| blob | 1b958b3ef282747af0f7ee3572d26ebff36c95c7 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
4 <chapter id="appendix">
5 <title>A Collection of Useful Tidbits</title>
7 <para>
8 <indexterm><primary>material</primary></indexterm>
9 <indexterm><primary>domain</primary><secondary>joining</secondary></indexterm>
10 Information presented here is considered to be either basic or well-known material that is informative
11 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that
12 the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps
13 different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical,
14 as shown in the example given below.
15 </para>
17 <sect1 id="domjoin">
18 <title>Joining a Domain: Windows 200x/XP Professional</title>
20 <para>
21 <indexterm><primary>joining a domain</primary></indexterm>
22 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security.
23 This section steps through the process for making a Windows 200x/XP Professional machine a
24 member of a Domain Security environment. It should be noted that this process is identical
25 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC.
26 </para>
28 <procedure>
29 <title>Steps to Join a Domain</title>
31 <step><para>
32 Click <guimenu>Start</guimenu>.
33 </para></step>
35 <step><para>
36 Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>.
37 </para></step>
39 <step><para>
40 The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel.
41 See <link linkend="swxpp001"></link>.
42 <figure id="swxpp001"><title>The General Panel.</title><imagefile>wxpp001</imagefile></figure>
43 </para></step>
45 <step><para>
46 Click the <guimenu>Computer Name</guimenu> tab.
47 This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>,
48 and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>.
49 </para>
51 <para>
52 Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
53 Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
54 See <link linkend="swxpp004"></link>.
55 <figure id="swxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure>
56 </para></step>
58 <step><para>
59 Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP.
60 We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>.
61 <figure id="swxpp006"><title>The Computer Name Changes Panel</title><imagefile>wxpp006</imagefile></figure>
62 </para></step>
64 <step><para>
65 Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button.
66 </para>
68 <para>
69 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>.
70 <figure id="swxpp007"><title>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</title><imagefile>wxpp007</imagefile></figure>
71 </para></step>
73 <step><para>
74 Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password)
75 of a domain administrative account that has the rights to add machines to the domain.
76 </para>
78 <para>
79 Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
80 <figure id="swxpp008"><title>Computer Name Changes &smbmdash; User name and Password Panel</title><imagefile>wxpp008</imagefile></figure>
81 </para></step>
83 <step><para>
84 Click <guimenu>OK</guimenu>.
85 </para>
87 <para>
88 The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted.
89 Joining the domain is now complete.
90 </para></step>
92 </procedure>
94 <para>
95 <indexterm><primary>Active Directory</primary></indexterm>
96 <indexterm><primary>DNS</primary></indexterm>
97 The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a
98 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members
99 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.
100 </para>
102 <para>
103 <indexterm><primary>Netlogon</primary></indexterm>
104 <indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm>
105 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers
106 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server
107 to find the services (like which machines are domain controllers or which machines have the Netlogon service running).
108 </para>
110 <para>
111 <indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm>
112 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix,
113 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to
114 a valid IP address.
115 </para>
117 <para>
118 The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain.
119 Where the client is a member of a Samba domain, it is preferable to leave this field blank.
120 </para>
122 <para>
123 <indexterm><primary>Group Policy</primary></indexterm>
124 According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant>
125 enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used
126 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is
127 used only if Group Policy is disabled or unspecified.</quote>
128 </para>
130 </sect1>
132 <sect1>
133 <title>Samba System File Location</title>
135 <para><indexterm>
136 <primary>default installation</primary>
137 </indexterm><indexterm>
138 <primary>/usr/local/samba</primary>
139 </indexterm><indexterm>
140 <primary>/usr/local</primary>
141 </indexterm>
142 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team
143 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is
144 in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other
145 Open Source software that installs into the <filename>/usr/local</filename> subdirectories.
146 </para>
148 <para>
149 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team
150 default.
151 </para>
153 <para><indexterm>
154 <primary>Free Standards Group</primary>
155 <see>FSG</see>
156 </indexterm><indexterm>
157 <primary>FSG</primary>
158 </indexterm><indexterm>
159 <primary>Linux Standards Base</primary>
160 <see>LSB</see>
161 </indexterm><indexterm>
162 <primary>LSB</primary>
163 </indexterm><indexterm>
164 <primary>File Hierarchy System</primary>
165 <see>FHS</see>
166 </indexterm><indexterm>
167 <primary>FHS</primary>
168 </indexterm><indexterm>
169 <primary>file locations</primary>
170 </indexterm><indexterm>
171 <primary>/etc/samba</primary>
172 </indexterm><indexterm>
173 <primary>/usr/sbin</primary>
174 </indexterm><indexterm>
175 <primary>/usr/bin</primary>
176 </indexterm><indexterm>
177 <primary>/usr/share</primary>
178 </indexterm><indexterm>
179 <primary>/usr/share/swat</primary>
180 </indexterm><indexterm>
181 <primary>/usr/lib/samba</primary>
182 </indexterm><indexterm>
183 <primary>/usr/share/samba/swat</primary>
184 </indexterm><indexterm>
185 <primary>SWAT</primary>
186 </indexterm><indexterm>
187 <primary>VFS modules</primary>
188 </indexterm>
189 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy
190 System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary
191 files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the
192 <filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the
193 <filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in
194 <filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the
195 <filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the
196 passdb backend as well as for the VFS modules.
197 </para>
199 <para><indexterm>
200 <primary>/var/lib/samba</primary>
201 </indexterm><indexterm>
202 <primary>/var/log/samba</primary>
203 </indexterm><indexterm>
204 <primary>run-time control files</primary>
205 </indexterm>
206 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in
207 the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename>
208 </para>
210 <para>
211 When Samba is built and installed using the default Samba Team process, all files are located under the
212 <filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns.
213 </para>
215 <para><indexterm>
216 <primary>smbd</primary>
217 <secondary>location of files</secondary>
218 </indexterm>
219 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location
220 of all files called <command>smbd</command>. Here is an example:
221 <screen>
222 &rootprompt; find / -name smbd -print
223 </screen>
224 You can find the location of the configuration files by running:
225 <screen>
226 &rootprompt; /path-to-binary-file/smbd -b | more
227 ...
228 Paths:
229 SBINDIR: /usr/sbin
230 BINDIR: /usr/bin
231 SWATDIR: /usr/share/samba/swat
232 CONFIGFILE: /etc/samba/smb.conf
233 LOGFILEBASE: /var/log/samba
234 LMHOSTSFILE: /etc/samba/lmhosts
235 LIBDIR: /usr/lib/samba
236 SHLIBEXT: so
237 LOCKDIR: /var/lib/samba
238 PIDDIR: /var/run/samba
239 SMB_PASSWD_FILE: /etc/samba/smbpasswd
240 PRIVATE_DIR: /etc/samba
241 ...
