| blob | d9f83914e297732861188ea9dbaa60bbcfed4083 |
1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.70.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2562011">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2562063">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2562312">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2562328">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2562770">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2562810">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2563723">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2568471">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2568533">Questions and Answers</a></span></dt></dl></div><p>
2 Congratulations, your Samba networking skills are developing nicely. You started out
3 with three simple networks in <a href="simple.html" title="Chapter 1. No-Frills Samba Servers">???</a>, and then in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>
4 you designed and built a network that provides a high degree of flexibility, integrity,
5 and dependability. It was enough for the basic needs each was designed to fulfill. In
6 this chapter you address a more complex set of needs. The solution you explore
7 introduces you to basic features that are specific to Samba-3.
8 </p><p>
9 You should note that a working and secure solution could be implemented using Samba-2.2.x.
10 In the exercises presented here, you are gradually using more Samba-3-specific features,
11 so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given.
12 To avoid confusion, this book is all about Samba-3. Let's get the exercises in this
13 chapter underway.
14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2562011"></a>Introduction</h2></div></div></div><p>
15 You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work
16 well done. It is one year since the last network upgrade. You have been quite busy.
17 Two months ago Mr. Meany gave approval to hire Christine Roberson, who has taken over
18 general network management. Soon she will provide primary user support. You have
19 demonstrated that you can delegate responsibility and can plan and execute according
20 to that plan. Above all, you have shown Mr. Meany that you are a responsible person.
21 Today is a big day. Mr. Meany called you to his office at 9 a.m. for news you never
22 expected: You are going to take charge of business operations. Mr. Meany
23 is retiring and has entrusted the business to your capable hands.
24 </p><p>
25 Mr. Meany may be retiring from this company, but not from work. He is taking the
26 opportunity to develop Abmas Accounting into a larger and more substantial company.
27 He says that it took him many years to learn that there is no future in just running
28 a business. He now realizes there is great personal satisfaction in the creation of
29 career opportunities for people in the local community. He wants to do more for others,
30 as he is doing for you. Today he spent a lot of time talking about his grand plan
31 for growth, which you will deal with in the chapters ahead.
32 </p><p>
33 Over the past year, the growth projections were exceeded. The network has grown to
34 meet the needs of 130 users. Along with growth, the demand for improved services
35 and better functionality has also developed. You are about to make an interim
36 improvement and then hand over all Help desk and network maintenance to Christine.
37 Christine has professional certifications in Microsoft Windows as well as in Linux;
38 she is a hard worker and quite likable. Christine does not want to manage the department
39 (although she manages well). She gains job satisfaction when left to sort things out.
40 Occasionally she wants to work with you on a challenging problem. When you told her
41 about your move, she almost resigned, although she was reassured that a new manager would
42 be hired to run Information Technology, and she would be responsible only for operations.
43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2562063"></a>Assignment Tasks</h3></div></div></div><p>
44 You promised the staff Internet services including Web browsing, electronic mail, virus
45 protection, and a company Web site. Christine is eager to help turn the vision into
46 reality. Let's see how close you can get to the promises made.
47 </p><p>
48 The network you are about to deliver will service 130 users today. Within a year,
49 Abmas will aquire another company. Mr. Meany claims that within 2 years there will be
50 well over 500 users on the network. You have bought into the big picture, so prepare
51 for growth. You have purchased a new server and will implement a new network infrastructure.
52 </p><p>
53 You have decided to not recycle old network components. The only items that will be
54 carried forward are notebook computers. You offered staff new notebooks, but not
55 one person wanted the disruption for what was perceived as a marginal update.
56 You decided to give everyone, even the notebook user, a new desktop computer.
57 </p><p>
58 You procured a DSL Internet connection that provides 1.5 Mb/sec (bidirectional)
59 and a 10 Mb/sec ethernet port. You registered the domain
61 secondary DNS. Information furnished by your ISP is shown in <a href="secure.html#chap4netid" title="Table 3.1. Abmas.US ISP Information">???</a>.
62 </p><p>
63 It is of paramount priority that under no circumstances will Samba offer
64 service access from an Internet connection. You are paying an ISP to
65 give, as part of its value-added services, full firewall protection for your
66 connection to the outside world. The only services allowed in from
69 will be allowed out after network address translation (NAT). No internal IP addresses
70 are permitted through the NAT filter because complete privacy of internal network
71 operations must be assured.
72 </p><div class="table"><a name="chap4netid"></a><p class="title"><b>Table 3.1. Abmas.US ISP Information</b></p><div class="table-contents"><table summary="Abmas.US ISP Information" border="1"><colgroup><col align="left"><col align="center"></colgroup><thead><tr><th align="left">Parameter</th><th align="center">Value</th></tr></thead><tbody><tr><td align="left">Server IP Address</td><td align="center">123.45.67.66</td></tr><tr><td align="left">DSL Device IP Address</td><td align="center">123.45.67.65</td></tr><tr><td align="left">Network Address</td><td align="center">123.45.67.64/30</td></tr><tr><td align="left">Gateway Address</td><td align="center">123.45.54.65</td></tr><tr><td align="left">Primary DNS Server</td><td align="center">123.45.54.65</td></tr><tr><td align="left">Secondary DNS Server</td><td align="center">123.45.54.32</td></tr><tr><td align="left">Forwarding DNS Server</td><td align="center">123.45.12.23</td></tr></tbody></table></div></div><br class="table-break"><div class="figure"><a name="ch04net"></a><p class="title"><b>Figure 3.1. Abmas Network Topology 130 Users</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap4-net.png" width="351" alt="Abmas Network Topology 130 Users"></div></div></div><br class="figure-break"><p>
73 Christine recommended that desktop systems should be installed from a single cloned
74 master system that has a minimum of locally installed software and loads all software
75 off a central application server. The benefit of having the central application server
76 is that it allows single-point maintenance of all business applications, a more
77 efficient way to manage software. She further recommended installation of antivirus
78 software on workstations as well as on the Samba server. Christine knows the dangers
79 of potential virus infection and insists on a comprehensive approach to detective
80 as well as corrective action to protect network operations.
81 </p><p>
82 A significant concern is the problem of managing company growth. Recently, a number
83 of users had to share a PC while waiting for new machines to arrive. This presented
84 some problems with desktop computers and software installation into the new users'
85 desktop profiles.
86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2562312"></a>Dissection and Discussion</h2></div></div></div><p>
87 Many of the conclusions you draw here are obvious. Some requirements are not very clear
88 or may simply be your means of drawing the most out of Samba-3. Much can be done more simply
89 than you will demonstrate here, but keep in mind that the network must scale to at least 500
90 users. This means that some functionality will be overdesigned for the current 130-user
91 environment.
92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2562328"></a>Technical Issues</h3></div></div></div><p>
93 In this exercise we use a 24-bit subnet mask for the two local networks. This,
94 of course, limits our network to a maximum of 253 usable IP addresses. The network
95 address range chosen is one assigned by RFC1918 for private networks.
96 When the number of users on the network begins to approach the limit of usable
97 addresses, it is a good idea to switch to a network address specified in RFC1918
99 </p><p>
102 The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code>
103 passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in
104 performance problems. The <code class="constant">tdbsam</code> passdb backend offers features that
105 are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database.
106 </p><p>
108 The proposed network design uses a single server to act as an Internet services host for
109 electronic mail, Web serving, remote administrative access via SSH,
110 Samba-based file and print services. This design is often chosen by sites that feel
111 they cannot afford or justify the cost or overhead of having separate servers. It must
112 be realized that if security of this type of server should ever be violated (compromised),
113 the whole network and all data is at risk. Many sites continue to choose this type
114 of solution; therefore, this chapter provides detailed coverage of key implementation
115 aspects.
116 </p><p>
117 Samba will be configured to specifically not operate on the Ethernet interface that is
118 directly connected to the Internet.
119 </p><p>
124 You know that your ISP is providing full firewall services, but you cannot rely on that.
125 Always assume that human error will occur, so be prepared by using Linux firewall facilities
127 incoming traffic except to permitted well-known ports. You must also allow incoming packets
128 to establish outgoing connections. You will permit all internal outgoing requests.
129 </p><p>
130 The configuration of Web serving, Web proxy services, electronic mail, and the details of
131 generic antivirus handling are beyond the scope of this book and therefore are not
132 covered except insofar as this affects Samba-3.
133 </p><p>
135 Notebook computers are configured to use a network login when in the office and a
136 local account to log in while away from the office. Users store all work done in
137 transit (away from the office) by using a local share for work files. Standard procedures
138 dictate that on completion of the work that necessitates mobile file access, all
139 work files are moved back to secure storage on the office server. Staff is instructed
140 to not carry on any company notebook computer any files that are not absolutely required.
