release/src/router/samba3/docs/htmldocs/Samba3-HOWTO/FastStart.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Fast Start: Cure for Impatience</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.70.1"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="introduction.html" title="Part I. General Installation"><link rel="prev" href="install.html" title="Chapter 1. How to Install and Test SAMBA"><link rel="next" href="type.html" title="Part II. Server Configuration Basics"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Fast Start: Cure for Impatience</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><th width="60%" align="center">Part I. General Installation</th><td width="20%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="FastStart"></a>Chapter 2. Fast Start: Cure for Impatience</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="FastStart.html#id2557455">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2557479">Description of Example Sites</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2557559">Worked Examples</a></span></dt><dd><dl><dt><span class="sect2"><a href="FastStart.html#id2557577">Standalone Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2559547">Domain Member Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2560504">Domain Controller</a></span></dt></dl></dd></dl></div><p>
   2 When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
   3 someone wrote asking for example configurations  and lots of them. That is remarkably
   4 difficult to do without losing a lot of value that can be derived from presenting
   5 many extracts from working systems. That is what the rest of this document does.
   6 It does so with extensive descriptions of the configuration possibilities within the
   7 context of the chapter that covers it. We hope that this chapter is the medicine
   8 that has been requested.
   9 </p><p>
  10 The information in this chapter is very sparse compared with the book &#8220;<span class="quote">Samba-3 by Example</span>&#8221;
  11 that was written after the original version of this book was nearly complete. &#8220;<span class="quote">Samba-3 by Example</span>&#8221;
  12 was the result of feedback from reviewers during the final copy editing of the first edition. It
  13 was interesting to see that reader feedback mirrored that given by the original reviewers.
  14 In any case, a month and a half was spent in doing basic research to better understand what
  15 new as well as experienced network administrators would best benefit from. The book &#8220;<span class="quote">Samba-3 by Example</span>&#8221;
  16 is the result of that research. What is presented in the few pages of this book is covered
  17 far more comprehensively in the second edition of &#8220;<span class="quote">Samba-3 by Example</span>&#8221;. The second edition
  18 of both books will be released at the same time.
  19 </p><p>
  20 So in summary, the book &#8220;<span class="quote">The Official Samba-3 HOWTO &amp; Reference Guide</span>&#8221; is intended
  21 as the equivalent of an auto mechanic's repair guide. The book &#8220;<span class="quote">Samba-3 by Example</span>&#8221; is the
  22 equivalent of the driver's guide that explains how to drive the car. If you want complete network
  23 configuration examples, go to <a href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by
  24 Example</a>.
  25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2557455"></a>Features and Benefits</h2></div></div></div><p>
  26 Samba needs very little configuration to create a basic working system.
  27 In this chapter we progress from the simple to the complex, for each providing
  28 all steps and configuration file changes needed to make each work. Please note
  29 that a comprehensively configured system will likely employ additional smart
  30 features. These additional features are covered in the remainder of this document.
  31 </p><p>
  32 The examples used here have been obtained from a number of people who made
  33 requests for example configurations. All identities have been obscured to protect
  34 the guilty, and any resemblance to unreal nonexistent sites is deliberate.
  35 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2557479"></a>Description of Example Sites</h2></div></div></div><p>
  36 In the first set of configuration examples we consider the case of exceptionally simple system requirements.
  37 There is a real temptation to make something that should require little effort much too complex.
  38 </p><p>
  39 <a href="FastStart.html#anon-ro" title="Anonymous Read-Only Document Server">???</a> documents the type of server that might be sufficient to serve CD-ROM images,
  40 or reference document files for network client use. This configuration is also discussed in <a href="StandAloneServer.html" title="Chapter 7. Standalone Servers">???</a>, <a href="StandAloneServer.html#RefDocServer" title="Reference Documentation Server">???</a>.  The purpose for this configuration
  41 is to provide a shared volume that is read-only that anyone, even guests, can access.
  42 </p><p>
  43 The second example shows a minimal configuration for a print server that anyone can print to as long as they
  44 have the correct printer drivers installed on their computer. This is a mirror of the system described in
  45 <a href="StandAloneServer.html" title="Chapter 7. Standalone Servers">???</a>, <a href="StandAloneServer.html#SimplePrintServer" title="Central Print Serving">???</a>.