242 </screen>
243 If you wish to locate the Samba version, just run:
244 <screen>
245 &rootprompt; /path-to-binary-file/smbd -V
246 Version 3.0.20-SUSE
247 </screen>
248 </para>
250 <para>
251 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
252 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
253 executing:<indexterm>
254 <primary>rpm</primary>
255 </indexterm>
256 <screen>
257 &rootprompt; rpm -qa | grep samba
258 samba3-pdb-3.0.20-1
259 samba3-vscan-0.3.6-0
260 samba3-winbind-3.0.20-1
261 samba3-3.0.20-1
262 samba3-python-3.0.20-1
263 samba3-utils-3.0.20-1
264 samba3-doc-3.0.20-1
265 samba3-client-3.0.20-1
266 samba3-cifsmount-3.0.20-1
267 </screen><indexterm>
268 <primary>package names</primary>
269 </indexterm>
270 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them.
271 </para>
273 </sect1>
275 <sect1>
276 <title>Starting Samba</title>
278 <para><indexterm>
279 <primary>daemon</primary>
280 </indexterm>
281 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
282 An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there
283 are three daemons, two of which are needed as a minimum.
284 </para>
286 <para>
287 The Samba server is made up of the following daemons:
288 </para>
290 <example id="ch12SL">
291 <title>A Useful Samba Control Script for SUSE Linux</title>
292 <screen>
293 #!/bin/bash
294 #
295 # Script to start/stop samba
296 # Locate this in /sbin as a file called 'samba'
298 RCD=/etc/rc.d
300 if [ z$1 == 'z' ]; then
301 echo $0 - No arguments given; must be start or stop.
302 exit
303 fi
305 if [ $1 == 'start' ]; then
306 ${RCD}/nmb start
307 ${RCD}/smb start
308 ${RCD}/winbind start
310 fi
311 if [ $1 == 'stop' ]; then
312 ${RCD}/smb stop
313 ${RCD}/winbind stop
314 ${RCD}/nmb stop
315 fi
316 if [ $1 == 'restart' ]; then
317 ${RCD}/smb stop
318 ${RCD}/winbind stop
319 ${RCD}/nmb stop
320 sleep 5
321 ${RCD}/nmb start
322 ${RCD}/smb start
323 ${RCD}/winbind start
324 fi
325 exit 0
326 </screen>
327 </example>
329 <variablelist>
330 <varlistentry><term>nmbd</term>
331 <listitem><para>
332 <indexterm><primary>smbd</primary></indexterm>
333 <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
334 This daemon handles all name registration and resolution requests. It is the primary vehicle involved
335 in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
336 be the first command started as part of the Samba startup process.
337 </para></listitem>
338 </varlistentry>
340 <varlistentry><term>smbd</term>
341 <listitem><para>
342 <indexterm><primary>nmbd</primary></indexterm>
343 <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
344 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
345 manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
346 </para></listitem>
347 </varlistentry>
349 <varlistentry><term>winbindd</term>
350 <listitem><para>
351 <indexterm><primary>winbindd</primary></indexterm>
352 <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
353 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
354 Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
355 &smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
356 parameters. If they are not found, <command>winbindd</command> bails out and refuses to start.
357 </para></listitem>
358 </varlistentry>
359 </variablelist>
361 <para>
362 When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
363 integration into the platform as a whole. Please refer to your operating system platform administration manuals for
364 specific information pertaining to correct management of Samba startup.
365 </para>
367 <example id="ch12RHscript">
368 <title>A Sample Samba Control Script for Red Hat Linux</title>
369 <screen>
370 #!/bin/sh
371 #
372 # chkconfig: 345 81 35
373 # description: Starts and stops the Samba smbd and nmbd daemons \
374 # used to provide SMB network services.
376 # Source function library.
377 . /etc/rc.d/init.d/functions
378 # Source networking configuration.
379 . /etc/sysconfig/network
380 # Check that networking is up.
381 [ ${NETWORKING} = "no" ] && exit 0
382 CONFIG=/etc/samba/smb.conf
383 # Check that smb.conf exists.
384 [ -f $CONFIG ] || exit 0
386 # See how we were called.
387 case "$1" in
388 start)
389 echo -n "Starting SMB services: "
390 daemon smbd -D; daemon nmbd -D; echo;
391 touch /var/lock/subsys/smb
392 ;;
393 stop)
394 echo -n "Shutting down SMB services: "
395 smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
396 for pid in $smbdpids; do
397 kill -TERM $pid
398 done
399 killproc nmbd -TERM; rm -f /var/lock/subsys/smb
400 echo ""
401 ;;
402 status)
403 status smbd; status nmbd;
404 ;;
405 restart)
406 echo -n "Restarting SMB services: "
407 $0 stop; $0 start;
408 echo "done."
409 ;;
410 *)
411 echo "Usage: smb {start|stop|restart|status}"
412 exit 1
413 esac
414 </screen>
415 </example>
417 <para><indexterm>
418 <primary>samba control script</primary>
419 </indexterm>
420 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently
421 executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory
422 <filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be
423 owned by user root and group root, and set so that only root can execute it.
424 </para>
426 <para><indexterm>
427 <primary>startup script</primary>
428 </indexterm>
429 A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>.
430 This file could be located in the directory <filename>/etc/rc.d</filename> and can be called
431 <filename>samba</filename>. A similar startup script is required to control <command>winbind</command>.
432 If you want to find more information regarding startup scripts please refer to the packaging section of
433 the Samba source code distribution tarball. The packaging files for each platform include a
434 startup control file.
435 </para>
437 </sect1>
439 <sect1>
440 <title>DNS Configuration Files</title>
442 <para>
443 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they
444 are presented here for general reference.
445 </para>
447 <sect2>
448 <title>The Forward Zone File for the Loopback Adaptor</title>
450 <para>
451 The forward zone file for the loopback address never changes. An example file is shown
452 in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a
453 physical interface on the machine itself is routed to the loopback adaptor. This is
454 a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor
455 is called <constant>localhost</constant>.