141 This is a preventative measure to protect client information as well as private business
142 records.
143 </p><p>
145 All applications are served from the central server from a share called <code class="constant">apps</code>.
146 Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network
147 (or administrative) installation. Accounting and financial management software can also
148 be run only from the central application server. Notebook users are provided with
149 locally installed applications on a need-to-have basis only.
150 </p><p>
152 The introduction of roaming profiles support means that users can move between
153 desktop computer systems without constraint while retaining full access to their data.
154 The desktop travels with them as they move.
155 </p><p>
157 The DNS server implementation must now address both internal and external
158 needs. You forward DNS lookups to your ISP-provided server as well as the
160 </p><p>
164 Compared with the DHCP server configuration in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>, <a href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>, the
165 configuration used in this example has to deal with the presence of an Internet connection.
166 The scope set for it ensures that no DHCP services will be offered on the external
167 connection. All printers are configured as DHCP clients so that the DHCP server assigns
168 the printer a fixed IP address by way of the Ethernet interface (MAC) address. One additional
169 feature of this DHCP server configuration file is the inclusion of parameters to allow dynamic
170 DNS (DDNS) operation.
171 </p><p>
172 This is the first implementation that depends on a correctly functioning DNS server.
173 Comprehensive steps are included to provide for a fully functioning DNS server that also
174 is enabled for DDNS operation. This means that DHCP clients can be autoregistered
175 with the DNS server.
176 </p><p>
177 You are taking the opportunity to manually set the netbios name of the Samba server to
178 a name other than what will be automatically resolved. You are doing this to ensure that
179 the machine has the same NetBIOS name on both network segments.
180 </p><p>
181 As in the previous network configuration, printing in this network configuration uses
182 direct raw printing (i.e., no smart printing and no print driver autodownload to Windows
183 clients). Printer drivers are installed on the Windows client manually. This is not
184 a problem because Christine is to install and configure one single workstation and
185 then clone that configuration, using Norton Ghost, to all workstations. Each machine is
186 identical, so this should pose no problem.
187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2562604"></a>Hardware Requirements</h4></div></div></div><p>
189 This server runs a considerable number of services. From similarly configured Linux
190 installations, the approximate calculated memory requirements are as shown in
191 <a href="secure.html#ch4memoryest" title="Example 3.1. Estimation of Memory Requirements">???</a>.
193 </p><div class="example"><a name="ch4memoryest"></a><p class="title"><b>Example 3.1. Estimation of Memory Requirements</b></p><div class="example-contents"><pre class="screen">
195 Name (MBytes) Total MBytes Total MBytes
196 ----------- --------------- ------------ ------------
197 DHCP 2.5 3 3
198 DNS 16.0 16 16
199 Samba (nmbd) 16.0 16 16
200 Samba (winbind) 16.0 16 16
201 Samba (smbd) 4.0 520 2000
203 CUPS 3.5 16 32
204 Basic OS 256.0 256 256
205 -------------- --------------
207 -------------- --------------
209 You should add a safety margin of at least 50% to these estimates. The minimum
210 system memory recommended for initial startup 1 GB, but to permit the system
212 An initial configuration with only 1 GB memory would lead to early performance complaints
213 as the system load builds up. Given the low cost of memory, it does not make sense to
214 compromise in this area.
215 </p><p>
217 Aggregate input/output loads should be considered for sizing network configuration as
218 well as disk subsystems. For network bandwidth calculations, one would typically use an
220 would deliver below acceptable capacity for the initial user load. It is therefore a good
221 idea to begin with 1 Gb Ethernet cards for the two internal networks, each attached
223 switched ports.
224 </p><p>
227 Considering the choice of 1 Gb Ethernet interfaces for the two local network segments,
229 demand that would require a fast disk storage I/O capability. Peak disk throughput is
230 limited by the disk subsystem chosen. It is desirable to provide the maximum
231 I/O bandwidth affordable. If a low-cost solution must be chosen,
232 3Ware IDE RAID Controllers are a good choice. These controllers can be fitted into a
234 controller that can operate at the peak of the PCI-X bandwidth (approximately 450 MB/sec).
235 Alternative SCSI-based hardware RAID controllers should also be considered. Alternately,
236 it makes sense to purchase well-known, branded hardware that has appropriate performance
237 specifications. As a minimum, one should attempt to provide a disk subsystem that can
238 deliver I/O rates of at least 100 MB/sec.
239 </p><p>
240 Disk storage requirements may be calculated as shown in <a href="secure.html#ch4diskest" title="Example 3.2. Estimation of Disk Storage Requirements">???</a>.
242 </p><div class="example"><a name="ch4diskest"></a><p class="title"><b>Example 3.2. Estimation of Disk Storage Requirements</b></p><div class="example-contents"><pre class="screen">
243 Corporate Data: 100 MBytes/user per year
244 Email Storage: 500 MBytes/user per year
245 Applications: 5000 MBytes
246 Safety Buffer: At least 50%
249 -----------------------------
253 ----------------------------
254 Total: 605 GBytes
256 Recommended Storage: 908 GBytes
261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2562770"></a>Political Issues</h3></div></div></div><p>
262 Your industry is coming under increasing accountability pressures. Increased paranoia
263 is necessary so you can demonstrate that you have acted with due diligence. You must
264 not trust your Internet connection.
265 </p><p>
266 Apart from permitting more efficient management of business applications through use of
267 an application server, your primary reason for the decision to implement this is that it
268 gives you greater control over software licensing.
269 </p><p>
271 You are well aware that the current configuration results in some performance issues
272 as the size of the desktop profile grows. Given that users use Microsoft Outlook
274 is something that needs to be addressed later.
275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2562810"></a>Implementation</h2></div></div></div><p>
276 <a href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">???</a> demonstrates the overall design of the network that you will implement.
277 </p><p>
278 The information presented here assumes that you are already familiar with many basic steps.
279 As this stands, the details provided already extend well beyond just the necessities of
280 Samba configuration. This decision is deliberate to ensure that key determinants
281 of a successful installation are not overlooked. This is the last case that documents
282 the finite minutiae of DHCP and DNS server configuration. Beyond the information provided
283 here, there are many other good reference books on these subjects.
284 </p><p>
288 </p></li><li><p>
290 </p></li><li><p>
295 and is externally exposed. This interface is explicitly not available for Samba to use.
296 Samba listens on this interface for broadcast messages but does not broadcast any
298 This is achieved by way of the <em class="parameter"><code>interfaces</code></em> parameter and the
300 </p></li><li><p>
304 The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use
306 has excellent scalability for a large number of user account entries.
307 </p></li><li><p>
312 and name resolution is set to use it by means of the
314 </p></li><li><p>
316 The Samba server is configured for use by Windows clients as a time server.
317 </p></li><li><p>
321 Samba is configured to directly interface with CUPS via the direct internal interface
322 that is provided by CUPS libraries. This is achieved with the
325 </p></li><li><p>
329 External interface scripts are provided to enable Samba to interface smoothly to
330 essential operating system functions for user and group management. This is important
331 to enable workstations to join the Domain and is also important so that you can use
332 the Windows NT4 Domain User Manager as well as the Domain Server Manager. These tools
334 downloaded from the Microsoft FTP
336 </p></li><li><p>
338 The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code>
340 (User Mode).
341 </p></li><li><p>
344 Domain logon services as well as a Domain logon script are specified. The logon script
345 will be used to add robustness to the overall network configuration.
346 </p></li><li><p>
350 Roaming profiles are enabled through the specification of the parameter,
351 <a class="indexterm" name="id2563184"></a>logon path = \\%L\profiles\%U. The value of this parameter translates the
352 <code class="constant">%L</code> to the name by which the Samba server is called by the client (for this
353 configuration, it translates to the name <code class="constant">DIAMOND</code>), and the <code class="constant">%U</code>
354 will translate to the name of the user within the context of the connection made to the profile share.
355 It is the administrator's responsibility to ensure there is a directory in the root of the
356 profile share for each user. This directory must be owned by the user also. An exception to this
357 requirement is when a profile is created for group use.
358 </p></li><li><p>
361 Precautionary veto is effected for particular Windows file names that have been targeted by
362 virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking
363 controls. This should help to prevent lock contention-related file access problems.
364 </p></li><li><p>
365 Every user has a private home directory on the UNIX/Linux host. This is mapped to
366 a network drive that is the same for all users.