  46 </p><p>
  47 The next example is of a secure office file and print server that will be accessible only to users who have an
  48 account on the system. This server is meant to closely resemble a workgroup file and print server, but has to
  49 be more secure than an anonymous access machine.  This type of system will typically suit the needs of a small
  50 office. The server provides no network logon facilities, offers no domain control; instead it is just a
  51 network-attached storage (NAS) device and a print server.
  52 </p><p>
  53 The later example consider more complex systems that will either integrate into existing MS Windows networks
  54 or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and
  55 finally describes in detail a large distributed network with branch offices in remote locations.
  56 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2557559"></a>Worked Examples</h2></div></div></div><p>
  57 The configuration examples are designed to cover everything necessary to get Samba
  58 running. They do not cover basic operating system platform configuration, which is
  59 clearly beyond the scope of this text.
  60 </p><p>
  61 It is also assumed that Samba has been correctly installed, either by way of installation
  62 of the packages that are provided by the operating system vendor or through other means.
  63 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557577"></a>Standalone Server</h3></div></div></div><p>
  64         <a class="indexterm" name="id2557585"></a>
  65         A standalone server implies no more than the fact that it is not a domain controller
  66         and it does not participate in domain control. It can be a simple, workgroup-like
  67         server, or it can be a complex server that is a member of a domain security context.
  68         </p><p>
  69         As the examples are developed, every attempt is made to progress the system toward greater capability, just as
  70         one might expect would happen in a real business office as that office grows in size and its needs change.
  71         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p>
  72                 <a class="indexterm" name="id2557618"></a>
  73                 The purpose of this type of server is to make available to any user
  74                 any documents or files that are placed on the shared resource. The
  75                 shared resource could be a CD-ROM drive, a CD-ROM image, or a file
  76                 storage area.
  77                 </p><div class="itemizedlist"><ul type="disc"><li><p>
  78                         The file system share point will be <code class="filename">/export</code>.
  79                         </p></li><li><p>
  80                         All files will be owned by a user called Jack Baumbach.
  81                         Jack's login name will be <span class="emphasis"><em>jackb</em></span>. His password will be
  82                         <span class="emphasis"><em>m0r3pa1n</em></span>  of course, that's just the example we are
  83                         using; do not use this in a production environment because
  84                         all readers of this document will know it.
  85                         </p></li></ul></div><div class="procedure"><a name="id2557666"></a><p class="title"><b>Procedure 2.1. Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example 2.1. Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2557804"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2557817"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2557830"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2557852"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2557864"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2557877"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557890"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
  86                         Add user to system (with creation of the user's home directory):
  87 </p><pre class="screen">
  88 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
  89 </pre><p>
  90                         </p></li><li><p>
  91                         Create directory, and set permissions and ownership:
  92 </p><pre class="screen">
  93 <code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
  94 <code class="prompt">root# </code><strong class="userinput"><code>chmod u+rwx,g+rx,o+rx /export</code></strong>
  95 <code class="prompt">root# </code><strong class="userinput"><code>chown jackb.users /export</code></strong>
  96 </pre><p>
  97                         </p></li><li><p>
  98                         Copy the files that should be shared to the <code class="filename">/export</code>
  99                         directory.
 100                         </p></li><li><p>
 101                         Install the Samba configuration file (<code class="filename">/etc/samba/smb.conf</code>)
 102                         as shown in <a href="FastStart.html#anon-example" title="Example 2.1. Anonymous Read-Only Server Configuration">Anonymous Read-Only Server Configuration</a>.
 103                         </p></li><li><p>
 104                         Test the configuration file by executing the following command:
 105 </p><pre class="screen">
 106 <code class="prompt">root# </code><strong class="userinput"><code>testparm</code></strong>
 107 </pre><p>
 108                         Alternatively, where you are operating from a master configuration file called
 109                         <code class="filename">smb.conf.master</code>, the following sequence of commands might prove
 110                         more appropriate:
 111 </p><pre class="screen">
 112 <code class="prompt">root# </code> cd /etc/samba
 113 <code class="prompt">root# </code> testparm -s smb.conf.master &gt; smb.conf
 114 <code class="prompt">root# </code> testparm
 115 </pre><p>
 116                         Note any error messages that might be produced. Proceed only if error-free output has been
 117                         obtained. An example of typical output that should be generated from the above configuration
 118                         file is shown here:
 119 </p><pre class="screen">
 120 Load smb config files from /etc/samba/smb.conf
 121 Processing section "[data]"
 122 Loaded services file OK.
 123 Server role: ROLE_STANDALONE
 124 Press enter to see a dump of your service definitions
 125 <strong class="userinput"><code>[Press enter]</code></strong>
 126
 127 # Global parameters
 128 [global]
 129         workgroup = MIDEARTH
 130         netbios name = HOBBIT
 131         security = share
 132
 133 [data]
 134         comment = Data
 135         path = /export
 136         read only = Yes
 137         guest only = Yes
 138 </pre><p>
 139                         </p></li><li><p>
 140                         Start Samba using the method applicable to your operating system platform. The method that
 141                         should be used is platform dependent. Refer to <a href="compiling.html#startingSamba" title="Starting the smbd nmbd and winbindd">Starting Samba</a>
 142                         for further information regarding the starting of Samba.
 143                         </p></li><li><p>
 144                         Configure your MS Windows client for workgroup <span class="emphasis"><em>MIDEARTH</em></span>,
 145                         set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
 146                         then open Windows Explorer and visit the Network Neighborhood.
 147                         The machine HOBBIT should be visible. When you click this machine
 148                         icon, it should open up to reveal the <span class="emphasis"><em>data</em></span> share. After
 149                         you click the share, it should open up to reveal the files previously
 150                         placed in the <code class="filename">/export</code> directory.
 151                         </p></li></ol></div><p>
 152                 The information above (following # Global parameters) provides the complete
 153                 contents of the <code class="filename">/etc/samba/smb.conf</code> file.
 154                 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2558040"></a>Anonymous Read-Write Document Server</h4></div></div></div><p>
 155                 <a class="indexterm" name="id2558048"></a>
 156                 We should view this configuration as a progression from the previous example.
 157                 The difference is that shared access is now forced to the user identity of jackb
 158                 and to the primary group jackb belongs to. One other refinement we can make is to
 159                 add the user <span class="emphasis"><em>jackb</em></span> to the <code class="filename">smbpasswd</code> file.
 160                 To do this, execute:
 161 </p><pre class="screen">
 162 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a jackb</code></strong>
 163 New SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
 164 Retype new SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
 165 Added user jackb.
 166 </pre><p>
 167                 Addition of this user to the <code class="filename">smbpasswd</code> file allows all files
 168                 to be displayed in the Explorer Properties boxes as belonging to <span class="emphasis"><em>jackb</em></span>
 169                 instead of to <span class="emphasis"><em>User Unknown</em></span>.
 170                 </p><p>
 171                 The complete, modified <code class="filename">smb.conf</code> file is as shown in <a href="FastStart.html#anon-rw" title="Example 2.2. Modified Anonymous Read-Write smb.conf">???</a>.
 172                 </p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example 2.2. Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2558162"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2558175"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2558188"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2558209"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2558222"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2558235"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id2558247"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2558260"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2558273"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2558287"></a>Anonymous Print Server</h4></div></div></div><p>
 173                 <a class="indexterm" name="id2558295"></a>
 174                 An anonymous print server serves two purposes:
 175                 </p><div class="itemizedlist"><ul type="disc"><li><p>
 176                         It allows printing to all printers from a single location.
 177                         </p></li><li><p>
 178                         It reduces network traffic congestion due to many users trying
 179                         to access a limited number of printers.
 180                         </p></li></ul></div><p>
 181                 In the simplest of anonymous print servers, it is common to require the installation
 182                 of the correct printer drivers on the Windows workstation. In this case the print
 183                 server will be designed to just pass print jobs through to the spooler, and the spooler
 184                 should be configured to do raw pass-through to the printer. In other words, the print
 185                 spooler should not filter or process the data stream being passed to the printer.
 186                 </p><p>
 187                 In this configuration, it is undesirable to present the Add Printer Wizard, and we do
 188                 not want to have automatic driver download, so we disable it in the following
 189                 configuration. <a href="FastStart.html#anon-print" title="Example 2.3. Anonymous Print Server smb.conf">???</a> is the resulting <code class="filename">smb.conf</code> file.
 190                 </p><div class="example"><a name="anon-print"></a><p class="title"><b>Example 2.3. Anonymous Print Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2558379"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2558391"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id2558404"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id2558417"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2558430"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558443"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2558456"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2558478"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2558490"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2558503"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558516"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558529"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558542"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>
 191                 The above configuration is not ideal. It uses no smart features, and it deliberately
 192                 presents a less than elegant solution. But it is basic, and it does print. Samba makes
 193                 use of the direct printing application program interface that is provided by CUPS.
