| blob | 8a4e1ef2b2438158139397af373edc27c0077f82 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
5 <!-- Stuff for xincludes -->
6 <!ENTITY % xinclude SYSTEM "../entities/xinclude.dtd">
7 %xinclude;
9 <!-- entities files to use -->
10 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
11 %global_entities;
13 ]>
15 <chapter id="small">
16 <title>Small Office Networking</title>
18 <para>
19 So far, this book has focused on the basics of simple yet effective
20 network solutions. Network administrators who take pride in their work
21 (that's most of us, right?) take care to deliver what our users want,
22 but not too much more. If we make things too complex, we confound our users and
23 increase costs of network ownership. A professional network manager
24 avoids the temptation to put too much pizazz into the way that the network
25 operates. Some creativity is helpful, but do keep it under control.
26 </para>
28 <para><indexterm>
29 <primary>Netware</primary>
30 </indexterm>
31 Five years ago there were two companies from which a lesson can be learned.
32 In one case the network administrator spent three months building a new
33 network to replace an old Netware server. What he delivered had all the
34 bells and whistles he could muster. There were a few teething problems
35 during the change-over, nothing serious but a little disruptive all the
36 same. Users were exposed to many changes at once. The network
37 administrator was asked to resign two months after implementing the
38 new system. This was necessary because so many staff had complained
39 they had lost time and were not happy with the new network.
40 Everything was automated and he delivered more features than any advanced
41 user could think of. He was just too smart for his own good.
42 </para>
44 <para>
45 In the case of the other company, a new network manager was appointed
46 to oversee the replacement of a LanTastic network with an MS Windows
47 NT 4.0 network. He had the replacement installed and operational within
48 two weeks. Before installation and change-over, he called a meeting to
49 explain to all users what was going to happen, how it would affect them
50 and that he would be available 24 hours a day to help them transition.
51 One week after conversion, he held another meeting asking for cooperation
52 in the introduction of a few new features that would help to make life
53 easier. Network users were thrilled with what he was doing to help
54 them. The network he implemented was nowhere near as complex as the first example, had fewer
55 features, and yet he had happy users. Months later he was still adding
56 new innovations. He always asked the users if a
57 particular feature was what they wanted. He asked his boss for a raise
58 and got it. He often told me, <quote>Always keep a few new tricks up your
59 sleeves for when you need them.</quote> Was he smart? You decide. Let's
60 get on with our next exercise.
61 </para>
63 <sect1>
64 <title>Introduction</title>
66 <para>
67 Abmas Accounting Inc. has grown. Mr. Meany likes you and says he knew you
68 were the right person for the job. That's why he asked you to install the
69 new server. The past few months have been hard work. You advised Mr. Meany
70 that it is time for a change. Abmas now has 52 users, having acquired an
71 investment consulting business recently. The new users were added to the
72 network without any problems.
73 </para>
75 <para>
76 Some of the Windows clients are getting to be past their use-by date.
77 You have found damaged and unusable software on some of the workstations
78 that came with the acquired business and found some machines that are
79 in need of both hardware and software maintenance.
80 </para>
82 <sect2>
83 <title>Assignment Tasks</title>
85 <para>
86 <indexterm><primary>Windows XP</primary></indexterm>
87 Mr. Meany has decided to retire in 12 months. He wants you to help him
88 make the business run better. Many of the new staff want notebook computers.
89 They visit customer business premises with the need to use local network
90 facilities; these users are technically competent. The company uses a
91 business application that requires Windows XP Professional. In short, a
92 complete client upgrade is about to happen. Mr. Meany told you that he is working
93 on another business acquisition and that by the time he retires there will be
94 80 to 100 users.
95 </para>
97 <para>
98 Mr. Meany is not concerned about security. He wants to make it easier for
99 staff to do their work. He has hired you to help him appoint a full-time
100 network manager before he retires. Above all, he says he is investing in
101 the ability to grow. He is determined to live his lifelong dream and
102 hand the business over to a bright and capable executive who can make
103 things happen. This means your network design must cope well with
104 growth.
105 </para>
107 <para>
108 In a few months, Abmas will require an Internet connection for email
109 and so staff easily obtain software updates. Mr. Meany is warming up to the
110 installation of anti-virus software, but is not yet ready to approve
111 this expense. He told you to spend the money a virus scanner costs
112 on better quality notebook computers for mobile users.
113 </para>
115 <para>
116 One of Mr. Meany's golfing partners sold him on the idea to buy new laser
117 printers. One black only, the other a color laser printer. Staff support
118 the need for a color printer so they can present more attractive proposals
119 and reports.
120 </para>
122 <para>
123 Mr. Meany also asked if it would be possible for one of the staff to manage
124 user accounts from the Windows desktop. That person will be responsible for
125 basic operations.
126 </para>
128 </sect2>
129 </sect1>
131 <sect1>
132 <title>Dissection and Discussion</title>
134 <para>
135 What are the key requirements in this business example? A quick review indicates
136 a need for:
137 </para>
139 <itemizedlist>
140 <listitem><para>
141 Scalability &smbmdash; from 52 to over 100 users in 12 months
142 </para></listitem>
144 <listitem><para>
145 Mobile computing capability
146 <indexterm><primary>mobile computing</primary></indexterm>
147 </para></listitem>
149 <listitem><para>
150 Improved reliability and usability
151 </para></listitem>
153 <listitem><para>
154 Easier administration
155 </para></listitem>
156 </itemizedlist>
158 <para>
159 In this instance the installed Linux system is assumed to be a Red Hat Linux 9.0 server
160 (as in <link linkend="AccountingOffice"/>).