367 </p></li></ul></div><p>
368 The configuration of the server is the most complex so far. The following steps are used:
370 Basic System Configuration
371 </p></li><li><p>
372 Samba Configuration
373 </p></li><li><p>
374 DHCP and DNS Server Configuration
375 </p></li><li><p>
376 Printer Configuration
377 </p></li><li><p>
378 Process Start-up Configuration
379 </p></li><li><p>
380 Validation
381 </p></li><li><p>
382 Application Share Configuration
383 </p></li><li><p>
384 Windows Client Configuration
385 </p></li></ol></div><p>
386 The following sections cover each step in logical and defined detail.
387 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p>
389 The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been
390 freshly installed. It prepares basic files so that the system is ready for comprehensive
391 operation in line with the network diagram shown in <a href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">???</a>.
392 </p><div class="procedure"><a name="id2563331"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p>
394 Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>.
395 Verify that your hostname is correctly set by running:
398 server
399 </pre><p>
400 An alternate method to verify the hostname is:
403 server.abmas.us
404 </pre><p>
405 </p></li><li><p>
408 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses
409 of all network interfaces that are on the host server. This is necessary so that during
410 startup the system can resolve all its own names to the IP address prior to
411 startup of the DNS server. An example of entries that should be in the
414 127.0.0.1 localhost
415 192.168.1.1 sleeth1.abmas.biz sleeth1 diamond
416 192.168.2.1 sleeth2.abmas.biz sleeth2
417 123.45.67.66 server.abmas.us server
418 </pre><p>
419 You should check the startup order of your system. If the CUPS print server is started before
420 the DNS server (<span><strong class="command">named</strong></span>), you should also include an entry for the printers
423 192.168.1.20 qmsa.abmas.biz qmsa
424 192.168.1.30 hplj6a.abmas.biz hplj6a
425 192.168.2.20 qmsf.abmas.biz qmsf
426 192.168.2.30 hplj6f.abmas.biz hplj6f
427 </pre><p>
431 The printer entries are not necessary if <span><strong class="command">named</strong></span> is started prior to
433 </p></li><li><p>
437 The host server is acting as a router between the two internal network segments as well
438 as for all Internet access. This necessitates that IP forwarding be enabled. This can be
439 achieved by adding to the <code class="filename">/etc/rc.d/boot.local</code> an entry as follows:
442 </pre><p>
443 To ensure that your kernel is capable of IP forwarding during configuration, you may
444 wish to execute that command manually also. This setting permits the Linux system to
446 </p></li><li><p>
449 Installation of a basic firewall and NAT facility is necessary.
453 script contents are shown in <a href="secure.html#ch4natfw" title="Example 3.3. NAT Firewall Configuration Script">???</a>.
455 </p><div class="example"><a name="ch4natfw"></a><p class="title"><b>Example 3.3. NAT Firewall Configuration Script</b></p><div class="example-contents"><pre class="screen">
456 #!/bin/sh
457 echo -e "\n\nLoading NAT firewall.\n"
458 IPTABLES=/usr/sbin/iptables
463 /sbin/depmod -a
464 /sbin/modprobe ip_tables
465 /sbin/modprobe ip_conntrack
466 /sbin/modprobe ip_conntrack_ftp
467 /sbin/modprobe iptable_nat
468 /sbin/modprobe ip_nat_ftp
469 $IPTABLES -P INPUT DROP
470 $IPTABLES -F INPUT
471 $IPTABLES -P OUTPUT ACCEPT
472 $IPTABLES -F OUTPUT
473 $IPTABLES -P FORWARD DROP
474 $IPTABLES -F FORWARD
476 $IPTABLES -A INPUT -i lo -j ACCEPT
477 $IPTABLES -A INPUT -i $INTIFA -j ACCEPT
478 $IPTABLES -A INPUT -i $INTIFB -j ACCEPT
479 $IPTABLES -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
480 # Enable incoming traffic for: SSH, SMTP, DNS(tcp), HTTP, HTTPS
481 for i in 22 25 53 80 443
482 do
483 $IPTABLES -A INPUT -i $EXTIF -p tcp --dport $i -j ACCEPT
484 done
485 # Allow DNS(udp)
486 $IPTABLES -A INPUT -i $EXTIF -p udp -dport 53 -j ACCEPT
487 echo "Allow all connections OUT and only existing and specified ones IN"
488 $IPTABLES -A FORWARD -i $EXTIF -o $INTIFA -m state \
489 --state ESTABLISHED,RELATED -j ACCEPT
490 $IPTABLES -A FORWARD -i $EXTIF -o $INTIFB -m state \
491 --state ESTABLISHED,RELATED -j ACCEPT
492 $IPTABLES -A FORWARD -i $INTIFA -o $EXTIF -j ACCEPT
493 $IPTABLES -A FORWARD -i $INTIFB -o $EXTIF -j ACCEPT
494 $IPTABLES -A FORWARD -j LOG
495 echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
496 $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
498 echo -e "\nNAT firewall done.\n"
500 </p></li><li><p>
501 Execute the following to make the script executable:
504 </pre><p>
506 that runs your <span><strong class="command">abmas-natfw.sh</strong></span> script. The following
507 entry works for you:
509 #! /bin/sh
510 #
511 # Copyright (c) 2002 SUSE Linux AG Nuernberg, Germany.
512 # All rights reserved.
513 #
514 # Author: Werner Fink, 1996
515 # Burchard Steinbild, 1996
516 #
517 # /etc/init.d/boot.local
518 #
519 # script with local commands to be executed from init on system startup
520 #
521 # Here you should add things that should happen directly after booting
522 # before we're going to the first run level.
523 #
524 /usr/local/sbin/abmas-natfw.sh
525 </pre><p>
526 </p></li></ol></div><p>
528 The server is now ready for Samba configuration. During the validation step, you remove
529 the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code>
530 file. This is done after you are satisfied that DNS-based name resolution is functioning correctly.
531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2563723"></a>Samba Configuration</h3></div></div></div><p>
532 When you have completed this section, the Samba server is ready for testing and validation;
533 however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have
534 been configured.
535 </p><div class="procedure"><a name="id2563736"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p>
536 Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary
537 RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this
538 file is as follows:
541 </pre><p>
542 This operation must be performed while logged in as the <span><strong class="command">root</strong></span> user.
543 Successful operation is clearly indicated. If this installation should fail for any reason,
544 refer to the operating system manufacturer's documentation for guidance.
545 </p></li><li><p>
546 Install the <code class="filename">smb.conf</code> file shown in <a href="secure.html#promisnet" title="Example 3.4. 130 User Network with tdbsam [globals] Section">???</a>, <a href="secure.html#promisnetsvca" title="Example 3.5. 130 User Network with tdbsam Services Section Part A">???</a>,
547 and <a href="secure.html#promisnetsvcb" title="Example 3.6. 130 User Network with tdbsam Services Section Part B">???</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code>
548 file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>.
550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2563857"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2563870"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2563883"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2563896"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563909"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2563922"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563935"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2563948"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2563962"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2563975"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563988"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2564000"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2564013"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2564026"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2564039"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2564051"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2564064"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564077"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2564090"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2564103"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564116"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564130"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564143"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564156"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564170"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564184"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2564197"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2564210"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2564223"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564236"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2564249"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564262"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564275"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564288"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564300"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564313"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564326"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2564338"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2564351"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2564364"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">
552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2564409"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2564422"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2564434"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2564447"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2564468"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2564481"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2564494"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564507"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564519"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564532"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564545"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2564567"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2564580"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2564593"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564605"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2564627"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2564640"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2564653"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2564665"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2564687"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2564700"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2564713"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">
554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2564757"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2564770"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2564783"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2564804"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2564817"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2564829"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2564851"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2564864"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2564876"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564889"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">
555 </p></li><li><p>
560 New SMB password: XXXXXXXX
561 Retype new SMB password: XXXXXXXX
563 </pre><p>
564 The <code class="constant">root</code> account is the UNIX equivalent of the Windows Domain Administrator.
565 This account is essential in the regular maintenance of your Samba server. It must never be
566 deleted. If for any reason the account is deleted, you may not be able to recreate this account
567 without considerable trouble.
568 </p></li><li><p>
570 Create the username map file to permit the <code class="constant">root</code> account to be called
571 <code class="constant">Administrator</code> from the Windows network environment. To do this, create
574 ####
575 # User mapping file
576 ####
577 # File Format
578 # -----------
579 # Unix_ID = Windows_ID
580 #
581 # Examples:
582 # root = Administrator
583 # janes = "Jane Smith"
584 # jimbo = Jim Bones
585 #
586 # Note: If the name contains a space it must be double quoted.
587 # In the example above the name 'jimbo' will be mapped to Windows
588 # user names 'Jim' and 'Bones' because the space was not quoted.