 194                 When Samba has been compiled and linked with the CUPS libraries, the default printing
 195                 system will be CUPS. By specifying that the printcap name is CUPS, Samba will use
 196                 the CUPS library API to communicate directly with CUPS for all printer functions.
 197                 It is possible to force the use of external printing commands by setting the value
 198                 of the <em class="parameter"><code>printing</code></em> to either SYSV or BSD, and thus the value of
 199                 the parameter <em class="parameter"><code>printcap name</code></em> must be set to something other than
 200                 CUPS. In such case, it could be set to the name of any file that contains a list
 201                 of printers that should be made available to Windows clients.
 202                 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
 203                 Windows users will need to install a local printer and then change the print
 204                 to device after installation of the drivers. The print to device can then be set to
 205                 the network printer on this machine.
 206                 </p></div><p>
 207                 Make sure that the directory <code class="filename">/var/spool/samba</code> is capable of being used
 208                 as intended. The following steps must be taken to achieve this:
 209                 </p><div class="itemizedlist"><ul type="disc"><li><p>
 210                         The directory must be owned by the superuser (root) user and group:
 211 </p><pre class="screen">
 212 <code class="prompt">root# </code><strong class="userinput"><code>chown root.root /var/spool/samba</code></strong>
 213 </pre><p>
 214                         </p></li><li><p>
 215                         Directory permissions should be set for public read-write with the
 216                         sticky bit set as shown:
 217 </p><pre class="screen">
 218 <code class="prompt">root# </code><strong class="userinput"><code>chmod a+twrx /var/spool/samba</code></strong>
 219 </pre><p>
 220                 The purpose of setting the sticky bit is to prevent who does not own the temporary print file
 221                 from being able to take control of it with the potential for devious misuse.
 222                         </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
 223                 <a class="indexterm" name="id2558658"></a>
 224                 <a class="indexterm" name="id2558667"></a>
 225                 On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
 226                 intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
 227                 it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
 228                 handler in the <code class="filename">/etc/mime.conv</code> and <code class="filename">/etc/mime.types</code>
 229                 files. Refer to <a href="CUPS-printing.html#cups-raw" title="Explicitly Enable &#8220;raw&#8221; Printing for application/octet-stream">???</a>.
 230                 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2558700"></a>Secure Read-Write File and Print Server</h4></div></div></div><p>
 231                 We progress now from simple systems to a server that is slightly more complex.
 232                 </p><p>
 233                 Our new server will require a public data storage area in which only authenticated
 234                 users (i.e., those with a local account) can store files, as well as a home directory.
 235                 There will be one printer that should be available for everyone to use.
 236                 </p><p>
 237                 In this hypothetical environment (no espionage was conducted to obtain this data),
 238                 the site is demanding a simple environment that is <span class="emphasis"><em>secure enough</em></span>
 239                 but not too difficult to use.
 240                 </p><p>
 241                 Site users will be Jack Baumbach, Mary Orville, and Amed Sehkah. Each will have
 242                 a password (not shown in further examples). Mary will be the printer administrator and will
 243                 own all files in the public share.
 244                 </p><p>
 245                 This configuration will be based on <span class="emphasis"><em>user-level security</em></span> that
 246                 is the default, and for which the default is to store Microsoft Windows-compatible
 247                 encrypted passwords in a file called <code class="filename">/etc/samba/smbpasswd</code>.
 248                 The default <code class="filename">smb.conf</code> entry that makes this happen is
 249                 <a class="indexterm" name="id2558757"></a>passdb backend = smbpasswd, guest. Since this is the default,
 250                 it is not necessary to enter it into the configuration file. Note that the guest backend is
 251                 added to the list of active passdb backends no matter whether it specified directly in Samba configuration
 252                 file or not.
 253                 </p><div class="procedure"><a name="id2558770"></a><p class="title"><b>Procedure 2.2. Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example 2.4. Secure Office Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2558877"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2558890"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id2558903"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2558916"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558928"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2558942"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2558963"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2558976"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2558989"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2559001"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2559023"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2559036"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2559048"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2559061"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2559074"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2559095"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2559108"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2559121"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2559134"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2559146"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2559159"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2559172"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2559185"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
 254                 <a class="indexterm" name="id2558782"></a>
 255                         Add all users to the operating system:
 256 </p><pre class="screen">
 257 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
 258 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Mary Orville" -m -g users -p secret maryo</code></strong>
 259 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Amed Sehkah" -m -g users -p secret ameds</code></strong>
 260 </pre><p>
 261                         </p></li><li><p>
 262                         Configure the Samba <code class="filename">smb.conf</code> file as shown in <a href="FastStart.html#OfficeServer" title="Example 2.4. Secure Office Server smb.conf">???</a>.