162 </para>
165 <sect2>
166 <title>Technical Issues</title>
168 <para>
169 <indexterm><primary>smbpasswd</primary></indexterm>
170 <indexterm><primary>DHCP</primary></indexterm>
171 <indexterm><primary>DNS</primary></indexterm>
172 <indexterm><primary>WINS</primary></indexterm>
173 <indexterm><primary>Domain</primary></indexterm>
174 It is time to implement a domain security environment. You will use the <constant>
175 smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
176 run DNS at this time, but the system will use WINS. The Domain name will be <constant>
177 BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
178 </para>
180 <para>
181 All printers will be configured as DHCP clients. The DHCP server will assign
182 the printer a fixed IP address by way of its Ethernet interface (MAC) address.
183 See <link linkend="dhcp01"/>.
184 </para>
186 <note><para>
187 The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
188 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
189 possible to start with the installation that you have created here, migrate it
190 to a Samba-3 configuration and then secure the system further. Configurations following
191 this one will utilize features that may not be supported in Samba-2.2.x releases.
192 However, you should note that the examples in each chapter start with the assumption
193 that a fresh new installation is being effected.
194 </para></note>
196 <para>
197 Later on, when the Internet connection is implemented, you will add DNS as well as
198 other enhancements. It is important that you plan accordingly.
199 </para>
201 <para>
202 <indexterm><primary>ether-switch</primary></indexterm>
203 You have split the network into two separate areas. Each has its own ether-switch.
204 There are 20 users on the accounting network and 32 users on the financial services
205 network. The server has two network interfaces, one serving each network. The
206 network printers will be located in a central area. You plan to install the new
207 printers and keep the old printer in use also.
208 </para>
210 <para>
211 You will provide separate file storage areas for each business entity. The old system
212 will go away, accounting files will be handled under a single directory, and files will
213 be stored under customer name, not under a personal work area. Staff will be made
214 responsible for file location, so maintain the old share point.
215 </para>
217 <para>
218 Given that DNS will not be used, you will configure WINS name resolution for UNIX
219 hostname name resolution.
220 </para>
222 <para>
223 <indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
224 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
225 It is necessary to map Windows Domain Groups to UNIX groups as a minimum. It is
226 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
227 key staff groups in the firm are Accounting Staff and Financial Services Staff.
228 For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
229 </para>
231 <para>
232 In the sample &smb.conf; file, you have configured Samba to call the UNIX <command>groupadd</command>
233 to add group entries. This utility does not permit the addition of group names that
234 contain upper-case characters or spaces. This is considered a bug. The <command>groupadd</command>
235 is part of the <command>shadow-utils</command> Open Source Software package.
236 A later release of this package may have been patched to resolve this bug.
237 If your operating platform has this bug, it means that attempts to add a Windows Domain
238 Group that has either a space or upper-case characters in it will fail. See <emphasis>TOSHARG</emphasis>, Section 11.3.1,
239 Example 11.1, for more information.
240 </para>
242 <para>
243 <indexterm><primary>CUPS</primary></indexterm>
244 Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler
245 on the UNIX host will be operated in <constant>raw</constant> mode.
246 </para>
248 </sect2>
250 <sect2>
251 <title>Political Issues</title>
253 <para>
254 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
255 He is willing to spend money on things he believes are of value. You need more
256 time to convince him of real priorities.
257 </para>
259 <para>
260 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
261 supplied with anti-virus software? Above all, demonstrate good purchase value and remember
262 to make your users happy.
263 </para>
265 </sect2>
267 </sect1>
269 <sect1>
270 <title>Implementation</title>
272 <para><indexterm>
273 <primary>migration</primary>
274 </indexterm>
275 In this example, the assumption is made that this server is being configured from a clean start.
276 The alternate approach could be to demonstrate the migration of the system that is documented
277 in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
278 future examples, as a new installation is based on the premise that you can determine
279 the migration steps from the information provided in the separate chapter on this subject.
280 Additionally, a fresh installation makes the example easier to follow.
281 </para>
283 <para><indexterm>
284 <primary>group membership</primary>
285 </indexterm>
286 Each user will be given a home directory on the UNIX system, which will be available as a private
287 share. Two additional shares will be created, one for the Accounting Department and the other for
288 the Financial Services Department. Network users will be given access to these shares by way
289 of group membership.
290 </para>
292 <para>
293 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
294 UNIX group membership is the primary mechanism by which Windows Domain users will be granted
295 rights and privileges within the Windows environment.
296 </para>
298 <para><indexterm>
299 <primary>sticky bit</primary>
300 </indexterm>
301 The user <command>alanm</command> will be made the owner of all files. This will be preserved
302 by setting the sticky bit (set UID/GID) on the top-level directories.