456 </para>
458 <example id="loopback">
459 <title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title>
460 <screen>
461 $TTL 1W
462 @ IN SOA @ root (
463 42 ; serial
464 2D ; refresh
465 4H ; retry
466 6W ; expiry
467 1W ) ; minimum
469 IN NS @
470 IN A 127.0.0.1
471 </screen>
472 </example>
474 </sect2>
476 <sect2>
477 <title>The Reverse Zone File for the Loopback Adaptor</title>
479 <para>
480 The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/>
481 is necessary so that references to the address <constant>127.0.0.1</constant> can be
482 resolved to the correct name of the interface.
483 </para>
485 <example id="dnsloopy">
486 <title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title>
487 <screen>
488 $TTL 1W
489 @ IN SOA localhost. root.localhost. (
490 42 ; serial
491 2D ; refresh
492 4H ; retry
493 6W ; expiry
494 1W ) ; minimum
496 IN NS localhost.
497 1 IN PTR localhost.
498 </screen>
499 </example>
501 <example id="roothint">
502 <title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title>
503 <screen>
504 ; This file is made available by InterNIC under anonymous FTP as
505 ; file /domain/named.root
506 ; on server FTP.INTERNIC.NET
507 ; last update: Nov 5, 2002. Related version of root zone: 2002110501
508 ; formerly NS.INTERNIC.NET
509 . 3600000 IN NS A.ROOT-SERVERS.NET.
510 A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
511 ; formerly NS1.ISI.EDU
512 . 3600000 NS B.ROOT-SERVERS.NET.
513 B.ROOT-SERVERS.NET. 3600000 A 128.9.0.107
514 ; formerly C.PSI.NET
515 . 3600000 NS C.ROOT-SERVERS.NET.
516 C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
517 ; formerly TERP.UMD.EDU
518 . 3600000 NS D.ROOT-SERVERS.NET.
519 D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
520 ; formerly NS.NASA.GOV
521 . 3600000 NS E.ROOT-SERVERS.NET.
522 E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
523 ; formerly NS.ISC.ORG
524 . 3600000 NS F.ROOT-SERVERS.NET.
525 F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
526 ; formerly NS.NIC.DDN.MIL
527 . 3600000 NS G.ROOT-SERVERS.NET.
528 G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
529 ; formerly AOS.ARL.ARMY.MIL
530 . 3600000 NS H.ROOT-SERVERS.NET.
531 H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
532 ; formerly NIC.NORDU.NET
533 . 3600000 NS I.ROOT-SERVERS.NET.
534 I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
535 ; operated by VeriSign, Inc.
536 . 3600000 NS J.ROOT-SERVERS.NET.
537 J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
538 ; housed in LINX, operated by RIPE NCC
539 . 3600000 NS K.ROOT-SERVERS.NET.
540 K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
541 ; operated by IANA
542 . 3600000 NS L.ROOT-SERVERS.NET.
543 L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
544 ; housed in Japan, operated by WIDE
545 . 3600000 NS M.ROOT-SERVERS.NET.
546 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
547 ; End of File
548 </screen>
549 </example>
550 </sect2>
552 <sect2>
553 <title>DNS Root Server Hint File</title>
555 <para>
556 The content of the root hints file as shown in <link linkend="roothint"/> changes slowly over time.
557 Periodically this file should be updated from the source shown. Because
558 of its size, this file is located at the end of this chapter.
559 </para>
561 </sect2>
563 </sect1>
565 <sect1 id="altldapcfg">
566 <title>Alternative LDAP Database Initialization</title>
568 <para><indexterm>
569 <primary>LDAP</primary>
570 <secondary>database</secondary>
571 </indexterm><indexterm>
572 <primary>LDAP</primary>
573 <secondary>initial configuration</secondary>
574 </indexterm>
575 The following procedure may be used as an alternative means of configuring
576 the initial LDAP database. Many administrators prefer to have greater control
577 over how system files get configured.
578 </para>
580 <sect2>
581 <title>Initialization of the LDAP Database</title>
583 <para><indexterm>
584 <primary>LDIF</primary>
585 </indexterm><indexterm>
586 <primary>Domain Groups</primary>
587 <secondary>well-known</secondary>
588 </indexterm><indexterm>
589 <primary>SID</primary>
590 </indexterm>
591 The first step to get the LDAP server ready for action is to create the LDIF file from
592 which the LDAP database will be preloaded. This is necessary to create the containers
593 into which the user, group, and other accounts are written. It is also necessary to
594 preload the well-known Windows NT Domain Groups, as they must have the correct SID so
595 that they can be recognized as special NT Groups by the MS Windows clients.
596 </para>
598 <procedure id="ldapinit">
599 <title>LDAP Directory Pre-Load Steps</title>
601 <step><para>
602 Create a directory in which to store the files you use to generate
603 the LDAP LDIF file for your system. Execute the following:
604 <screen>
605 &rootprompt; mkdir /etc/openldap/SambaInit
606 &rootprompt; chown root:root /etc/openldap/SambaInit
607 &rootprompt; chmod 700 /etc/openldap/SambaInit
608 </screen>
609 </para></step>
611 <step><para>
612 Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>,
613 and <link linkend="sbehap-ldapreconfc"/> into the directory
614 <filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are,
615 respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file.
616 </para></step>
618 <step><para>
619 Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory
620 <filename>/etc/openldap/SambaInit/.</filename> These two files are
621 parts A and B, respectively, of the <filename>init-ldif.pat</filename> file.
622 </para></step>
624 <step><para>
625 Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following:
626 <screen>
627 &rootprompt; sh SMBLDAP-ldif-preconfig.sh
629 How do you wish to refer to your organization?
630 Suggestions:
631 Black Tire Company, Inc.
632 Cat With Hat Ltd.
633 How would you like your organization name to appear?
634 Your organization name is: My Organization
635 Enter a new name is this is not what you want, press Enter to Continue.
636 Name [My Organization]: Abmas Inc.
638 Samba Config File Location [/etc/samba/smb.conf]:
639 Enter a new full path or press Enter to continue.
640 Samba Config File Location [/etc/samba/smb.conf]:
641 Domain Name: MEGANET2
642 Domain SID: S-1-5-21-3504140859-1010554828-2431957765
644 The name of your Internet domain is now needed in a special format
645 as follows, if your domain name is mydomain.org, what we need is
646 the information in the form of:
647 Domain ID: mydomain
648 Top level: org
649 If your fully qualified hostname is: snoopy.bazaar.garagesale.net
650 where "snoopy" is the name of the machine,
651 Then the information needed is:
652 Domain ID: garagesale
653 Top Level: net
655 Found the following domain name: abmas.biz
656 I think the bit we are looking for might be: abmas
657 Enter the domain name or press Enter to continue:
659 The top level organization name I will use is: biz
660 Enter the top level org name or press Enter to continue:
661 &rootprompt;