 263                         </p></li><li><p>
 264                         Initialize the Microsoft Windows password database with the new users:
 265 </p><pre class="screen">
 266 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a root</code></strong>
 267 New SMB password: <strong class="userinput"><code>bigsecret</code></strong>
 268 Reenter smb password: <strong class="userinput"><code>bigsecret</code></strong>
 269 Added user root.
 270
 271 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a jackb</code></strong>
 272 New SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
 273 Retype new SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
 274 Added user jackb.
 275
 276 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a maryo</code></strong>
 277 New SMB password: <strong class="userinput"><code>secret</code></strong>
 278 Reenter smb password: <strong class="userinput"><code>secret</code></strong>
 279 Added user maryo.
 280
 281 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a ameds</code></strong>
 282 New SMB password: <strong class="userinput"><code>mysecret</code></strong>
 283 Reenter smb password: <strong class="userinput"><code>mysecret</code></strong>
 284 Added user ameds.
 285 </pre><p>
 286                         </p></li><li><p>
 287                         Install printer using the CUPS Web interface. Make certain that all
 288                         printers that will be shared with Microsoft Windows clients are installed
 289                         as raw printing devices.
 290                         </p></li><li><p>
 291                         Start Samba using the operating system administrative interface.
 292                         Alternately, this can be done manually by executing:
 293                         <a class="indexterm" name="id2559323"></a>
 294                         <a class="indexterm" name="id2559330"></a>
 295                         <a class="indexterm" name="id2559337"></a>
 296                         <a class="indexterm" name="id2559346"></a>
 297 </p><pre class="screen">
 298 <code class="prompt">root# </code><strong class="userinput"><code> nmbd; smbd;</code></strong>
 299 </pre><p>
 300                         Both applications automatically execute as daemons. Those who are paranoid about
 301                         maintaining control can add the <code class="constant">-D</code> flag to coerce them to start
 302                         up in daemon mode.
 303                         </p></li><li><p>
 304                         Configure the <code class="filename">/export</code> directory:
 305 </p><pre class="screen">
 306 <code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
 307 <code class="prompt">root# </code><strong class="userinput"><code>chown maryo.users /export</code></strong>
 308 <code class="prompt">root# </code><strong class="userinput"><code>chmod u=rwx,g=rwx,o-rwx /export</code></strong>
 309 </pre><p>
 310                         </p></li><li><p>
 311                         Check that Samba is running correctly:
 312 </p><pre class="screen">
 313 <code class="prompt">root# </code><strong class="userinput"><code>smbclient -L localhost -U%</code></strong>
 314 Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.20]
 315
 316 Sharename      Type      Comment
 317 ---------      ----      -------
 318 public         Disk      Data
 319 IPC$           IPC       IPC Service (Samba-3.0.20)
 320 ADMIN$         IPC       IPC Service (Samba-3.0.20)
 321 hplj4          Printer   hplj4
 322
 323 Server               Comment
 324 ---------            -------
 325 OLORIN               Samba-3.0.20
 326
 327 Workgroup            Master
 328 ---------            -------
 329 MIDEARTH             OLORIN
 330 </pre><p>
 331                         The following error message indicates that Samba was not running:
 332 </p><pre class="screen">
 333 <code class="prompt">root# </code> smbclient -L olorin -U%
 334 Error connecting to 192.168.1.40 (Connection refused)
 335 Connection to olorin failed
 336 </pre><p>
 337                         </p></li><li><p>
 338                         Connect to OLORIN as maryo:
 339 </p><pre class="screen">
 340 <code class="prompt">root# </code><strong class="userinput"><code>smbclient //olorin/maryo -Umaryo%secret</code></strong>
 341 OS=[UNIX] Server=[Samba-3.0.20]
 342 smb: \&gt; <strong class="userinput"><code>dir</code></strong>
 343 .                              D        0  Sat Jun 21 10:58:16 2003
 344 ..                             D        0  Sat Jun 21 10:54:32 2003
 345 Documents                      D        0  Fri Apr 25 13:23:58 2003
 346 DOCWORK                        D        0  Sat Jun 14 15:40:34 2003
 347 OpenOffice.org                 D        0  Fri Apr 25 13:55:16 2003
 348 .bashrc                        H     1286  Fri Apr 25 13:23:58 2003
 349 .netscape6                    DH        0  Fri Apr 25 13:55:13 2003
 350 .mozilla                      DH        0  Wed Mar  5 11:50:50 2003
 351 .kermrc                        H      164  Fri Apr 25 13:23:58 2003
 352 .acrobat                      DH        0  Fri Apr 25 15:41:02 2003
 353
 354                 55817 blocks of size 524288. 34725 blocks available
 355 smb: \&gt; <strong class="userinput"><code>q</code></strong>
 356 </pre><p>
 357                         </p></li></ol></div><p>
 358                         By now you should be getting the hang of configuration basics. Clearly, it is time to
 359                         explore slightly more complex examples. For the remainder of this chapter we abbreviate
 360                         instructions, since there are previous examples.