303 </para>
305 <image id="acct2net">
306 <imagedescription>Abmas Accounting &smbmdash; 52 User Network Topology</imagedescription>
307 <imagefile scale="100">acct2net</imagefile>
308 </image>
310 <procedure>
311 <step><para>
312 Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
313 </para></step>
315 <step><para>
316 <indexterm><primary>/etc/hosts</primary></indexterm>
317 Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
318 The printers are network attached, so it is desirable that there should be entries for the
319 network printers also. An example <filename>/etc/hosts</filename> file is shown here:
320 <screen>
321 192.168.1.1 sleeth sleeth1
322 192.168.2.1 sleeth2
323 192.168.1.10 hplj6
324 192.168.1.11 hplj4
325 192.168.2.10 qms
326 </screen>
327 </para></step>
329 <step><para>
330 Install the Samba-3 binary RPM from the Samba-Team FTP site.
331 </para></step>
333 <step><para>
334 Install the ISC DHCP server using the UNIX/Linux system tools available to you.
335 </para></step>
337 <step><para><indexterm>
338 <primary>/etc/rc.d/rc.local</primary>
339 </indexterm><indexterm>
340 <primary>IP forwarding</primary>
341 </indexterm><indexterm>
342 <primary>router</primary>
343 </indexterm><indexterm>
344 <primary>/proc/sys/net/ipv4/ip_forward</primary>
345 </indexterm>
346 Given that Samba will be operating over two network interfaces and clients on each side
347 may want to be able to reach clients on the other side, it is imperative that IP forwarding
348 shall be enabled. Use the system tool of your choice to enable IP forwarding. In the
349 absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
350 file an entry as follows:
351 <screen>
352 echo 1 > /proc/sys/net/ipv4/ip_forward
353 </screen>
354 This causes the Linux kernel to forward IP packets so that it acts as a router.
355 </para></step>
357 <step><para>
358 Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and
359 <link linkend="acct3conf"/>. Combine these two examples to form a single
360 <filename>/etc/samba/smb.conf</filename> file.
361 </para></step>
363 <step><para><indexterm>
364 <primary>smbpasswd</primary>
365 </indexterm>
366 Add the user <command>root</command> to the Samba password backend:
367 <screen>
368 &rootprompt; smbpasswd -a root
369 New SMB password: XXXXXXX
370 Retype new SMB password: XXXXXXX
371 &rootprompt;
372 </screen>
373 <indexterm><primary>administrator</primary></indexterm>
374 This is the Windows Domain Administrator password. Never delete this account from
375 the password backend after Windows Domain Groups have been initialized. If you delete
376 this account, your system is crippled. You cannot restore this account
377 and your Samba server is no longer capable of being administered.
378 </para></step>
380 <step><para>
381 <indexterm><primary>username map</primary></indexterm>
382 Create the username map file to permit the <constant>root</constant> account to be called
383 <constant>Administrator</constant> from the Windows network environment. To do this, create
384 the file <filename>/etc/samba/smbusers</filename> with the following contents:
385 <screen>
386 ####
387 # User mapping file
388 ####
389 # File Format
390 # -----------
391 # Unix_ID = Windows_ID
392 #
393 # Examples:
394 # root = Administrator
395 # janes = "Jane Smith"
396 # jimbo = Jim Bones
397 #
398 # Note: If the name contains a space it must be double quoted.
399 # In the example above the name 'jimbo' will be mapped to Windows
400 # user names 'Jim' and 'Bones' because the space was not quoted.
401 #######################################################################
402 root = Administrator
403 ####
404 # End of File
405 ####
406 </screen>
407 </para></step>
409 <step><para>
410 <indexterm><primary>initGrps.sh</primary></indexterm>
411 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
412 <link linkend="initGrps"/>. Create a file containing this script. We called ours
413 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
414 and then execute the script. Sample output should be as follows:
416 <example id="initGrps">
417 <title>Script to Map Windows NT Groups to UNIX Groups</title>
418 <indexterm><primary>initGrps.sh</primary></indexterm>
419 <screen>
420 #!/bin/bash
421 #
422 # initGrps.sh
423 #
425 # Create UNIX groups
426 groupadd acctsdep
427 groupadd finsrvcs
429 # Map Windows Domain Groups to UNIX groups
430 net groupmap modify ntgroup="Domain Admins" unixgroup=root
431 net groupmap modify ntgroup="Domain Users" unixgroup=users
432 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
434 # Add Functional Domain Groups
435 net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
436 net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
438 # Map Windows NT machine local groups to local UNIX groups
439 net groupmap modify ntgroup="Administrators" unixgroup=sys
440 net groupmap modify ntgroup="Users" unixgroup=public
441 net groupmap modify ntgroup="Guests" unixgroup=nobody
442 net groupmap modify ntgroup="System Operators" unixgroup=daemon
443 net groupmap modify ntgroup="Account Operators" unixgroup=wheel
444 net groupmap modify ntgroup="Backup Operators" unixgroup=bin
445 net groupmap modify ntgroup="Print Operators" unixgroup=lp
446 net groupmap modify ntgroup="Replicators" unixgroup=kmem
447 net groupmap modify ntgroup="Power Users" unixgroup=ntadmin
448 </screen>
449 </example>
451 <screen>
452 &rootprompt; chmod 755 initGrps.sh
453 &rootprompt; /etc/samba # ./initGrps.sh
454 Updated mapping entry for Domain Admins
455 Updated mapping entry for Domain Users
456 Updated mapping entry for Domain Guests
457 No rid or sid specified, choosing algorithmic mapping
458 Successfully added group Accounts Dept to the mapping db
459 No rid or sid specified, choosing algorithmic mapping
460 Successfully added group Domain Guests to the mapping db
461 Updated mapping entry for Administrators
462 Updated mapping entry for Users
463 Updated mapping entry for Guests
464 Updated mapping entry for System Operators
465 Updated mapping entry for Account Operators
466 Updated mapping entry for Backup Operators
467 Updated mapping entry for Print Operators
468 Updated mapping entry for Replicators
469 Updated mapping entry for Power Users
471 &rootprompt; /etc/samba # net groupmap list | sort
472 Account Operators (S-1-5-32-548) -> wheel
473 Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
474 Administrators (S-1-5-32-544) -> sys
475 Backup Operators (S-1-5-32-551) -> bin
476 Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
477 Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
478 Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
479 Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
480 Guests (S-1-5-32-546) -> nobody
481 Power Users (S-1-5-32-547) -> ntadmin
482 Print Operators (S-1-5-32-550) -> lp
483 Replicators (S-1-5-32-552) -> kmem
484 System Operators (S-1-5-32-549) -> daemon
485 Users (S-1-5-32-545) -> public
486 </screen>
487 </para></step>
489 <step><para>
490 <indexterm><primary>/etc/passwd</primary></indexterm>
491 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
492 <indexterm><primary>smbpasswd</primary></indexterm>
493 For each user who needs to be given a Windows Domain account, make an entry in the
494 <filename>/etc/passwd</filename> file as well as in the Samba password backend.