589 #######################################################################
590 root = Administrator
591 ####
592 # End of File
593 ####
594 </pre><p>
595 </p></li><li><p>
600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>,
601 <a href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours
603 and then execute the script. Sample output should be as follows:
605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2565080"></a><pre class="screen">
606 #!/bin/bash
607 #
608 # initGrps.sh
609 #
611 # Create UNIX groups
612 groupadd acctsdep
613 groupadd finsrvcs
615 # Map Windows Domain Groups to UNIX groups
620 # Add Functional Domain Groups
625 # Map Windows NT machine local groups to local UNIX groups
626 # Mapping of local groups is not necessary and not functional
627 # for this installation.
633 Updated mapping entry for Domain Admins
634 Updated mapping entry for Domain Users
635 Updated mapping entry for Domain Guests
636 No rid or sid specified, choosing algorithmic mapping
637 Successfully added group Accounts Dept to the mapping db
638 No rid or sid specified, choosing algorithmic mapping
639 Successfully added group Domain Guests to the mapping db
656 </pre><p>
657 </p></li><li><p>
665 There is one preparatory step without which you will not have a working Samba
666 network environment. You must add an account for each network user.
667 For each user who needs to be given a Windows Domain account, make an entry in the
669 Use the system tool of your choice to create the UNIX system account, and use the Samba
671 There are a number of tools for user management under UNIX, such as
672 <span><strong class="command">useradd</strong></span>, and <span><strong class="command">adduser</strong></span>, as well as a plethora of custom
673 tools. You also want to create a home directory for each user.
674 You can do this by executing the following steps for each user:
679 New password: XXXXXXXX
680 Re-enter new password: XXXXXXXX
681 Password changed
682 <code class="prompt">root# </code> smbpasswd -a <em class="parameter"><code>username</code></em>
683 New SMB password: XXXXXXXX
684 Retype new SMB password: XXXXXXXX
686 </pre><p>
687 You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>.
688 </p></li><li><p>
692 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
693 previously as necessary. File system access control will be based on UNIX group membership.
694 </p></li><li><p>
695 Create the directory mount point for the disk subsystem that can be mounted to provide
696 data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code>
697 file is <code class="filename">/data</code>. Format the file system as required, and mount the formatted
698 file system partition using appropriate system tools.
699 </p></li><li><p>
701 Create the top-level file storage directories for data and applications as follows:
711 </pre><p>
712 Each department is responsible for creating its own directory structure within the departmental
713 share. The directory root of the <span><strong class="command">accounts</strong></span> share is <code class="filename">/data/accounts</code>.
714 The directory root of the <span><strong class="command">finsvcs</strong></span> share is <code class="filename">/data/finsvcs</code>.
715 The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share
716 that provides the application server infrastructure.
717 </p></li><li><p>
718 The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network
719 logon services. You can now create the file system infrastructure to provide the
720 locations on disk that these services require. Adequate planning is essential,
721 since desktop profiles can grow to be quite large. For planning purposes, a minimum of
722 200 MB of storage should be allowed per user for profile storage. The following
723 commands create the directory infrastructure needed:
732 </pre><p>
733 For each user account that is created on the system, the following commands should be
734 executed:
739 </pre><p>
740 </p></li><li><p>
744 Create a logon script. It is important that each line is correctly terminated with
745 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
746 works if the right tools (<code class="constant">unix2dos</code> and <code class="constant">dos2unix</code>) are installed.
747 First, create a file called <code class="filename">/var/lib/samba/netlogon/scripts/logon.bat.unix</code>
748 with the following contents:
750 net time \\diamond /set /yes
751 net use h: /home
752 net use p: \\diamond\apps
753 </pre><p>
754 Convert the UNIX file to a DOS file using the <span><strong class="command">unix2dos</strong></span> as shown here:
756 <code class="prompt">root# </code> unix2dos < /var/lib/samba/netlogon/scripts/logon.bat.unix \
757 > /var/lib/samba/netlogon/scripts/logon.bat
758 </pre><p>
759 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p>
760 DHCP services are a basic component of the entire network client installation. DNS operation is
761 foundational to Internet access as well as to trouble-free operation of local networking. When
762 you have completed this section, the server should be ready for solid duty operation.
763 </p><div class="procedure"><a name="id2565676"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p>
766 shown in <a href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">???</a>.
768 </p><div class="example"><a name="prom-dhcp"></a><p class="title"><b>Example 3.8. DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><pre class="screen">
769 # Abmas Accounting Inc.
770 default-lease-time 86400;
771 max-lease-time 172800;
772 default-lease-time 86400;
773 option ntp-servers 192.168.1.1;
774 option domain-name "abmas.biz";
777 option netbios-node-type 8; ### Node type = Hybrid ###
778 ddns-updates on; ### Dynamic DNS enabled ###
779 ddns-update-style interim;
782 range dynamic-bootp 192.168.1.128 192.168.1.254;
783 option subnet-mask 255.255.255.0;
784 option routers 192.168.1.1;
785 allow unknown-clients;
786 host qmsa {
788 fixed-address 192.168.1.20;
789 }
790 host hplj6a {
792 fixed-address 192.168.1.30;
793 }
794 }
796 range dynamic-bootp 192.168.2.128 192.168.2.254;
797 option subnet-mask 255.255.255.0;
798 option routers 192.168.2.1;
799 allow unknown-clients;
800 host qmsf {
802 fixed-address 192.168.1.20;
803 }
804 host hplj6f {
806 fixed-address 192.168.2.30;
807 }
808 }
810 }
812 }
814 </p></li><li><p>
816 Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents
817 of the <a href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">???</a>, <a href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">???</a>, and
818 <a href="secure.html#ch4namedvarrev" title="Example 3.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">???</a> files that are concatenated (merged) in this
819 specific order.
820 </p></li><li><p>
821 Create the files shown in their respective directories as shown in <a href="secure.html#namedrscfiles" title="Table 3.2. DNS (named) Resource Files">DNS
822 (named) Resource Files</a>.
824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">???</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">???</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">???</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">???</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">???</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">???</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">???</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break">
826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id2565974"></a><pre class="screen">
827 ###
828 # Abmas Biz DNS Control File
829 ###
831 ###
832 options {
833 directory "/var/lib/named";
834 forwarders {
835 123.45.12.23;
836 };
837 forward first;
838 listen-on {
839 mynet;
840 };
841 auth-nxdomain yes;
842 multiple-cnames yes;
843 notify no;
844 };
846 zone "." in {
847 type hint;
848 file "root.hint";
849 };
851 zone "localhost" in {
852 type master;
853 file "localhost.zone";
854 };
856 zone "0.0.127.in-addr.arpa" in {
857 type master;
858 file "127.0.0.zone";
859 };
861 acl mynet {
864 127.0.0.1;
865 };
867 acl seconddns {
868 123.45.54.32;
869 };
873 </p><div class="example"><a name="ch4namedvarfwd"></a><p class="title"><b>Example 3.10. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</b></p><div class="example-contents"><pre class="screen">
874 zone "abmas.biz" {
875 type master;
876 file "/var/lib/named/master/abmas.biz.hosts";
877 allow-query {
878 mynet;
879 };
880 allow-transfer {
881 mynet;
882 };
883 allow-update {
884 mynet;
885 };
886 };
888 zone "abmas.us" {
889 type master;
890 file "/var/lib/named/master/abmas.us.hosts";
891 allow-query {
892 any;
893 };
894 allow-transfer {
895 seconddns;
896 };
897 };
900 </p><div class="example"><a name="ch4namedvarrev"></a><p class="title"><b>Example 3.11. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</b></p><div class="example-contents"><pre class="screen">
901 zone "1.168.192.in-addr.arpa" {
902 type master;
903 file "/var/lib/named/master/192.168.1.0.rev";
904 allow-query {
905 mynet;
906 };
907 allow-transfer {
908 mynet;
909 };
910 allow-update {
911 mynet;
912 };
913 };
915 zone "2.168.192.in-addr.arpa" {
916 type master;
917 file "/var/lib/named/master/192.168.2.0.rev";
918 allow-query {
919 mynet;
920 };
921 allow-transfer {
922 mynet;
923 };
924 allow-update {
925 mynet;
926 };
927 };
930 </p><div class="example"><a name="eth1zone"></a><p class="title"><b>Example 3.12. DNS 192.168.1 Reverse Zone File</b></p><div class="example-contents"><pre class="screen">
931 $ORIGIN .
933 1.168.192.in-addr.arpa IN SOA sleeth.abmas.biz. root.abmas.biz. (
934 2003021825 ; serial
939 )
940 NS sleeth1.abmas.biz.
941 $ORIGIN 1.168.192.in-addr.arpa.
