS"
1350 >What is password sync and should I use it ?</I
1351 > and <I
1352 CLASS="EMPHASIS"
1353 >    How do I get remote password (unix and SMB) changing working ?</I
1354 ></P
1355 ></DIV
1356 ><DIV
1357 CLASS="SECT2"
1358 ><HR><H2
1359 CLASS="SECT2"
1360 ><A
1361 NAME="AEN286"
1362 >Using PAM</A
1363 ></H2
1364 ><P
1365 >Pam enabled systems have a much better solution available. The Samba
1366         PDC server will offer to authenticate domain users to other processes
1367         (either on this server or on the domain). With a suitable pam stack
1368         such as <A
1369 HREF="http://www.csn.ul.ie/~airlied/pam_smb/"
1370 TARGET="_top"
1371 > Pam_smb</A
1372 >
1373         you can get any pam aware application looking to the samba password and
1374         can leave the password field in <TT
1375 CLASS="FILENAME"
1376 >/etc/shadow</TT
1377 >
1378         or <TT
1379 CLASS="FILENAME"
1380 >/etc/passwd</TT
1381 > invalid.</P
1382 ></DIV
1383 ><DIV
1384 CLASS="SECT2"
1385 ><HR><H2
1386 CLASS="SECT2"
1387 ><A
1388 NAME="AEN292"
1389 >Authenticating other Samba Servers</A
1390 ></H2
1391 ><P
1392 >In a domain that has a number of servers you only need one password database.
1393         The machines that don't have their own ask the PDC  to check for them.
1394     This will work fine for a domain controlled by either a Samba or NT machine.</P
1395 ><P
1396 >To do so the Samba machine must be told to refer to the PDC and where the PDC is.
1397     See the section in the NTDom <A
1398 HREF="samba-pdc-faq.html"
1399 TARGET="_top"
1400 >FAQ</A
1401 > called <I
1402 CLASS="EMPHASIS"
1403 >How do I get my samba server to
1404     become a member ( not PDC ) of an NT domain?</I
1405 ></P
1406 ></DIV
1407 ></DIV
1408 ></DIV
1409 ><DIV
1410 CLASS="CHAPTER"
1411 ><HR><H1
1412 ><A
1413 NAME="AEN298"
1414 >Chapter 6. Background</A
1415 ></H1
1416 ><DIV
1417 CLASS="SECT1"
1418 ><H1
1419 CLASS="SECT1"
1420 ><A
1421 NAME="AEN300"
1422 ></A
1423 ></H1
1424 ><DIV
1425 CLASS="SECT2"
1426 ><H2
1427 CLASS="SECT2"
1428 ><A
1429 NAME="AEN302"
1430 >History</A
1431 ></H2
1432 ><P
1433 >It might help you understand the limitations of the PDC in Samba if you
1434         read something of its history. Well, the history as I understand it anyway.</P
1435 ><P
1436 >For many years the Samba team have been developing Samba, some time ago
1437         a number of people, possibly lead by Luke Leighton started contributing NT
1438         PDC stuff. This was added to the 'head' stream (that would eventually
1439         become the next version) and later to a seperate stream (NTDom). They did so
1440         much that eventually this development stream was so mutated that it could not
1441         be merged back into the main stream and was abandoned towards the end of 1999.
1442         And that was very sad because many users, myself include had become heavily
1443         dependant on the NTController facilities it offered. Oh well...</P
1444 ><P
1445 >The NTDom team continued on with their new found knowledge however and
1446         built the TNG stream. Intended to be carefully controlled so that it can be
1447         merged back into the main stream and benefiting from what they learnt, it is
1448         a very different product to the origional NTDom product. However, for a
1449     number of reasons, the merge did not take place and now TNG is being developed
1450     at <A
1451 HREF="http://www.samba-tng.org"
1452 TARGET="_top"
1453 >http://www.samba-tng.org</A
1454 >.</P
1455 ><P
1456 >Now, the NTDom things that the main strean 2.0.x version does is based more
1457         on the old (initial version) abandoned code than on the TNG ideas. It appears
1458         that version 2.2.0 will also include an improved version of the 2.0.7 domain
1459         controller charactistics, not the TNG ways. The developers have indicated
1460         that 2.2.0 will be further developed incrementally and the ideas from TNG
1461         incorporated into it.</P
1462 ><P
1463 >One more little wriggle is worth mentioning. At one stage the NTDom
1464         stream was called Samba 2.1.0-prealpha and similar names. This is most
1465         unfortunate because at least one book published advises people who want to
1466         use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon
1467         be called 2.2.0  and NOT officially supporting NTDom Controlling functions,
1468         the potential for confusion is certainly there.</P
1469 ></DIV
1470 ><DIV
1471 CLASS="SECT2"
1472 ><HR><H2
1473 CLASS="SECT2"
1474 ><A
1475 NAME="AEN310"
1476 >The Future</A
1477 ></H2
1478 ><P
1479 >There is a document on the Samba mirrors called <I
1480 CLASS="EMPHASIS"
1481 >'Development'
1482         </I
1483 >. It offers the 'best guess'   of what is planned for future releases
1484         of Samba.</P
1485 ><P
1486 >The future of Samba as a Primary Domain Controller appears rosie, however
1487         be aware that its the future, not the present. The developers are strongly committed
1488         to building a full featured PDC into Samba but it will  take time. If this
1489         version does not meet your requirements then you should consider (in no particular
1490         order) :</P
1491 ><P
1492 ></P
1493 ><UL
1494 ><LI
1495 ><P
1496 > Wait. No, we don't know how long. Repeated asking won't help.</P
1497 ></LI
1498 ><LI
1499 ><P
1500 >Investigate the development versions, TNG perhaps or HEAD where new code is being added
1501         all the time. Realise that development code is often unstable, poorly documented and subject to change.
1502         You will need to use cvs to download development versions.</P
1503 ></LI
1504 ><LI
1505 ><P
1506 >Join one of the Samba mailing lists so that you can find out
1507         what is happening on the 'bleeding edge'.</P
1508 ></LI
1509 ></UL
1510 ></DIV
1511 ><DIV
1512 CLASS="SECT2"
1513 ><HR><H2
1514 CLASS="SECT2"
1515 ><A
1516 NAME="AEN322"
1517 >Getting further help</A
1518 ></H2
1519 ><P
1520 >This document cannot possibly answer all your questions. Please understand that its very
1521         likely that someone has been confrounted by the same problem that you have. The
1522     <A
1523 HREF="samba-pdc-faq.html"
1524 TARGET="_top"
1525 >FAQ</A
1526 >
1527     discusses a number of possible paths to take to get further help :</P
1528 ><P
1529 ></P
1530 ><UL
1531 ><LI
1532 ><P
1533 >Documents on the Samba Sites.</P
1534 ></LI
1535 ><LI
1536 ><P
1537 >Other web sites.</P
1538 ></LI
1539 ><LI
1540 ><P
1541 >Mailing list.</P
1542 ></LI
1543 ></UL
1544 ><P
1545 >There is some discussion about guide lines for using the Mailing Lists on the
1546     accompanying <A
1547 HREF="samba-pdc-faq.html"
1548 TARGET="_top"
1549 >FAQ</A
1550 >,
1551     please read them before posting.</P
1552 ></DIV
1553 ></DIV
1554 ></DIV
1555 ></DIV
1556 ></BODY
1557 ></HTML
1558 >