495 Use the system tool of your choice to create the UNIX system accounts and use the Samba
496 <command>smbpasswd</command> program to create the Domain user accounts.
497 </para>
499 <para>
500 <indexterm><primary>useradd</primary></indexterm>
501 <indexterm><primary>adduser</primary></indexterm>
502 <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
503 There are a number of tools for user management under UNIX. Commonly known ones include:
504 <command>useradd</command>, <command>adduser</command>. In addition to these, there are a plethora of custom
505 tools. With the tool of your choice, create a home directory for each user.
506 </para></step>
508 <step><para>
509 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
510 previously as necessary. File system access control will be based on UNIX group membership.
511 </para></step>
513 <step><para>
514 Create the directory mount point for the disk sub-system that is mounted to provide
515 data storage for company files. In this case the mount point indicated in the &smb.conf;
516 file is <filename>/data</filename>. Format the file system as required, mount the formatted
517 file system partition using <command>mount</command>,
518 and make the appropriate changes in <filename>/etc/fstab</filename>.
519 </para></step>
521 <step><para>
522 Create the top-level file storage directories are follows:
523 <screen>
524 &rootprompt; mkdir -p /data/{accounts,finsvcs}
525 &rootprompt; chown -R root.root /data
526 &rootprompt; chown -R alanm.accounts /data/accounts
527 &rootprompt; chown -R alanm.finsvcs /data/finsvcs
528 &rootprompt; chmod -R ug+rwx,o+rx-w /data
529 </screen>
530 Each department is responsible for creating its own directory structure within its
531 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
532 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
533 </para></step>
535 <step><para>
536 Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
537 Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
538 This allows the CUPS spooler to print using raw mode protocols.
539 <indexterm><primary>CUPS</primary></indexterm>
540 <indexterm><primary>raw printing</primary></indexterm>
541 </para></step>
543 <step><para>
544 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm><indexterm>
545 <primary>lpadmin</primary>
546 </indexterm>
547 Configure the CUPS Print Queues as follows:
548 <screen>
549 &rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
550 &rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
551 &rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
552 </screen>
553 <indexterm><primary>print filter</primary></indexterm>
554 This creates the necessary print queues with no assigned print filter.
555 </para></step>
557 <step><para>
558 <indexterm><primary>mime type</primary></indexterm>
559 <indexterm><primary>/etc/mime.convs</primary></indexterm>
560 <indexterm><primary>application/octet-stream</primary></indexterm>
561 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
562 <screen>
563 application/octet-stream application/vnd.cups-raw 0 -
564 </screen>
565 </para></step>
567 <step><para>
568 <indexterm><primary>/etc/mime.types</primary></indexterm>
569 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
570 <screen>
571 application/octet-stream
572 </screen>
573 </para></step>
575 <step><para><indexterm>
576 <primary>DHCP Server</primary>
577 </indexterm>
578 Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
579 contents as shown in <link linkend="dhcp01"/>.
580 <example id="dhcp01">
581 <title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
582 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
583 <screen>
584 default-lease-time 86400;
585 max-lease-time 172800;
586 default-lease-time 86400;
588 option ntp-servers 192.168.1.1;
589 option domain-name "abmas.biz";
590 option domain-name-servers 192.168.1.1, 192.168.2.1;
591 option netbios-name-servers 192.168.1.1, 192.168.2.1;
592 option netbios-node-type 8;
593 ### NOTE ###
594 # netbios-node-type=8 means set clients to Hybrid Mode
595 # so they will use Unicast communication with the WINS
596 # server and thus reduce the level of UDP broadcast
597 # traffic by up to 90%.
598 ############
600 subnet 192.168.1.0 netmask 255.255.255.0 {
601 range dynamic-bootp 192.168.1.128 192.168.1.254;
602 option subnet-mask 255.255.255.0;
603 option routers 192.168.1.1;
604 allow unknown-clients;
605 host hplj4 {
606 hardware ethernet 08:00:46:7a:35:e4;
607 fixed-address 192.168.1.10;
608 }
609 host hplj6 {
610 hardware ethernet 00:03:47:cb:81:e0;
611 fixed-address 192.168.1.11;
612 }
613 }
614 subnet 192.168.2.0 netmask 255.255.255.0 {
615 range dynamic-bootp 192.168.2.128 192.168.2.254;
616 option subnet-mask 255.255.255.0;
617 option routers 192.168.2.1;
618 allow unknown-clients;
619 host qms {
620 hardware ethernet 01:04:31:db:e1:c0;
621 fixed-address 192.168.1.10;
622 }
623 }
624 subnet 127.0.0.0 netmask 255.0.0.0 {
625 }
626 </screen>
627 </example>
628 </para></step>
631 <step><para>
632 Use the standard system tool to start Samba and CUPS and configure them to start
633 automatically at every system reboot. For example:
634 </para>
636 <para>
637 <indexterm><primary>chkconfig</primary></indexterm>
638 <indexterm><primary>starting dhcpd</primary></indexterm>
639 <indexterm><primary>starting samba</primary></indexterm>
640 <indexterm><primary>starting CUPS</primary></indexterm><indexterm>
641 <primary>chkconfig</primary>
642 </indexterm>
643 <screen>
644 &rootprompt; chkconfig dhpc on
645 &rootprompt; chkconfig smb on
646 &rootprompt; chkconfig cups on
647 &rootprompt; /etc/rc.d/init.d/dhcp restart
648 &rootprompt; /etc/rc.d/init.d/smb restart
649 &rootprompt; /etc/rc.d/init.d/cups restart
650 </screen>
651 </para></step>
653 <step><para>
654 <indexterm><primary>Name Service Switch</primary></indexterm>
655 <indexterm><primary>NSS</primary><see>Name Service Switch</see></indexterm>
656 <indexterm><primary>DNS</primary></indexterm><indexterm>
657 <primary>DNS server</primary>
658 </indexterm>
659 <indexterm><primary>WINS</primary></indexterm>
660 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
661 Configure the Name Service Switch (NSS) to handle WINS based name resolution.
662 Since this system does not use a DNS server, it is safe to remove this option from
663 the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
664 the <constant>hosts:</constant> entry looks like this:
665 <screen>
666 hosts: files wins
667 </screen>
668 </para></step>
670 </procedure>
672 <smbconfexample id="acct2conf">
673 <title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
674 <smbconfcomment>Global parameters</smbconfcomment>
675 <smbconfsection>[global]</smbconfsection>
676 <smbconfoption><name>workgroup</name><value>BILLMORE</value></smbconfoption>
677 <smbconfoption><name>passwd chat</name><value>*New*Password* \</value></smbconfoption>
678 <member><parameter>%n\n*Re-enter*new*password* %n\n *Password*changed*</parameter></member>
679 <smbconfoption><name>username map</name><value>/etc/samba/smbusers</value></smbconfoption>
680 <smbconfoption><name>syslog</name><value>0</value></smbconfoption>
681 <smbconfoption><name>name resolve order</name><value>wins bcast hosts</value></smbconfoption>
682 <smbconfoption><name>printcap name</name><value>CUPS</value></smbconfoption>
683 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
684 <smbconfoption><name>add user script</name><value>/usr/sbin/useradd -m %u</value></smbconfoption>
685 <smbconfoption><name>delete user script</name><value>/usr/sbin/userdel -r %u</value></smbconfoption>
686 <smbconfoption><name>add group script</name><value>/usr/sbin/groupadd %g</value></smbconfoption>
687 <smbconfoption><name>delete group script</name><value>/usr/sbin/groupdel %g</value></smbconfoption>
688 <smbconfoption><name>add user to group script</name><value>/usr/sbin/usermod -G %g %u</value></smbconfoption>
689 <smbconfoption><name>add machine script</name><value>/usr/sbin/useradd \</value></smbconfoption>
690 <member><parameter>-s /bin/false -d /dev/null %u</parameter></member>
691 <smbconfoption><name>logon script</name><value>scripts\login.bat</value></smbconfoption>
692 <smbconfoption><name>logon path</name><value> </value></smbconfoption>
693 <smbconfoption><name>logon drive</name><value>X:</value></smbconfoption>
694 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
695 <smbconfoption><name>preferred master</name><value>Yes</value></smbconfoption>
696 <smbconfoption><name>wins support</name><value>Yes</value></smbconfoption>
697 <smbconfoption><name>printing</name><value>CUPS</value></smbconfoption>
698 </smbconfexample>
700 <smbconfexample id="acct3conf">
701 <title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
702 <smbconfsection>[homes]</smbconfsection>
703 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
704 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
705 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
706 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
708 <smbconfsection>[printers]</smbconfsection>
709 <smbconfoption><name>comment</name><value>SMB Print Spool</value></smbconfoption>
710 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
711 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
712 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
713 <smbconfoption><name>use client driver</name><value>Yes</value></smbconfoption>
714 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
716 <smbconfsection>[netlogon]</smbconfsection>
717 <smbconfoption><name>comment</name><value>Network Logon Service</value></smbconfoption>
718 <smbconfoption><name>path</name><value>/data/%U</value></smbconfoption>
719 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
720 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
722 <smbconfsection>[accounts]</smbconfsection>
723 <smbconfoption><name>comment</name><value>Accounting Files</value></smbconfoption>
724 <smbconfoption><name>path</name><value>/data/accounts</value></smbconfoption>
725 <smbconfoption><name>valid users</name><value>%G</value></smbconfoption>
726 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
728 <smbconfsection>[finsvcs]</smbconfsection>
729 <smbconfoption><name>comment</name><value>Financial Service Files</value></smbconfoption>
730 <smbconfoption><name>path</name><value>/data/finsvcs</value></smbconfoption>
731 <smbconfoption><name>valid users</name><value>%G</value></smbconfoption>
732 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
733 </smbconfexample>
735 <sect2>
736 <title>Validation</title>
738 <para>
739 Does everything function as it ought? That is the key question at this point.
740 Here are some simple steps to validate your Samba server configuration.
741 </para>
743 <procedure>
745 <step><para><indexterm>
746 <primary>testparm</primary>
747 </indexterm>
748 If your &smb.conf; file has bogus options or parameters, this may cause Samba
749 to refuse to start. The first step should always be to validate the contents
750 of this file by running:
751 <screen>
752 &rootprompt; testparm -s
753 Load smb config files from smb.conf
754 Processing section "[homes]"
755 Processing section "[printers]"
756 Processing section "[netlogon]"
757 Processing section "[accounts]"
758 Processing section "[service]"
759 Loaded services file OK.
760 # Global parameters
761 [global]
762 workgroup = BILLMORE
763 passwd chat = *New*Password* \
764 %n\n *Re-enter*new*password* %n\n *Password*changed*
765 username map = /etc/samba/smbusers
766 syslog = 0
767 name resolve order = wins bcast hosts
768 printcap name = CUPS
769 show add printer wizard = No
770 add user script = /usr/sbin/useradd -m %u
771 delete user script = /usr/sbin/userdel -r %u
772 add group script = /usr/sbin/groupadd %g
773 delete group script = /usr/sbin/groupdel %g
774 add user to group script = /usr/sbin/usermod -G %g %u
775 add machine script = /usr/sbin/useradd
776 -s /bin/false -d /dev/null %u
777 logon script = scripts\logon.bat
778 logon path =
779 logon drive = X:
780 domain logons = Yes
781 preferred master = Yes
782 wins support = Yes
783 printing = cups
784 ...
785 ### Remainder cut to save space ###
786 </screen>
787 The inclusion of an invalid parameter (say one called dogbert) would generate an
788 error as follows:
789 <screen>
790 Unknown parameter encountered: "dogbert"
791 Ignoring unknown parameter "dogbert"
792 </screen>
793 Clear away all errors before proceeding and start or restart samba as necessary.
794 </para></step>
796 <step><para>
797 <indexterm><primary>check samba
798 daemons</primary></indexterm><indexterm>
799 <primary>nmbd</primary>
800 </indexterm><indexterm>
801 <primary>smbd</primary>
802 </indexterm><indexterm>
803 <primary>winbindd</primary>
804 </indexterm>
805 Check that the Samba server is running:
806 <screen>
807 &rootprompt; ps ax | grep mbd
808 14244 ? S 0:00 /usr/sbin/nmbd -D
809 14245 ? S 0:00 /usr/sbin/nmbd -D
810 14290 ? S 0:00 /usr/sbin/smbd -D
812 $rootprompt; ps ax | grep winbind
813 14293 ? S 0:00 /usr/sbin/winbindd -B
814 14295 ? S 0:00 /usr/sbin/winbindd -B
815 </screen>
816 The <command>winbindd</command> daemon is running in split mode (normal) so there are also
817 two instances of it. For more information regarding winbindd, see <emphasis>TOSHARG</emphasis>, Chapter 20,
818 Section 20.3. The single instance of <command>smbd</command> is normal.
819 </para></step>
821 <step><para>
822 <indexterm><primary>anonymous connection</primary></indexterm>
823 Check that an anonymous connection can be made to the Samba server:
824 <screen>
825 &rootprompt; smbclient -L localhost -U%
827 Sharename Type Comment
828 --------- ---- -------
829 netlogon Disk Network Logon Service
830 accounts Disk Accounting Files
831 finsvcs Disk Financial Service Files
832 IPC$ IPC IPC Service (Samba3)
833 ADMIN$ IPC IPC Service (Samba3)
834 hplj4 Printer Hewlett-Packard LaserJet 4
835 hplj6 Printer Hewlett-Packard LaserJet 6
836 qms Printer QMS Magicolor Laser Printer XXXX
838 Server Comment
839 --------- -------
840 SLEETH Samba 3.0.2
842 Workgroup Master
843 --------- -------
844 BILLMORE SLEETH
845 </screen>
846 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
847 of browsing the server from a Windows client to obtain a list of shares on the server.
848 The <constant>-U%</constant> argument means, send a "<constant>NULL</constant> username and
849 a <constant>NULL</constant> password."
850 </para></step>
852 <step><para>
853 <indexterm><primary>dhcp client validation</primary></indexterm>
854 <indexterm><primary>printer
855 validation</primary></indexterm><indexterm>
856 <primary>/etc/dhcpd.conf</primary>
857 </indexterm>
858 Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
859 The easiest way to do this is to ping the printer name. Immediately after the ping response
860 has been received, execute <command>arp -a</command> to find the MAC address of the printer
861 that has responded. Now you can compare the IP address and the MAC address of the printer
862 with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
863 should, of course, match. For example:
864 <screen>
865 &rootprompt; ping hplj4
866 PING hplj4 (192.168.1.11) 56(84) bytes of data.
867 64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
869 &rootprompt; arp -a
870 hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
871 </screen>
872 The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
873 IP address from which the printer has responded and with the entry for it in the
874 <filename>/etc/dhcpd.conf</filename> file.
875 </para></step>
877 <step><para>
878 <indexterm><primary>authenticated connection</primary></indexterm>
879 Make an authenticated connection to the server using the <command>smbclient</command> tool:
880 <screen>
881 &rootprompt; smbclient //sleeth/accounts -U alanm
882 Password: XXXXXXX
883 smb: \> dir
884 . D 0 Sun Nov 9 01:28:34 2003
885 .. D 0 Sat Aug 16 17:24:26 2003
886 .mc DH 0 Sat Nov 8 21:57:38 2003
887 .qt DH 0 Fri Sep 5 00:48:25 2003
888 SMB D 0 Sun Oct 19 23:04:30 2003
889 Documents D 0 Sat Nov 1 00:31:51 2003
890 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
892 65387 blocks of size 65536. 28590 blocks available
893 smb: \> q
894 </screen>
895 </para></step>
897 </procedure>
899 </sect2>
902 <procedure>
903 <title>Windows XP Professional Client Configuration</title>
905 <step><para>
906 Configure clients to the network settings shown in <link linkend="acct2net"/>.
907 All clients use DHCP for TCP/IP protocol stack configuration.
908 <indexterm><primary>WINS</primary></indexterm>
909 <indexterm><primary>DHCP</primary></indexterm>
910 DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
911 </para></step>
913 <step><para>
914 Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
915 user name <constant>root</constant> and the SMB password you assigned to this account.