662 </screen>
663 This creates a file called <filename>MEGANET2.ldif</filename>.
664 </para></step>
666 <step><para>
667 It is now time to preload the LDAP database with the following
668 command:
669 <screen>
670 &rootprompt; slapadd -v -l MEGANET2.ldif
671 added: "dc=abmas,dc=biz" (00000001)
672 added: "cn=Manager,dc=abmas,dc=biz" (00000002)
673 added: "ou=People,dc=abmas,dc=biz" (00000003)
674 added: "ou=Computers,dc=abmas,dc=biz" (00000004)
675 added: "ou=Groups,dc=abmas,dc=biz" (00000005)
676 added: "ou=Domains,dc=abmas,dc=biz" (00000006)
677 added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007)
678 added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008)
679 added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009)
680 added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a)
681 </screen>
682 You should verify that the account information was correctly loaded by executing:
683 <screen>
684 &rootprompt; slapcat
685 dn: dc=abmas,dc=biz
686 objectClass: dcObject
687 objectClass: organization
688 dc: abmas
689 o: Abmas Inc.
690 description: Posix and Samba LDAP Identity Database
691 structuralObjectClass: organization
692 entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474
693 creatorsName: cn=manager,dc=abmas,dc=biz
694 modifiersName: cn=manager,dc=abmas,dc=biz
695 createTimestamp: 20031217055747Z
696 modifyTimestamp: 20031217055747Z
697 entryCSN: 2003121705:57:47Z#0x0001#0#0000
698 ...
700 dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
701 objectClass: posixGroup
702 objectClass: sambaGroupMapping
703 gidNumber: 513
704 cn: domusers
705 sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
706 sambaGroupType: 2
707 displayName: Domain Users
708 description: Domain Users
709 structuralObjectClass: posixGroup
710 entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474
711 creatorsName: cn=manager,dc=abmas,dc=biz
712 modifiersName: cn=manager,dc=abmas,dc=biz
713 createTimestamp: 20031217055747Z
714 modifyTimestamp: 20031217055747Z
715 entryCSN: 2003121705:57:47Z#0x000a#0#0000
716 </screen>
717 </para></step>
719 <step><para>
720 Your LDAP database is ready for testing. You can now start the LDAP server
721 using the system tool for your Linux operating system. For SUSE Linux, you can
722 do this as follows:
723 <screen>
724 &rootprompt; rcldap start
725 </screen>
726 </para></step>
728 <step><para>
729 It is now a good idea to validate that the LDAP server is running correctly.
730 Execute the following:
731 <screen>
732 &rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
733 # extended LDIF
734 #
735 # LDAPv3
736 # base <dc=abmas,dc=biz> with scope sub
737 # filter: (ObjectClass=*)
738 # requesting: ALL
739 #
741 # abmas.biz
742 dn: dc=abmas,dc=biz
743 objectClass: dcObject
744 objectClass: organization
745 dc: abmas
746 o: Abmas Inc.
747 description: Posix and Samba LDAP Identity Database
748 ...
749 # domusers, Groups, abmas.biz
750 dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
751 objectClass: posixGroup
752 objectClass: sambaGroupMapping
753 gidNumber: 513
754 cn: domusers
755 sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
756 sambaGroupType: 2
757 displayName: Domain Users
758 description: Domain Users
760 # search result
761 search: 2
762 result: 0 Success
764 # numResponses: 11
765 # numEntries: 10
766 </screen>
767 Your LDAP server is ready for creation of additional accounts.
768 </para></step>
769 </procedure>
771 </sect2>
773 <example id="sbehap-ldapreconfa">
774 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title>
775 <screen>
776 #!/bin/bash
777 #
778 # This script prepares the ldif LDAP load file only
779 #
781 # Pattern File Name
782 file=init-ldif.pat
784 # The name of my organization
785 ORGNAME="My Organization"
787 # My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets"
788 INETDOMAIN="my-domain"
790 # In the above case, md domain is: buckets.org, TLDORG="org"
791 TLDORG="org"
793 # This is the Samba Domain/Workgroup Name
794 DOMNAME="MYWORKGROUP"
796 #
797 # Here We Go ...
798 #
800 cat <<EOF
802 How do you wish to refer to your organization?
804 Suggestions:
805 Black Tire Company, Inc.
806 Cat With Hat Ltd.
808 How would you like your organization name to appear?
810 EOF
812 echo "Your organization name is: $ORGNAME"
813 echo
814 echo "Enter a new name or, press Enter to Continue."
815 echo
816 </screen>
817 </example>
819 <example id="sbehap-ldapreconfb">
820 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title>
821 <screen>
822 echo -e -n "Name [$ORGNAME]: "
823 read name
825 if [ ! -z "$name" ]; then
826 ORGNAME=${name}
827 fi
828 echo
829 sed "s/ORGNAME/${ORGNAME}/g" < $file > $file.tmp1
831 # Try to find smb.conf
833 if [ -e /usr/local/samba/lib/smb.conf ]; then
834 CONF=/usr/local/samba/lib/smb.conf
835 elif [ -e /etc/samba/smb.conf ]; then
836 CONF=/etc/samba/smb.conf
837 fi
839 echo "Samba Config File Location [$CONF]: "
840 echo
841 echo "Enter a new full path or press Enter to continue."