942 1 PTR sleeth1.abmas.biz.
943 20 PTR qmsa.abmas.biz.
944 30 PTR hplj6a.abmas.biz.
947 </p><div class="example"><a name="eth2zone"></a><p class="title"><b>Example 3.13. DNS 192.168.2 Reverse Zone File</b></p><div class="example-contents"><pre class="screen">
948 $ORIGIN .
950 2.168.192.in-addr.arpa IN SOA sleeth.abmas.biz. root.abmas.biz. (
951 2003021825 ; serial
956 )
957 NS sleeth2.abmas.biz.
958 $ORIGIN 2.168.192.in-addr.arpa.
959 1 PTR sleeth2.abmas.biz.
960 20 PTR qmsf.abmas.biz.
961 30 PTR hplj6f.abmas.biz.
964 </p><div class="example"><a name="abmasbiz"></a><p class="title"><b>Example 3.14. DNS Abmas.biz Forward Zone File</b></p><div class="example-contents"><pre class="screen">
965 $ORIGIN .
967 abmas.biz IN SOA sleeth1.abmas.biz. root.abmas.biz. (
968 2003021833 ; serial
973 )
974 NS dns.abmas.biz.
975 MX 10 mail.abmas.biz.
976 $ORIGIN abmas.biz.
977 sleeth1 A 192.168.1.1
978 sleeth2 A 192.168.2.1
979 qmsa A 192.168.1.20
980 hplj6a A 192.168.1.30
981 qmsf A 192.168.2.20
982 hplj6f A 192.168.2.30
983 dns CNAME sleeth1
984 diamond CNAME sleeth1
985 mail CNAME sleeth1
988 </p><div class="example"><a name="abmasus"></a><p class="title"><b>Example 3.15. DNS Abmas.us Forward Zone File</b></p><div class="example-contents"><pre class="screen">
989 $ORIGIN .
991 abmas.us IN SOA server.abmas.us. root.abmas.us. (
992 2003021833 ; serial
997 )
998 NS dns.abmas.us.
999 NS dns2.abmas.us.
1000 MX 10 mail.abmas.us.
1001 $ORIGIN abmas.us.
1002 server A 123.45.67.66
1003 dns2 A 123.45.54.32
1004 gw A 123.45.67.65
1005 www CNAME server
1006 mail CNAME server
1007 dns CNAME server
1010 </p></li><li><p>
1012 All DNS name resolution should be handled locally. To ensure that the server is configured
1013 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following
1014 content:
1016 search abmas.us abmas.biz
1017 nameserver 127.0.0.1
1018 nameserver 123.45.54.23
1019 </pre><p>
1021 This instructs the name resolver function (when configured correctly) to ask the DNS server
1022 that is running locally to resolve names to addresses. In the event that the local name server
1023 is not available, ask the name server provided by the ISP. The latter, of course, does not resolve
1024 purely local names to IP addresses.
1025 </p></li><li><p>
1028 This file controls the operation of the various resolver libraries that are part of the Linux
1029 Glibc libraries. Edit this file so that it contains the following entries:
1031 hosts: files dns wins
1032 </pre><p>
1033 </p></li></ol></div><p>
1034 The basic DHCP and DNS services are now ready for validation testing. Before you can proceed,
1035 there are a few more steps along the road. First, configure the print spooling and print
1036 processing system. Then you can configure the server so that all services
1037 start automatically on reboot. You must also manually start all services prior to validation testing.
1038 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p>
1039 Network administrators who are new to CUPS based-printing typically experience some difficulty mastering
1040 its powerful features. The steps outlined in this section are designed to navigate around the distractions
1041 of learning CUPS. Instead of implementing smart features and capabilities, our approach is to use it as a
1042 transparent print queue that performs no filtering, and only minimal handling of each print job that is
1043 submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that
1044 the correct printer driver must be installed on all clients.
1045 </p><div class="procedure"><a name="id2566307"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p>
1046 Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines.
1047 </p></li><li><p>
1048 Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100.
1049 Use any other port the manufacturer specifies for direct-mode raw printing, and adjust the
1050 port as necessary in the following example commands.
1051 This allows the CUPS spooler to print using raw mode protocols.
1054 </p></li><li><p>
1056 Configure the CUPS Print Queues as follows:
1062 </pre><p>
1064 This creates the necessary print queues with no assigned print filter.
1066 Print queues may not be enabled at creation. Use <span><strong class="command">lpc stat</strong></span> to check
1067 the status of the print queues and, if necessary, make certain that the queues you have
1068 just created are enabled by executing the following:
1074 </pre><p>
1076 Even though your print queues may be enabled, it is still possible that they
1077 are not accepting print jobs. A print queue services incoming printing
1078 requests only when configured to do so. Ensure that your print queues are
1079 set to accept incoming jobs by executing the following commands:
1085 </pre><p>
1086 </p></li><li><p>
1092 application/octet-stream application/vnd.cups-raw 0 -
1093 </pre><p>
1094 </p></li><li><p>
1098 application/octet-stream
1099 </pre><p>
1100 </p></li><li><p>
1101 Printing drivers are installed on each network client workstation.
1102 </p></li></ol></div><p>
1103 Note: If the parameter <em class="parameter"><code>cups options = Raw</code></em> is specified in the <code class="filename">smb.conf</code> file,
1104 the last two steps can be omitted with CUPS version 1.1.18, or later.
1105 </p><p>
1106 The UNIX system print queues have been configured and are ready for validation testing.
1107 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p>
1109 There are two essential steps to process startup configuration. First, the process
1110 must be configured so that it automatically restarts each time the server
1111 is rebooted. This step involves use of the <span><strong class="command">chkconfig</strong></span> tool that
1112 creates the appropriate symbolic links from the master daemon control file that is
1113 located in the <code class="filename">/etc/rc.d</code> directory, to the <code class="filename">/etc/rc'x'.d</code>
1114 directories. Links are created so that when the system run level is changed, the
1115 necessary start or kill script is run.
1116 </p><p>
1122 In the event that a service is not run as a daemon, but via the internetworking
1123 super daemon (<span><strong class="command">inetd</strong></span> or <span><strong class="command">xinetd</strong></span>), then the <span><strong class="command">chkconfig</strong></span>
1125 and sends a hang-up (HUP) signal to the the super daemon, thus forcing it to
1126 re-read its control files.
1127 </p><p>
1128 Last, each service must be started to permit system validation to proceed.
1130 Use the standard system tool to configure each service to restart
1131 automatically at every system reboot. For example,
1138 </pre><p>
1139 </p></li><li><p>
1143 Now start each service to permit the system to be validated.
1144 Execute each of the following in the sequence shown:
1151 </pre><p>
1152 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p>
1154 Complex networking problems are most often caused by simple things that are poorly or incorrectly
1155 configured. The validation process adopted here should be followed carefully; it is the result of the
1156 experience gained from years of making and correcting the most common mistakes. Shortcuts often lead to basic errors. You should
1157 refrain from taking shortcuts, from making basic assumptions, and from not exercising due process
1158 and diligence in network validation. By thoroughly testing and validating every step in the process
1159 of network installation and configuration, you can save yourself from sleepless nights and restless
1160 days. A well debugged network is a foundation for happy network users and network administrators.
1161 Later in this book you learn how to make users happier. For now, it is enough to learn to
1162 validate. Let's get on with it.
1163 </p><div class="procedure"><a name="id2566880"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p>
1165 One of the most important facets of Samba configuration is to ensure that
1166 name resolution functions correctly. You can check name resolution
1167 with a few simple tests. The most basic name resolution is provided from the
1172 hosts: files
1173 </pre><p>
1174 When you have saved this file, execute the following command:
1183 --- sleeth1.abmas.biz ping statistics ---
1186 </pre><p>
1188 is working.
1189 </p></li><li><p>
1191 So far, your installation is going particularly well. In this step we validate
1192 DNS server and name resolution operation. Using your favorite UNIX system editor,
1196 hosts: dns
1197 </pre><p>
1198 </p></li><li><p>
1200 Before you test DNS operation, it is a good idea to verify that the DNS server
1201 is running by executing the following:
1211 </pre><p>
1212 This means that we are ready to check DNS operation. Do so by executing:
1220 --- sleeth1.abmas.biz ping statistics ---
1223 </pre><p>
1224 You should take a few more steps to validate DNS server operation, as follows:
1227 sleeth1.abmas.biz has address 192.168.1.1
1228 </pre><p>
1232 but its removal reduces the number of administrative steps for this name.