916 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
917 a Windows Domain is given in <link linkend="domjoin"/>.
918 Reboot the machine as prompted and then logon using a Domain User account.
919 </para></step>
921 <step><para>
922 Verify on each client that the machine called <constant>SLEETH</constant>
923 is visible in <guimenu>My Network Places</guimenu>, that it is
924 possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
925 and <guimenuitem>finsvcs</guimenuitem>,
926 and that it is possible to open that share to reveal its contents.
927 </para></step>
929 <step><para>
930 Instruct all users to log onto the workstation using their assigned user name and password.
931 </para></step>
933 <step><para>
934 Install a printer on each using the following steps:
936 <procedure>
937 <step><para>
938 Click <menuchoice>
939 <guimenu>Start</guimenu>
940 <guimenuitem>Settings</guimenuitem>
941 <guimenuitem>Printers</guimenuitem>
942 <guiicon>Add Printer</guiicon>
943 <guibutton>Next</guibutton>
944 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
945 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
946 </para></step>
948 <step><para>
949 Click <guibutton>Next</guibutton>. In the panel labeled
950 <guimenuitem>Manufacturer:</guimenuitem>, select <constant>HP</constant>.
951 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
952 <constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
953 </para></step>
955 <step><para>
956 In the panel labeled <guimenuitem>Available ports:</guimenuitem>, select
957 <constant>FILE:</constant>. Accept the default printer name by clicking
958 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
959 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
960 <guibutton>Finish</guibutton>.
961 </para></step>
963 <step><para>
964 You may be prompted for the name of a file to print to. If so, close the
965 dialog panel. Right-click <menuchoice>
966 <guiicon>HP LaserJet 4</guiicon>
967 <guimenuitem>Properties</guimenuitem>
968 <guimenusub>Details (Tab)</guimenusub>
969 <guimenubutton>Add Port</guimenubutton>
970 </menuchoice>.
971 </para></step>
973 <step><para>
974 In the panel labeled <guimenuitem>Network</guimenuitem>, enter the name of
975 the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
976 Click <menuchoice>
977 <guibutton>OK</guibutton>
978 <guibutton>OK</guibutton>
979 </menuchoice> to complete the installation.
980 </para></step>
982 <step><para>
983 Repeat the printer installation steps above for the HP LaserJet 6 printer
984 as well as for the QMS Magicolor XXXX laser printer.
985 </para></step>
986 </procedure>
987 </para></step>
988 </procedure>
990 <sect2>
991 <title>Notebook Computers: A Special Case</title>
993 <para>
994 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
995 Professional systems. This is the preferred solution to provide continuity of work for notebook users
996 so that absence from the office network environment does not become a barrier to productivity.
997 </para>
999 <para>
1000 By creating a local machine account that has the same user name and password as you create for that
1001 user in the Windows Domain environment, the user can log onto the machine locally and still
1002 transparently access network resources as if logged onto the domain itself. There are some trade-offs
1003 that mean that as the network is more tightly secured it becomes necessary to modify Windows client
1004 configuration somewhat.
1005 </para>
1007 </sect2>
1009 <sect2>
1010 <title>Key Points Learned</title>
1012 <para>
1013 In this network design and implementation exercise, you have created a Windows NT4 style Domain
1014 Controller using Samba-3.0.2. As a result of following these guidelines meant that you experienced
1015 and implemented several important aspects of Windows networking. In the next chapter of this book,
1016 you build on the experience gained. These are the highlights from this chapter:
1017 </para>
1019 <itemizedlist>
1020 <listitem><para>
1021 <indexterm><primary>DHCP</primary></indexterm>
1022 You implemented a DHCP Server and Microsoft Windows clients were able to obtain all necessary
1023 network configuration settings from this server.
1024 </para></listitem>
1026 <listitem><para>
1027 <indexterm><primary>Domain Controller</primary></indexterm>
1028 You created a Windows Domain Controller. You were able to use the network logon service
1029 and successfully joined Windows 200x/XP Professional clients to the Domain.
1030 </para></listitem>
1032 <listitem><para>
1033 <indexterm><primary>CUPS</primary></indexterm>
1034 You created raw print queues in the CUPS printing system. You maintained a simple
1035 printing system so that all users can share centrally managed printers. You installed
1036 native printer drivers on the Windows clients.
1037 </para></listitem>
1039 <listitem><para>
1040 You experienced the benefits of centrally managed user accounts on the server.
1041 </para></listitem>
1043 <listitem><para>
1044 You offered Mobile notebook users a solution that allows them to continue to work
1045 while away from the office and not connected to the corporate network.
1046 </para></listitem>
1047 </itemizedlist>
1049 </sect2>
1051 </sect1>
1053 <sect1>
1054 <title>Questions and Answers</title>
1056 <para>
1057 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
1058 may help.
1059 </para>
1061 <qandaset defaultlabel="chap03qa" type="number">
1062 <qandaentry>
1063 <question>
1065 <para>
1066 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
1067 </para>
1069 </question>
1070 <answer>
1072 <para>
1073 First and foremost, portability. It means that notebook users can move between
1074 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
1075 reconfigure their machines. It also means that when they work from their home environments
1076 either using DHCP assigned addressing or when using dial-up networking, settings such as
1077 default routes and DNS server addresses that apply only to the Abmas office environment do
1078 not interfere with remote operations. This is an extremely important feature of DHCP.