842 echo
843 echo -n "Samba Config File Location [$CONF]: "
844 read name
845 if [ ! -z "$name" ]; then
846 CONF=$name
847 fi
848 echo
850 # Find the name of our Domain/Workgroup
851 DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=`
852 echo Domain Name: $DOMNAME
853 echo
855 sed "s/DOMNAME/${DOMNAME}/g" < $file.tmp1 > $file.tmp2
857 DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"`
858 echo Domain SID: $DOMSID
860 sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1
861 </screen>
862 </example>
864 <example id="sbehap-ldapreconfc">
865 <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title>
866 <screen>
867 cat <<EOL
868 The name of your Internet domain is now needed in a special format
869 as follows, if your domain name is mydomain.org, what we need is
870 the information in the form of:
871 Domain ID: mydomain
872 Top level: org
874 If your fully qualified hostname is: snoopy.bazaar.garagesale.net
875 where "snoopy" is the name of the machine,
876 Then the information needed is:
877 Domain ID: garagesale
878 Top Level: net
880 EOL
881 INETDOMAIN=`hostname -d | cut -f1 -d.`
882 echo Found the following domain name: `hostname -d`
883 echo "I think the bit we are looking for might be: $INETDOMAIN"
884 echo
885 echo -n "Enter the domain name or press Enter to continue: "
886 read domnam
887 if [ ! -z $domnam ]; then
888 INETDOMAIN=$domnam
889 fi
890 echo
891 sed "s/INETDOMAIN/${INETDOMAIN}/g" < $file.tmp1 > $file.tmp2
892 TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"`
893 echo "The top level organization name I will use is: ${TLDORG}"
894 echo
895 echo -n "Enter the top level org name or press Enter to continue: "
896 read domnam
897 if [ ! -z $domnam ]; then
898 TLDORG=$domnam
899 fi
900 sed "s/TLDORG/${TLDORG}/g" < $file.tmp2 > $DOMNAME.ldif
901 rm $file.tmp*
902 exit 0
903 </screen>
904 </example>
906 <example id="sbehap-ldifpata">
907 <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title>
908 <screen>
909 dn: dc=INETDOMAIN,dc=TLDORG
910 objectClass: dcObject
911 objectClass: organization
912 dc: INETDOMAIN
913 o: ORGNAME
914 description: Posix and Samba LDAP Identity Database
916 dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG
917 objectClass: organizationalRole
918 cn: Manager
919 description: Directory Manager
921 dn: ou=People,dc=INETDOMAIN,dc=TLDORG
922 objectClass: top
923 objectClass: organizationalUnit
924 ou: People
926 dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG
927 objectClass: top
928 objectClass: organizationalUnit
929 ou: Computers
931 dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG
932 objectClass: top
933 objectClass: organizationalUnit
934 ou: Groups
936 dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG
937 objectClass: top
938 objectClass: organizationalUnit
939 ou: Idmap
941 dn: ou=Domains,dc=INETDOMAIN,dc=TLDORG
942 objectClass: top
943 objectClass: organizationalUnit
944 ou: Domains
946 dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG
947 objectClass: sambaDomain
948 sambaDomainName: DOMNAME
949 sambaSID: DOMSID
950 sambaAlgorithmicRidBase: 1000
951 structuralObjectClass: sambaDomain
952 </screen>
953 </example>
955 <example id="sbehap-ldifpatb">
956 <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title>
957 <screen>
958 dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG
959 objectClass: posixGroup
960 objectClass: sambaGroupMapping
961 gidNumber: 512
962 cn: domadmins
963 sambaSID: DOMSID-512
964 sambaGroupType: 2
965 displayName: Domain Admins
966 description: Domain Administrators
968 dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG
969 objectClass: posixGroup
970 objectClass: sambaGroupMapping
971 gidNumber: 514
972 cn: domguests
973 sambaSID: DOMSID-514
974 sambaGroupType: 2
975 displayName: Domain Guests
976 description: Domain Guests Users
978 dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG
979 objectClass: posixGroup
980 objectClass: sambaGroupMapping
981 gidNumber: 513
982 cn: domusers
983 sambaSID: DOMSID-513
984 sambaGroupType: 2
985 displayName: Domain Users
986 description: Domain Users
987 </screen>
988 </example>
990 </sect1>
992 <sect1>
993 <title>The LDAP Account Manager</title>
995 <para>
996 <indexterm><primary>LAM</primary></indexterm>
997 <indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm>
998 <indexterm><primary>PHP</primary></indexterm>
999 <indexterm><primary>unencrypted</primary></indexterm>
1000 <indexterm><primary>SSL</primary></indexterm>
1001 <indexterm><primary>Posix</primary></indexterm>
1002 <indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm>
1003 The LDAP Account Manager (LAM) is an application suite that has been written in PHP.
1004 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP
1005 server either using unencrypted connections or via SSL/TLS. LAM can be used to manage
1006 Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines
1007 (hosts).
1008 </para>
1010 <para>
1011 LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink>
1012 home page and from its mirror sites. LAM has been released under the GNU GPL version 2.
1013 The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter
1014 of 2005.
1015 </para>
1017 <para>
1018 <indexterm><primary>PHP4</primary></indexterm>
1019 <indexterm><primary>OpenLDAP</primary></indexterm>
1020 <indexterm><primary>Perl</primary></indexterm>
1021 Requirements:
1022 </para>
1024 <itemizedlist>
1025 <listitem><para>A web server that will work with PHP4.</para></listitem>
1026 <listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem>
1027 <listitem><para>OpenLDAP 2.0 or later.</para></listitem>
1028 <listitem><para>A Web browser that supports CSS.</para></listitem>
1029 <listitem><para>Perl.</para></listitem>
1030 <listitem><para>The gettext package.</para></listitem>
1031 <listitem><para>mcrypt + mhash (optional).</para></listitem>
1032 <listitem><para>It is also a good idea to install SSL support.</para></listitem>
1033 </itemizedlist>
1035 <para>
1036 LAM is a useful tool that provides a simple Web-based device that can be used to
1037 manage the contents of the LDAP directory to:
1038 <indexterm><primary>organizational units</primary></indexterm>
1039 <indexterm><primary>operating profiles</primary></indexterm>
1040 <indexterm><primary>account policies</primary></indexterm>
1041 </para>
1043 <itemizedlist>
1044 <listitem><para>Display user/group/host and Domain entries.</para></listitem>
1045 <listitem><para>Manage entries (Add/Delete/Edit).</para></listitem>
1046 <listitem><para>Filter and sort entries.</para></listitem>
1047 <listitem><para>Store and use multiple operating profiles.</para></listitem>
1048 <listitem><para>Edit organizational units (OUs).</para></listitem>
1049 <listitem><para>Upload accounts from a file.</para></listitem>
1050 <listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem>
1051 </itemizedlist>
1053 <para>
1054 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba
1055 user, group, and windows domain member machine accounts.
1056 </para>
1058 <para>
1059 <indexterm><primary>default password</primary></indexterm>
1060 <indexterm><primary>secure connections</primary></indexterm>
1061 <indexterm><primary>LAM</primary></indexterm>
1062 <indexterm><primary>SSL</primary></indexterm>
1063 The default password is <quote>lam.</quote> It is highly recommended that you use only
1064 an SSL connection to your Web server for all remote operations involving LAM. If you
1065 want secure connections, you must configure your Apache Web server to permit connections
1066 to LAM using only SSL.