1233 </p></li><li><p>
1235 WINS is a great way to resolve NetBIOS names to their IP address. You can test
1236 the operation of WINS by starting <span><strong class="command">nmbd</strong></span> (manually or by way
1237 of the Samba startup method shown in <a href="secure.html#procstart" title="Process Startup Configuration">???</a>). You must edit
1238 the <code class="filename">/etc/nsswitch.conf</code> file so that the <code class="constant">hosts</code>
1239 entry is as follows:
1241 hosts: wins
1242 </pre><p>
1243 The next step is to make certain that Samba is running using <span><strong class="command">ps ax | grep mbd</strong></span>.
1244 The <span><strong class="command">nmbd</strong></span> daemon will provide the WINS name resolution service when the
1245 <code class="filename">smb.conf</code> file <em class="parameter"><code></code></em> parameter <a class="indexterm" name="id2567152"></a>wins support = Yes has been specified. Having validated that Samba is operational,
1246 excute the following:
1252 </pre><p>
1254 Now that you can relax with the knowledge that all three major forms of name
1255 resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code>
1256 again. This time you add all three forms of name resolution to this file.
1259 hosts: files dns wins
1260 </pre><p>
1261 The system is looking good. Let's move on.
1262 </p></li><li><p>
1263 It would give you peace of mind to know that the DHCP server is running
1264 and available for service. You can validate DHCP services by running:
1270 </pre><p>
1271 This shows that the server is running. The proof of whether or not it is working
1272 comes when you try to add the first DHCP client to the network.
1273 </p></li><li><p>
1275 This is a good point at which to start validating Samba operation. You are
1276 content that name resolution is working for basic TCP/IP needs. Let's move on.
1277 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba
1278 to refuse to start. The first step should always be to validate the contents
1279 of this file by running:
1282 Load smb config files from smb.conf
1283 Processing section "[homes]"
1284 Processing section "[printers]"
1285 Processing section "[netlogon]"
1286 Processing section "[profiles]"
1287 Processing section "[accounts]"
1288 Processing section "[service]"
1289 Processing section "[apps]"
1290 Loaded services file OK.
1291 # Global parameters
1292 [global]
1293 workgroup = PROMISES
1294 netbios name = DIAMOND
1295 interfaces = eth1, eth2, lo
1296 bind interfaces only = Yes
1297 passdb backend = tdbsam
1298 pam password change = Yes
1299 passwd program = /usr/bin/passwd '%u'
1300 passwd chat = *New*Password* %n\n \
1301 *Re-enter*new*password* %n\n *Password*changed*
1302 username map = /etc/samba/smbusers
1303 unix password sync = Yes
1304 log level = 1
1305 syslog = 0
1306 log file = /var/log/samba/%m
1307 max log size = 50
1308 smb ports = 139
1309 name resolve order = wins bcast hosts
1310 time server = Yes
1311 printcap name = CUPS
1312 show add printer wizard = No
1313 add user script = /usr/sbin/useradd -m '%u'
1314 delete user script = /usr/sbin/userdel -r '%u'
1315 add group script = /usr/sbin/groupadd '%g'
1316 delete group script = /usr/sbin/groupdel '%g'
1317 add user to group script = /usr/sbin/usermod -G '%g' '%u'
1318 add machine script = /usr/sbin/useradd \
1319 -s /bin/false -d /dev/null '%u'
1320 shutdown script = /var/lib/samba/scripts/shutdown.sh
1321 abort shutdown script = /sbin/shutdown -c
1322 logon script = scripts\logon.bat
1323 logon path = \\%L\profiles\%U
1324 logon drive = X:
1325 logon home = \\%L\%U
1326 domain logons = Yes
1327 preferred master = Yes
1328 wins support = Yes
1329 utmp = Yes
1330 winbind use default domain = Yes
1331 map acl inherit = Yes
1332 cups options = Raw
1333 veto files = /*.eml/*.nws/*.{*}/
1334 veto oplock files = /*.doc/*.xls/*.mdb/
1336 [homes]
1337 comment = Home Directories
1338 valid users = %S
1339 read only = No
1340 browseable = No
1341 ...
1342 ### Remainder cut to save space ###
1343 </pre><p>
1344 Clear away all errors before proceeding.
1345 </p></li><li><p>
1350 Check that the Samba server is running:
1357 $rootprompt; ps ax | grep winbind
1360 </pre><p>
1361 The <span><strong class="command">winbindd</strong></span> daemon is running in split mode (normal), so there are also
1363 </p></li><li><p>
1366 Check that an anonymous connection can be made to the Samba server:
1370 Sharename Type Comment
1371 --------- ---- -------
1372 IPC$ IPC IPC Service (Samba 3.0.20)
1373 netlogon Disk Network Logon Service
1374 profiles Disk Profile Share
1375 accounts Disk Accounting Files
1376 service Disk Financial Services Files
1377 apps Disk Application Files
1378 ADMIN$ IPC IPC Service (Samba 3.0.20)
1379 hplj6a Printer hplj6a
1380 hplj6f Printer hplj6f
1381 qmsa Printer qmsa
1382 qmsf Printer qmsf
1384 Server Comment
1385 --------- -------
1386 DIAMOND Samba 3.0.20
1388 Workgroup Master
1389 --------- -------
1390 PROMISES DIAMOND
1391 </pre><p>
1392 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
1393 of browsing the server from a Windows client to obtain a list of shares on the server.
1394 The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and
1396 </p></li><li><p>
1400 Verify that each printer has the IP address assigned in the DHCP server configuration file.
1401 The easiest way to do this is to ping the printer name. Immediately after the ping response
1402 has been received, execute <span><strong class="command">arp -a</strong></span> to find the MAC address of the printer
1403 that has responded. Now you can compare the IP address and the MAC address of the printer
1404 with the configuration information in the <code class="filename">/etc/dhcpd.conf</code> file. They
1405 should, of course, match. For example,
1413 </pre><p>
1416 IP address from which the printer has responded and with the entry for it in the
1418 </p></li><li><p>
1420 Make an authenticated connection to the server using the <span><strong class="command">smbclient</strong></span> tool:
1423 Password: XXXXXXX
1424 smb: \> dir
1435 smb: \> q
1436 </pre><p>
1437 </p></li><li><p>
1439 Your new server is connected to an Internet-accessible connection. Before you start
1440 your firewall, you should run a port scanner against your system. You should repeat that
1441 after the firewall has been started. This helps you understand to what extent the
1442 server may be vulnerable to external attack. One way you can do this is by using an
1443 external service, such as the <a href="http://www.dslreports.com/scan" target="_top">DSL Reports</a>
1444 tools. Alternately, if you can gain root-level access to a remote
1445 UNIX/Linux system that has the <span><strong class="command">nmap</strong></span> tool, you can run the following:
1449 Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
1450 Host server.abmas.us (123.45.67.66) appears to be up ... good.
1451 Initiating Connect() Scan against server.abmas.us (123.45.67.66)
1452 Adding open port 6000/tcp
1453 Adding open port 873/tcp
1454 Adding open port 445/tcp
1455 Adding open port 10000/tcp
1456 Adding open port 901/tcp
1457 Adding open port 631/tcp
1458 Adding open port 25/tcp
1459 Adding open port 111/tcp
1460 Adding open port 32770/tcp
1461 Adding open port 3128/tcp
1462 Adding open port 53/tcp
1463 Adding open port 80/tcp
1464 Adding open port 443/tcp
1465 Adding open port 139/tcp
1466 Adding open port 22/tcp
1468 Interesting ports on server.abmas.us (123.45.67.66):
1469 (The 1587 ports scanned but not shown below are in state: closed)
1470 Port State Service
1471 22/tcp open ssh
1472 25/tcp open smtp
1473 53/tcp open domain
1474 80/tcp open http
1475 111/tcp open sunrpc
1476 139/tcp open netbios-ssn
1477 443/tcp open https
1478 445/tcp open microsoft-ds
1479 631/tcp open ipp
1480 873/tcp open rsync
1481 901/tcp open samba-swat
1482 3128/tcp open squid-http
1483 6000/tcp open X11
1484 10000/tcp open snet-sensor-mgmt
1485 32770/tcp open sometimes-rpc3
1488 </pre><p>
1489 The above scan was run before the external interface was locked down with the NAT-firewall
1490 script you created above. The following results are obtained after the firewall rules
1491 have been put into place:
1495 Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
1496 Host server.abmas.us (123.45.67.66) appears to be up ... good.
1497 Initiating Connect() Scan against server.abmas.us (123.45.67.66)
1498 Adding open port 53/tcp
1499 Adding open port 22/tcp
1501 Interesting ports on server.abmas.us (123.45.67.66):
1502 (The 1593 ports scanned but not shown below are in state: filtered)
1503 Port State Service
1504 22/tcp open ssh
1505 25/tcp closed smtp
1506 53/tcp open domain
1507 80/tcp closed http
1508 443/tcp closed https
1511 </pre><p>
1512 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p>
1515 The use of an application server is a key mechanism by which desktop administration overheads
1516 can be reduced. Check the application manual for your software to identify how best to
1517 create an administrative installation.