1079 </para>
1081 </answer>
1082 </qandaentry>
1084 <qandaentry>
1085 <question>
1087 <para>
1088 Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
1089 that should be noted in particular?
1090 </para>
1092 </question>
1093 <answer>
1095 <para>
1096 Yes. The configuration you created automatically provides each client with the IP address
1097 of your WINS server. It also configures the client to preferentially register NetBIOS names
1098 with the WINS server, and then instructs the client to first query the WINS server when a
1099 NetBIOS machine name needs to be resolved to an IP Address. This means that this configuration
1100 results in far lower UDP broadcast traffic than would be the case if WINS was not used.
1101 </para>
1103 </answer>
1104 </qandaentry>
1106 <qandaentry>
1107 <question>
1109 <para>
1110 Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
1111 </para>
1113 </question>
1114 <answer>
1116 <para>
1117 You can surely create a Windows Domain Account called <constant>Administrator</constant>. It is also
1118 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
1119 necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
1120 account called <constant>root</constant>.
1121 </para>
1123 </answer>
1124 </qandaentry>
1126 <qandaentry>
1127 <question>
1129 <para>
1130 Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
1131 </para>
1133 </question>
1134 <answer>
1136 <para>
1137 The Windows Domain <constant>Administrator</constant> account is the most privileged account that
1138 exists on the Windows platform. This user can change any setting, add/delete or modify user
1139 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
1140 environment is the <constant>root</constant> account. If you want to permit the Windows Domain
1141 Administrator to manage accounts, as well as permissions, privileges, and security
1142 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
1143 achieved with the <constant>root</constant> UID equal to 0.
1144 </para>
1146 </answer>
1147 </qandaentry>
1149 <qandaentry>
1150 <question>
1152 <para>
1153 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
1154 <constant>root</constant> access. How can we do this?
1155 </para>
1157 </question>
1158 <answer>
1160 <para>
1161 Users who are members of the <constant>Domain Admins</constant> group can add machines to the
1162 Domain. This group is mapped to the UNIX group account called <constant>root</constant>
1163 (or equivalent on <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
1164 This must be the primary GID of the account of the user who is a member of the Windows <constant>
1165 Domain Admins</constant> account.
1166 </para>
1168 </answer>
1169 </qandaentry>
1171 <qandaentry>
1172 <question>
1174 <para>
1175 Why must I map Windows Domain Groups to UNIX groups?
1176 </para>
1178 </question>
1179 <answer>
1181 <para>
1182 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
1183 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are:
1184 <guimenu>Domain Guests, Domain Users, Domain Admins</guimenu>.
1185 </para>
1187 </answer>
1188 </qandaentry>
1190 <qandaentry>
1191 <question>
1193 <para>
1194 I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
1195 </para>
1197 </question>
1198 <answer>
1200 <para>
1201 This is a nasty problem. Fortunately, here is a solution.
1202 </para>
1204 <procedure>
1205 <step><para>
1206 Back up your existing configuration files in case you need to restore them.
1207 </para></step>
1209 <step><para>
1210 Rename the <filename>group_mapping.tdb</filename> file.
1211 </para></step>
1213 <step><para>
1214 Use the <command>smbpasswd</command> to add the root account.
1215 </para></step>
1217 <step><para>
1218 Restore the <filename>group_mapping.tdb</filename> file.
1219 </para></step>
1220 </procedure>
1222 </answer>
1223 </qandaentry>
1225 <qandaentry>
1226 <question>
1228 <para>
1229 When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
1230 as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
1231 </para>
1233 </question>
1234 <answer>
1236 <para>
1237 The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
1238 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
1239 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
1240 may change at some later date. These accounts are provided only so that security objects are correctly shown.
1241 </para>
1243 </answer>
1244 </qandaentry>
1246 <qandaentry>
1247 <question>
1249 <para>
1250 What is the effect of changing the name of a Samba server, or of changing the Domain name?
1251 </para>
1253 </question>
1254 <answer>
1256 <para>
1257 In the event that you elect to change the name of the Samba server, on restarting <command>smbd</command>,
1258 Windows security identifiers are changed. In the case of a Stand-Alone server or a Domain Member server,
1259 the machine SID is changed. This may break Domain Membership. In the case of a change of the Domain name
1260 (Workgroup name), the Domain SID is changed. This affects all Domain Memberships.
1261 </para>
1263 <para>
1264 If it becomes necessary to change either the Server name or the Domain name, be sure to back up the respective
1265 SID before the change is made. You can back up the SID from use of the <command>net getlocalsid</command> (Samba-3),
1266 or by way of the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
1267 to check the man page for this command for detailed instructions regarding the steps involved.
1268 </para>
1270 </answer>
1271 </qandaentry>
1273 <qandaentry>
1274 <question>
1276 <para>
1277 How can I manage user accounts from my Windows XP Professional workstation?
1278 </para>
1280 </question>
1281 <answer>
1283 <para>
1284 Samba-3 implements a Windows NT4 style security domain architecture. This type of Domain cannot
1285 be managed using tools present on a Windows XP Professional installation. You may download from the
1286 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
1287 it. This package extracts the tools known as: <command>User Manager for Domains, Server Manager, Event
1288 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
1289 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
1290 for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
1291 </para>
1293 </answer>
1294 </qandaentry>
1296 </qandaset>
1298 </sect1>
1300 </chapter>