1067 </para>
1069 <procedure id="sbehap-laminst">
1070 <title>Apache Configuration Steps for LAM</title>
1072 <step><para>
1073 Extract the LAM package by untarring it as shown here:
1074 <screen>
1075 &rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz
1076 </screen>
1077 Alternatively, install the LAM DEB for your system using the following command:
1078 <screen>
1079 &rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb
1080 </screen>
1081 </para></step>
1083 <step><para>
1084 Copy the extracted files to the document root directory of your Web server.
1085 For example, on SUSE Linux Enterprise Server 9, copy to the
1086 <filename>/srv/www/htdocs</filename> directory.
1087 </para></step>
1089 <step><para>
1090 <indexterm><primary>file permissions</primary></indexterm>
1091 Set file permissions using the following commands:
1092 <screen>
1093 &rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam
1094 &rootprompt; chmod 755 /srv/www/htdocs/lam/sess
1095 &rootprompt; chmod 755 /srv/www/htdocs/lam/tmp
1096 &rootprompt; chmod 755 /srv/www/htdocs/lam/config
1097 &rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl
1098 </screen>
1099 </para></step>
1101 <step><para>
1102 <indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm>
1103 Using your favorite editor create the following <filename>config.cfg</filename>
1104 LAM configuration file:
1105 <screen>
1106 &rootprompt; cd /srv/www/htdocs/lam/config
1107 &rootprompt; cp config.cfg_sample config.cfg
1108 &rootprompt; vi config.cfg
1109 </screen>
1110 <indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm>
1111 <indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm>
1112 An example file is shown in <link linkend="lamcfg"/>.
1113 This is the minimum configuration that must be completed. The LAM profile
1114 file can be created using a convenient wizard that is part of the LAM
1115 configuration suite.
1116 </para></step>
1118 <step><para>
1119 Start your Web server then, using your Web browser, connect to
1120 <ulink url="http://localhost/lam">LAM</ulink> URL. Click on the
1121 the <parameter>Configuration Login</parameter> link then click on the
1122 Configuration Wizard link to begin creation of the default profile so that
1123 LAM can connect to your LDAP server. Alternately, copy the
1124 <filename>lam.conf_sample</filename> file to a file called
1125 <filename>lam.conf</filename> then, using your favorite editor,
1126 change the settings to match local site needs.
1127 </para></step>
1128 </procedure>
1130 <para>
1131 <indexterm><primary>pitfalls</primary></indexterm>
1132 An example of a working file is shown here in <link linkend="lamconf"/>.
1133 This file has been stripped of comments to keep the size small. The comments
1134 and help information provided in the profile file that the wizard creates
1135 is very useful and will help many administrators to avoid pitfalls.
1136 Your configuration file obviously reflects the configuration options that
1137 are preferred at your site.
1138 </para>
1140 <para>
1141 <indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm>
1142 It is important that your LDAP server is running at the time that LAM is
1143 being configured. This permits you to validate correct operation.
1144 An example of the LAM login screen is provided in <link linkend="lam-login"/>.
1145 </para>
1147 <figure id="lam-login">
1148 <title>The LDAP Account Manager Login Screen</title>
1149 <imagefile scale="50">lam-login</imagefile>
1150 </figure>
1152 <para>
1153 <indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm>
1154 The LAM configuration editor has a number of options that must be managed correctly.
1155 An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>.
1156 It is important that you correctly set the minimum and maximum UID/GID values that are
1157 permitted for use at your site. The default values may not be compatible with a need to
1158 modify initial default account values for well-known Windows network users and groups.
1159 The best work-around is to temporarily set the minimum values to zero (0) to permit
1160 the initial settings to be made. Do not forget to reset these to sensible values before
1161 using LAM to add additional users and groups.
1162 </para>
1164 <figure id="lam-config">
1165 <title>The LDAP Account Manager Configuration Screen</title>
1166 <imagefile scale="50">lam-config</imagefile>
1167 </figure>
1169 <para>
1170 <indexterm><primary>PDF</primary></indexterm>
1171 LAM has some nice, but unusual features. For example, one unexpected feature in most application
1172 screens permits the generation of a PDF file that lists configuration information. This is a well
1173 thought out facility. This option has been edited out of the following screen shots to conserve
1174 space.
1175 </para>
1177 <para>
1178 <indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm>
1179 When you log onto LAM the opening screen drops you right into the user manager as shown in
1180 <link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility
1181 to be used immediately. The editing of an existing user, as with the addition of a new user,
1182 is easy to follow and very clear in both layout and intent. It is a simple matter to edit
1183 generic settings, UNIX specific parameters, and then Samba account requirements. Each step
1184 involves clicking a button that intuitively drives you through the process. When you have
1185 finished editing simply press the <guimenu>Final</guimenu> button.
1186 </para>
1188 <figure id="lam-user">
1189 <title>The LDAP Account Manager User Edit Screen</title>
1190 <imagefile scale="50">lam-users</imagefile>
1191 </figure>
1193 <para>
1194 The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen
1195 for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/>
1196 shows a sub-screen from the group editor that permits users to be assigned secondary group
1197 memberships.
1198 </para>
1200 <figure id="lam-group">
1201 <title>The LDAP Account Manager Group Edit Screen</title>
1202 <imagefile scale="50">lam-groups</imagefile>
1203 </figure>
1205 <figure id="lam-group-mem">
1206 <title>The LDAP Account Manager Group Membership Edit Screen</title>
1207 <imagefile scale="50">lam-group-members</imagefile>
1208 </figure>
1210 <para>
1211 <indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm>
1212 The final screen presented here is one that you should not normally need to use. Host accounts will
1213 be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/>
1214 will, in most cases, not be used.
1215 </para>
1217 <figure id="lam-host">
1218 <title>The LDAP Account Manager Host Edit Screen</title>
1219 <imagefile scale="50">lam-hosts</imagefile>
1220 </figure>
1222 <para>
1223 One aspect of LAM that may annoy some users is the way it forces certain conventions on
1224 the administrator. For example, LAM does not permit the creation of Windows user and group
1225 accounts that contain spaces even though the underlying UNIX/Linux
1226 operating system may exhibit no problems with them. Given the propensity for using upper-case
1227 characters and spaces (particularly in the default Windows account names) this may cause
1228 some annoyance. For the rest, LAM is a very useful administrative tool.
1229 </para>
1231 <para>
1232 The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features
1233 (e.g., logon hours). The new plugin-based architecture also allows management of much more different
1234 account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another
1235 important point is the tree view which allows browsing and editing LDAP objects directly.