1518 </p><p>
1519 Some Windows software will only run locally on the desktop computer. Such software
1520 is typically not suited for administrative installation. Administratively installed software
1521 permits one or more of the following installation choices:
1523 Install software fully onto a workstation, storing data files on the same workstation.
1524 </p></li><li><p>
1525 Install software fully onto a workstation with central network data file storage.
1526 </p></li><li><p>
1527 Install software to run off a central application server with data files stored
1528 on the local workstation. This is often called a minimum installation, or a
1529 network client installation.
1530 </p></li><li><p>
1531 Install software to run off a central application server with data files stored
1532 on a central network share. This type of installation often prevents storage
1533 of work files on the local workstation.
1534 </p></li></ul></div><p>
1536 A common application deployed in this environment is an office suite.
1537 Enterprise editions of Microsoft Office XP Professional can be administratively installed
1538 by launching the installation from a command shell. The command that achieves this is
1539 <span><strong class="command">setup /a</strong></span>. It results in a set of prompts through which various
1540 installation choices can be made. Refer to the Microsoft Office Resource SDK and Resource
1541 Kit for more information regarding this mode of installation of MS Office XP Professional.
1542 The full administrative installation of MS Office XP Professional requires approximately
1543 650 MB of disk space.
1544 </p><p>
1545 When the MS Office XP Professional product has been installed to the administrative network
1546 share, the product can be installed onto a workstation by executing the normal setup program.
1547 The installation process now provides a choice to either perform a minimum installation
1548 or a full local installation. A full local installation takes over 100 MB of disk space.
1550 local disk space. In the latter case, when the applications are used, they load over the network.
1551 </p><p>
1554 Microsoft Office Service Packs can be unpacked to update an administrative share. This makes
1555 it possible to update MS Office XP Professional for all users from a single installation
1556 of the service pack and generally circumvents the need to run updates on each network
1557 Windows client.
1558 </p><p>
1559 The default location for MS Office XP Professional data files can be set through registry
1560 editing or by way of configuration options inside each Office XP Professional application.
1561 </p><p>
1563 OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also
1564 be installed to run off a network share. The latter is a most desirable solution for office-bound
1565 network users and for administrative staff alike. It permits quick and easy updates
1566 to be rolled out to all users with a minimum of disruption and with maximum flexibility.
1567 </p><p>
1568 The process for installation of administrative shared OpenOffice involves download of the
1569 distribution ZIP file, followed by extraction of the ZIP file into a temporary disk area.
1570 When fully extracted using the unzipping tool of your choosing, change into the Windows
1571 installation files directory then execute <span><strong class="command">setup -net</strong></span>. You are
1572 prompted on screen for the target installation location. This is the administrative
1573 share point. The full administrative OpenOffice share takes approximately 150 MB of disk
1574 space.
1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2567910"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>
1576 Many single-user products can be installed into an administrative share, but
1577 personal versions of products such as Microsoft Office XP Professional do not permit this.
1578 Many people do not like terms of use typical with commercial products, so a few comments
1579 regarding software licensing seem important.
1580 </p><p>
1581 Please do not use an administrative installation of proprietary and commercially licensed
1582 software products to violate the copyright holders' property. All software is licensed,
1583 particularly software that is licensed for use free of charge. All software is the property
1584 of the copyright holder unless the author and/or copyright holder has explicitly disavowed
1585 ownership and has placed the software into the public domain.
1586 </p><p>
1587 Software that is under the GNU General Public License, like proprietary software, is
1588 licensed in a way that restricts use. For example, if you modify GPL software and then
1589 distribute the binary version of your modifications, you must offer to provide the source
1590 code as well. This restriction is designed to maintain the momentum
1591 of the diffusion of technology and to protect against the withholding of innovations.
1592 </p><p>
1593 Commercial and proprietary software generally restrict use to those who have paid the
1594 license fees and who comply with the licensee's terms of use. Software that is released
1595 under the GNU General Public License is restricted to particular terms and conditions
1596 also. Whatever the licensing terms may be, if you do not approve of the terms of use,
1597 please do not use the software.
1598 </p><p>
1600 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided
1601 with the source code.
1602 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p>
1603 Christine needs to roll out 130 new desktop systems. There is no doubt that she also needs
1604 to reinstall many of the notebook computers that will be recycled for use with the new network
1605 configuration. The smartest way to handle the challenge of the roll-out program is to build
1606 a staged system for each type of target machine, and then use an image replication tool such as Norton
1607 Ghost (enterprise edition) to replicate the staged machine to its target desktops. The same can
1608 be done with notebook computers as long as they are identical or sufficiently similar.
1609 </p><div class="procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol type="1"><li><p>
1612 Install MS Windows XP Professional. During installation, configure the client to use DHCP for
1613 TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server
1614 address that has been defined for the local subnet.
1615 </p></li><li><p>
1618 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
1619 a Windows Domain is given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.
1620 Reboot the machine as prompted and then log on using the Domain Administrator account
1622 </p></li><li><p>
1623 Verify <code class="constant">DIAMOND</code> is visible in <span class="guimenu">My Network Places</span>,
1624 that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>,
1625 <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>, and that it is
1626 possible to open each share to reveal its contents.
1627 </p></li><li><p>
1628 Create a drive mapping to the <code class="constant">apps</code> share on the server <code class="constant">DIAMOND</code>.
1629 </p></li><li><p>
1630 Perform an administrative installation of each application to be used. Select the options
1631 that you wish to use. Of course, you can choose to run applications over the network, correct?
1632 </p></li><li><p>
1633 Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
1634 NTP-based time synchronization software, drivers for specific local devices such as fingerprint
1635 scanners, and the like. Probably the most significant application for local installation
1636 is antivirus software.
1637 </p></li><li><p>
1638 Now install all four printers onto the staging system. The printers you install
1639 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers. You will
1640 also configure identical printers that are located in the financial services department.
1641 Install printers on each machine following the steps shown in the Windows client printer
1642 preparation procedure below.
1643 </p></li><li><p>
1645 When you are satisfied that the staging systems are complete, use the appropriate procedure to
1646 remove the client from the domain. Reboot the system and then log on as the local administrator
1647 and clean out all temporary files stored on the system. Before shutting down, use the disk
1648 defragmentation tool so that the file system is in optimal condition before replication.
1649 </p></li><li><p>
1650 Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the
1651 machine to a network share on the server.
1652 </p></li><li><p>
1655 You may now replicate the image to the target machines using the appropriate Norton Ghost
1656 procedure. Make sure to use the procedure that ensures each machine has a unique
1657 Windows security identifier (SID). When the installation of the disk image has completed, boot the PC.
1658 </p></li><li><p>
1659 Log on to the machine as the local Administrator (the only option), and join the machine to
1660 the Domain, following the procedure set out in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. The system is now
1661 ready for the user to log on, provided you have created a network logon account for that
1662 user, of course.
1663 </p></li><li><p>
1664 Instruct all users to log on to the workstation using their assigned username and password.
1665 </p></li></ol></div><div class="procedure"><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure 3.7. Windows Client Printer Preparation Procedure</b></p><ol type="1"><li><p>
1666 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
1668 </p></li><li><p>
1673 </p></li><li><p>
1676 <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a
1679 </p></li><li><p>
1680 You may be prompted for the name of a file to print to. If so, close the
1681 dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>.
1682 </p></li><li><p>
1684 the print queue on the Samba server as follows: <code class="constant">\\DIAMOND\hplj6a</code>.
1685 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
1686 </p></li><li><p>
1687 Repeat the printer installation steps above for both HP LaserJet 6 printers
1688 as well as for both QMS Magicolor laser printers.
1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568471"></a>Key Points Learned</h3></div></div></div><p>
1690 How do you feel? You have built a capable network, a truly ambitious project.
1691 Future network updates can be handled by
1692 your staff. You must be a satisfied manager. Let's review the achievements.
1694 A simple firewall has been configured to protect the server in the event that
1695 the ISP firewall service should fail.
1696 </p></li><li><p>
1697 The Samba configuration uses measures to ensure that only local network users
1698 can connect to SMB/CIFS services.
1699 </p></li><li><p>
1701 Considerable complexity was added to Samba functionality.
1702 </p></li><li><p>
1703 A DHCP server was configured to implement dynamic DNS (DDNS) updates to the DNS
1704 server.