1236 </para>
1238 <example id="lamcfg">
1239 <title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title>
1240 <screen>
1241 # password to add/delete/rename configuration profiles
1242 password: not24get
1244 # default profile, without ".conf"
1245 default: lam
1246 </screen>
1247 </example>
1249 <example id="lamconf">
1250 <title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title>
1251 <screen>
1252 ServerURL: ldap://massive.abmas.org:389
1253 Admins: cn=Manager,dc=abmas,dc=biz
1254 Passwd: not24get
1255 usersuffix: ou=People,dc=abmas,dc=biz
1256 groupsuffix: ou=Groups,dc=abmas,dc=biz
1257 hostsuffix: ou=Computers,dc=abmas,dc=biz
1258 domainsuffix: ou=Domains,dc=abmas,dc=biz
1259 MinUID: 0
1260 MaxUID: 65535
1261 MinGID: 0
1262 MaxGID: 65535
1263 MinMachine: 20000
1264 MaxMachine: 25000
1265 userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber
1266 grouplistAttributes: #cn;#gidNumber;#memberUID;#description
1267 hostlistAttributes: #cn;#description;#uidNumber;#gidNumber
1268 maxlistentries: 30
1269 defaultLanguage: en_GB:ISO-8859-1:English (Great Britain)
1270 scriptPath:
1271 scriptServer:
1272 samba3: yes
1273 cachetimeout: 5
1274 pwdhash: SSHA
1275 </screen>
1276 </example>
1278 </sect1>
1280 <sect1>
1281 <title>IDEALX Management Console</title>
1283 <para>
1284 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive
1285 web-based management interface for UNIX and Linux systems.
1286 </para>
1288 <para>
1289 The Samba toolset is the first console developped for IMC. It offers a simple and ergonomic
1290 interface for managing a Samba domain controler. The goal is to give Linux administrators who
1291 need to manage production Samba servers an effective, intuitive and consistent management
1292 experience. An IMC screenshot of the user management tool is shown in <link linkend="imcidealx"/>.
1293 </para>
1295 <figure id="imcidealx">
1296 <title>The IMC Samba User Account Screen</title>
1297 <imagefile scale="40">imc-usermanager2</imagefile>
1298 </figure>
1300 <para>
1301 IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC,
1302 but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language.
1303 </para>
1305 <para>
1306 For further information regarding IMC refer to the web <ulink url="http://imc.sourceforge.net/">site.</ulink>
1307 Prebuilt RPM packages are also <ulink url="http://imc.sourceforge.net/download.html">available.</ulink>
1308 </para>
1310 </sect1>
1312 <sect1 id="ch12-SUIDSGID">
1313 <title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title>
1315 <indexterm><primary>SUID</primary></indexterm>
1316 <indexterm><primary>SGID</primary></indexterm>
1317 <para>
1318 The setting of the SUID/SGID bits on the file or directory permissions flag has particular
1319 consequences. If the file is executable and the SUID bit is set, it executes with the privilege
1320 of (with the UID of) the owner of the file. For example, if you are logged onto a system as
1321 a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned
1322 by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is
1323 executed as if you had logged in as the user <constant>root</constant> and then executed the file.
1324 The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the
1325 use of that executable file.
1326 </para>
1328 <para>
1329 The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it
1330 applies the privilege to the UNIX group setting. In other words, the file executes with the force
1331 of capability of the group.
1332 </para>
1334 <para>
1335 When the SUID/SGID permissions are set on a directory, all files that are created within that directory
1336 are automatically given the ownership of the SUID user and the SGID group, as per the ownership
1337 of the directory in which the file is created. This means that the system level <command>create()</command>
1338 function executes with the SUID user and/or SGID group of the directory in which the file is
1339 created.
1340 </para>
1342 <para>
1343 If you want to obtain the SUID behavior, simply execute the following command:
1344 <screen>
1345 &rootprompt; chmod u+s file-or-directory
1346 </screen>
1347 To set the SGID properties on a file or a directory, execute this command:
1348 <screen>
1349 &rootprompt; chmod g+s file-or-directory
1350 </screen>
1351 And to set both SUID and SGID properties, execute the following:
1352 <screen>
1353 &rootprompt; chmod ug+s file-or-directory
1354 </screen>
1355 </para>
1357 <para>
1358 Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this
1359 directory before setting both SUID and SGID on this directory are:
1360 <screen>
1361 &rootprompt; ls -al /data/accounts
1362 total 1
1363 drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1364 drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1365 drwxrwxrwx 2 bobj Domain Users 48 Dec 18 17:08 accounts/
1366 drwx------ 2 root root 48 Jan 26 2002 lost+found
1367 </screen>
1368 In this example, if the user <constant>maryv</constant> creates a file, it is owned by her.
1369 If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is
1370 owned by the group <constant>Accounts</constant>, as shown in this listing:
1371 <screen>
1372 &rootprompt; ls -al /data/accounts/maryvfile.txt
1373 drw-rw-r-- 2 maryv Accounts 12346 Dec 18 17:53
1374 </screen>
1375 </para>
1377 <para>
1378 Now you set the SUID and SGID and check the result as follows:
1379 <screen>
1380 &rootprompt; chmod ug+s /data/accounts
1381 &rootprompt; ls -al /data/accounts
1382 total 1
1383 drwxr-xr-x 10 root root 232 Dec 18 17:08 .
1384 drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
1385 drwsrwsr-x 2 bobj Domain Users 48 Dec 18 17:08 accounts
1386 drwx------ 2 root root 48 Jan 26 2002 lost+found
1387 </screen>
1388 If <constant>maryv</constant> creates a file in this directory after this change has been made, the
1389 file is owned by the user <constant>bobj</constant>, and the group is set to the group
1390 <constant>Domain Users</constant>, as shown here:
1391 <screen>
1392 &rootprompt; chmod ug+s /data/accounts
1393 &rootprompt; ls -al /data/accounts/maryvfile.txt
1394 total 1
1395 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
1396 </screen>
1397 </para>
1399 </sect1>
1401 <sect1 id="ch12dblck">
1402 <title>Shared Data Integrity</title>
1404 <para><indexterm>
1405 <primary>data integrity</primary>
1406 </indexterm><indexterm>
1407 <primary>multi-user</primary>
1408 <secondary>data access</secondary>
1409 </indexterm>
1410 The integrity of shared data is often viewed as a particularly emotional issue, especially where
1411 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have
1412 experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
1413 </para>
1415 <para>
1416 The solution to concurrent multiuser data access problems must consider three separate areas
1417 from which the problem may stem:<indexterm>
1418 <primary>locking</primary>
1419 <secondary>Application level</secondary>
1420 </indexterm><indexterm>
1421 <primary>locking</primary>
1422 <secondary>Client side</secondary>
1423 </indexterm><indexterm>
1424 <primary>locking</primary>
1425 <secondary>Server side</secondary>
1426 </indexterm>
1427 </para>
1429 <itemizedlist>
1430 <listitem><para>application-level locking controls</para></listitem>
1431 <listitem><para>client-side locking controls</para></listitem>
1432 <listitem><para>server-side locking controls</para></listitem>
1433 </itemizedlist>
1435 <para><indexterm>
1436 <primary>database applications</primary>
1437 </indexterm><indexterm>
1438 <primary>Microsoft Access</primary>
1439 </indexterm>
1440 Many database applications use some form of application-level access control. An example of one
1441 well-known application that uses application-level locking is Microsoft Access. Detailed guidance
1442 is provided here because this is the most common application for which problems have been reported.