1705 </p></li><li><p>
1706 The DNS server was configured to permit DDNS only for local network clients. This
1707 server also provides primary DNS services for the company Internet presence.
1708 </p></li><li><p>
1709 You introduced an application server as well as the concept of cloning a Windows
1710 client in order to effect improved standardization of desktops and to reduce
1711 the costs of network management.
1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2568533"></a>Questions and Answers</h2></div></div></div><p>
1714 What is the maximum number of account entries that the tdbsam
1715 passdb backend can handle?
1717 Would Samba operate any better if the OS level is set to a value higher than 35?
1719 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?
1721 Why has a path been specified in the IPC$ share?
1723 Why does the smb.conf file in this exercise include an entry for smb ports?
1725 What is the difference between a print queue and a printer?
1727 Can all MS Windows application software be installed onto an application server share?
1729 Why use dynamic DNS (DDNS)?
1731 Why would you use WINS as well as DNS-based name resolution?
1733 What are the major benefits of using an application server?
1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2568549"></a><a name="id2568551"></a><b>1.</b></td><td align="left" valign="top"><p>
1735 What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em>
1736 passdb backend can handle?
1737 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1738 The tdb data structure and support system can handle more entries than the number of
1739 accounts that are possible on most UNIX systems. A practical limit would come into
1740 play long before a performance boundary would be anticipated. That practical limit
1741 is controlled by the nature of Windows networking. There are few Windows file and
1742 print servers that can handle more than a few hundred concurrent client connections.
1743 The key limiting factors that predicate offloading of services to additional servers
1744 are memory capacity, the number of CPUs, network bandwidth, and disk I/O limitations.
1745 All of these are readily exhausted by just a few hundred concurrent active users.
1746 Such bottlenecks can best be removed by segmentation of the network (distributing
1747 network load across multiple networks).
1748 </p><p>
1749 As the network grows, it becomes necessary to provide additional authentication
1750 servers (domain controllers). The tdbsam is limited to a single machine and cannot
1751 be reliably replicated. This means that practical limits on network design dictate
1752 the point at which a distributed passdb backend is required; at this time, there is
1753 no real alternative other than ldapsam (LDAP).
1754 </p><p>
1755 The guideline provided in <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, Section 10.1.2,
1756 is to limit the number of accounts in the tdbsam backend to 250. This is the point
1757 at which most networks tend to want backup domain controllers (BDCs). Samba-3 does
1758 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The
1759 limitation of 250 users per tdbsam is predicated only on the need for replication,
1760 not on the limits<sup>[<a name="id2568607" href="#ftn.id2568607">8</a>]</sup> of the tdbsam backend itself.
1761 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568618"></a><a name="id2568620"></a><b>2.</b></td><td align="left" valign="top"><p>
1762 Would Samba operate any better if the OS level is set to a value higher than 35?
1763 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1764 No. MS Windows workstations and servers do not use a value higher than 33. Setting this to a value
1765 of 35 already assures Samba of precedence over MS Windows products in browser elections. There is
1766 no gain to be had from setting this higher.
1767 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568639"></a><a name="id2568642"></a><b>3.</b></td><td align="left" valign="top"><p>
1768 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?
1769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1770 At this time, Samba has the capacity to use only Domain Groups mappings. It is possible that at
1771 a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special
1772 Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups.
1773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568662"></a><a name="id2568664"></a><b>4.</b></td><td align="left" valign="top"><p>
1775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1776 This is done so that in the event that a software bug may permit a client connection to the IPC$ share to
1777 obtain access to the file system, it does so at a location that presents least risk. Under normal operation
1778 this type of paranoid step should not be necessary. The use of this parameter should not be necessary.
1779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568691"></a><a name="id2568693"></a><b>5.</b></td><td align="left" valign="top"><p>
1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="indexterm" name="id2568704"></a>smb ports?
1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1782 The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port
1783 used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS
1784 over TCP/IP. In this configuration Windows network operations are predicated around NetBIOS over TCP/IP. By
1785 specifying the use of only port 139, the intent is to reduce unsuccessful service connection attempts.
1786 The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain
1787 member, the default behavior is highly beneficial and should not be changed.
1788 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568732"></a><a name="id2568734"></a><b>6.</b></td><td align="left" valign="top"><p>
1789 What is the difference between a print queue and a printer?
1790 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1791 A printer is a physical device that is connected either directly to the network or to a computer
1792 via a serial, parallel, or USB connection so that print jobs can be submitted to it to create a
1793 hard copy printout. Network-attached printers that use TCP/IP-based printing generally accept a
1794 single print data stream and block all secondary attempts to dispatch jobs concurrently to the
1795 same device. If many clients were to concurrently print directly via TCP/IP to the same printer,
1796 it would result in a huge amount of network traffic through continually failing connection attempts.
1797 </p><p>
1798 A print server (like CUPS or LPR/LPD) accepts multiple concurrent input streams or
1799 print requests. When the data stream has been fully received, the input stream is closed,
1800 and the job is then submitted to a sequential print queue where the job is stored until
1801 the printer is ready to receive the job.
1802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568768"></a><a name="id2568770"></a><b>7.</b></td><td align="left" valign="top"><p>
1803 Can all MS Windows application software be installed onto an application server share?
1804 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1805 Much older Windows software is not compatible with installation to and execution from
1806 an application server. Enterprise versions of Microsoft Office XP Professional can
1807 be installed to an application server. Retail consumer versions of Microsoft Office XP
1808 Professional do not permit installation to an application server share and can be installed
1809 and used only to/from a local workstation hard disk.
1810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568792"></a><a name="id2568795"></a><b>8.</b></td><td align="left" valign="top"><p>
1811 Why use dynamic DNS (DDNS)?
1812 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1813 When DDNS records are updated directly from the DHCP server, it is possible for
1814 network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate
1815 Windows clients via DNS.
1816 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568813"></a><a name="id2568815"></a><b>9.</b></td><td align="left" valign="top"><p>
1817 Why would you use WINS as well as DNS-based name resolution?
1818 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1819 WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is
1820 a name like “<span class="quote">myhost.mydomain.tld</span>” where <em class="parameter"><code>tld</code></em>
1821 means <code class="constant">top-level domain</code>. A FQDN is a longhand but easy-to-remember
1822 expression that may be up to 1024 characters in length and that represents an IP address.
1824 is a name type indicator. A specific name type is registered<sup>[<a name="id2568850" href="#ftn.id2568850">9</a>]</sup> for each
1825 type of service that is provided by the Windows server or client and that may be registered
1826 where a WINS server is in use.
1827 </p><p>
1828 WINS is a mechanism by which a client may locate the IP Address that corresponds to a
1829 NetBIOS name. The WINS server may be queried to obtain the IP Address for a NetBIOS name
1830 that includes a particular registered NetBIOS name type. DNS does not provide a mechanism
1831 that permits handling of the NetBIOS name type information.
1832 </p><p>
1833 DNS provides a mechanism by which TCP/IP clients may locate the IP address of a particular
1834 hostname or service name that has been registered in the DNS database for a particular domain.
1835 A DNS server has limited scope of control and is said to be authoritative for the zone over
1836 which it has control.
1837 </p><p>
1838 Windows 200x Active Directory requires the registration in the DNS zone for the domain it
1839 controls of service locator<sup>[<a name="id2568884" href="#ftn.id2568884">10</a>]</sup> records
1840 that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also
1841 requires the registration of special records that are called global catalog (GC) entries
1842 and site entries by which domain controllers and other essential ADS servers may be located.
1843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2568897"></a><a name="id2568899"></a><b>10.</b></td><td align="left" valign="top"><p>
1844 What are the major benefits of using an application server?
1845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1846 The use of an application server can significantly reduce application update maintenance.
1847 By providing a centralized application share, software updates need be applied to only
1848 one location for all major applications used. This results in faster update roll-outs and
1849 significantly better application usage control.
1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2563122" href="#id2563122">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.
1851 This is necessary so that Samba can act as a Domain Controller (PDC); see
1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2563531" href="#id2563531">6</a>] </sup>You may want to do the echo command last and include
1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2567388" href="#id2567388">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,
1854 Chapter 23, Section 23.3. The single instance of <span><strong class="command">smbd</strong></span> is normal. One additional
1855 <span><strong class="command">smbd</strong></span> slave process is spawned for each SMB/CIFS client
1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2568607" href="#id2568607">8</a>] </sup>Bench tests have shown that tdbsam is a very
1857 effective database technology. There is surprisingly little performance loss even
1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2568850" href="#id2568850">9</a>] </sup>
1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2568884" href="#id2568884">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html>