1443 </para>
1445 <para><indexterm>
1446 <primary>Microsoft Excel</primary>
1447 </indexterm><indexterm>
1448 <primary>Act!</primary>
1449 </indexterm>
1450 Common applications that are affected by client- and server-side locking controls include MS
1451 Excel and Act!. Important locking guidance is provided here.
1452 </para>
1455 <sect2>
1456 <title>Microsoft Access</title>
1458 <para>
1459 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that
1460 cover this area. Examples of relevant documents include:
1461 </para>
1463 <itemizedlist>
1464 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem>
1465 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem>
1466 </itemizedlist>
1469 <para><indexterm>
1470 <primary>multi-user</primary>
1471 <secondary>access</secondary>
1472 </indexterm><indexterm>
1473 <primary>exclusive open</primary>
1474 </indexterm>
1475 Make sure that your MS Access database file is configured for multiuser access (not set for
1476 exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice>
1477 <guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu>
1478 </menuchoice>. Set network path to Default database folder: <filename>\\server\share\folder</filename>.
1479 </para>
1481 <para>
1482 You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>.
1483 Set:<indexterm>
1484 <primary>record locking</primary>
1485 </indexterm>
1486 </para>
1488 <itemizedlist>
1489 <listitem><para>Default open mode: Shared</para></listitem>
1490 <listitem><para>Default Record Locking: Edited Record</para></listitem>
1491 <listitem><para>Open databases using record_level locking</para></listitem>
1492 </itemizedlist>
1494 <para><indexterm>
1495 <primary>MS Access</primary>
1496 <secondary>validate</secondary>
1497 </indexterm>
1498 You must now commit the changes so that they will take effect. To do so, click
1499 <guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart
1500 it, and then validate that these settings have not changed.
1501 </para>
1503 </sect2>
1505 <sect2>
1506 <title>Act! Database Sharing</title>
1508 <para><indexterm>
1509 <primary>ACT! database</primary>
1510 </indexterm><indexterm>
1511 <primary>data corruption</primary>
1512 </indexterm>
1513 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you
1514 must disable opportunistic locking on the server and all workstations. Failure to do so
1515 results in data corruption. This information is available from the Act! Web site
1516 knowledgebase articles
1517 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink>
1518 as well as from article
1519 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>.
1520 </para>
1522 <para><indexterm>
1523 <primary>opportunistic locking</primary>
1524 </indexterm><indexterm>
1525 <primary>Act!Diag</primary>
1526 </indexterm>
1527 These documents clearly state that opportunistic locking must be disabled on both
1528 the server (Samba in the case we are interested in here), as well as on every workstation
1529 from which the centrally shared Act! database will be accessed. Act! provides
1530 a tool called <command>Act!Diag</command> that may be used to disable all workstation
1531 registry settings that may otherwise interfere with the operation of Act!
1532 Registered Act! users may download this utility from the Act! Web
1533 <ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink>
1534 </para>
1536 </sect2>
1538 <sect2>
1539 <title>Opportunistic Locking Controls</title>
1541 <para><indexterm>
1542 <primary>file caching</primary>
1543 </indexterm>
1544 Third-party Windows applications may not be compatible with the use of opportunistic file
1545 and record locking. For applications that are known not to be compatible,<footnote><para>Refer to
1546 the application manufacturer's installation guidelines and knowledge base for specific
1547 information regarding compatibility. It is often safe to assume that if the software
1548 manufacturer does not specifically mention incompatibilities with opportunistic file
1549 and record locking, or with Windows client file caching, the application is probably
1550 compatible with Windows (as well as Samba) default settings.</para></footnote> oplock
1551 support may need to be disabled both on the Samba server and on the Windows workstations.
1552 </para>
1554 <para><indexterm>
1555 <primary>cache</primary>
1556 </indexterm><indexterm>
1557 <primary>write lock</primary>
1558 </indexterm><indexterm>
1559 <primary>flush</primary>
1560 <secondary>cache memory</secondary>
1561 </indexterm>
1562 Oplocks enable a Windows client to cache parts of a file that are being
1563 edited. Another windows client may then request to open the file with the
1564 ability to write to it. The server will then ask the original workstation
1565 that had the file open with a write lock to release its lock. Before
1566 doing so, that workstation must flush the file from cache memory to the
1567 disk or network drive.
1568 </para>
1570 <para><indexterm>
1571 <primary>Oplocks</primary>
1572 <secondary>disabled</secondary>
1573 </indexterm>
1574 Disabling of Oplocks usage may require server and client changes.
1575 Oplocks may be disabled by file, by file pattern, on the share, or on the
1576 Samba server.
1577 </para>
1579 <para>
1580 The following are examples showing how Oplock support may be managed using
1581 Samba &smb.conf; file settings:
1582 <screen>
1583 By file: veto oplock files = myfile.mdb
1585 By Pattern: veto oplock files = /*.mdb/
1587 On the Share: oplocks = No
1588 level2 oplocks = No
1590 On the server:
1591 (in [global]) oplocks = No
1592 level2 oplocks = No
1593 </screen>
1594 </para>
1596 <para>
1597 The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4
1598 workstation clients must be configured as shown here:
1599 <screen>
1600 REGEDIT4
1602 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1603 Services\LanmanServer\Parameters]
1604 "EnableOplocks"=dword:00000000
1606 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
1607 Services\LanmanWorkstation\Parameters]
1608 "UseOpportunisticLocking"=dword:00000000
1609 </screen>
1610 </para>
1612 <para>
1613 Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13.
1614 The information in that chapter was obtained from a wide variety of sources.
1615 </para>
1617 </sect2>
1619 </sect1>
1621 </chapter>