 361                         </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2559547"></a>Domain Member Server</h3></div></div></div><p>
 362         <a class="indexterm" name="id2559555"></a>
 363         In this instance we consider the simplest server configuration we can get away with
 364         to make an accounting department happy. Let's be warned, the users are accountants and they
 365         do have some nasty demands. There is a budget for only one server for this department.
 366         </p><p>
 367         The network is managed by an internal Information Services Group (ISG), to which we belong.
 368         Internal politics are typical of a medium-sized organization; Human Resources is of the
 369         opinion that they run the ISG because they are always adding and disabling users. Also,
 370         departmental managers have to fight tooth and nail to gain basic network resources access for
 371         their staff. Accounting is different, though, they get exactly what they want. So this should
 372         set the scene.
 373         </p><p>
 374         We use the users from the last example. The accounting department
 375         has a general printer that all departmental users may use. There is also a check printer
 376         that may be used only by the person who has authority to print checks. The chief financial
 377         officer (CFO) wants that printer to be completely restricted and for it to be located in the
 378         private storage area in her office. It therefore must be a network printer.
 379         </p><p>
 380         The accounting department uses an accounting application called <span class="emphasis"><em>SpytFull</em></span>
 381         that must be run from a central application server. The software is licensed to run only off
 382         one server, there are no workstation components, and it is run off a mapped share. The data
 383         store is in a UNIX-based SQL backend. The UNIX gurus look after that, so this is not our
 384         problem.
 385         </p><p>
 386         The accounting department manager (maryo) wants a general filing system as well as a separate
 387         file storage area for form letters (nastygrams). The form letter area should be read-only to
 388         all accounting staff except the manager. The general filing system has to have a structured
 389         layout with a general area for all staff to store general documents as well as a separate
 390         file area for each member of her team that is private to that person, but she wants full
 391         access to all areas. Users must have a private home share for personal work-related files
 392         and for materials not related to departmental operations.
 393         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2559619"></a>Example Configuration</h4></div></div></div><p>
 394                 The server <span class="emphasis"><em>valinor</em></span> will be a member server of the company domain.
 395                 Accounting will have only a local server. User accounts will be on the domain controllers,
 396                 as will desktop profiles and all network policy files.
 397                 </p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example 2.5. Member Server smb.conf (Globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2559704"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2559716"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id2559729"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2559742"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2559755"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2559768"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2559781"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2559794"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2559807"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2559820"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example 2.6. Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2559858"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2559871"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2559883"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2559896"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id2559918"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id2559931"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id2559943"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2559956"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2559969"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2559990"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2560003"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id2560016"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2560038"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2560050"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2560063"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2560076"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2560089"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560101"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560114"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560127"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
 398                         Do not add users to the UNIX/Linux server; all of this will run off the
 399                         central domain.
 400                         </p></li><li><p>
 401                         Configure <code class="filename">smb.conf</code> according to <a href="FastStart.html#fast-member-server" title="Example 2.5. Member Server smb.conf (Globals)">Member server smb.conf
 402                         (globals)</a> and <a href="FastStart.html#fast-memberserver-shares" title="Example 2.6. Member Server smb.conf (Shares and Services)">Member server smb.conf (shares
 403                         and services)</a>.
 404                         </p></li><li><p>
 405                         <a class="indexterm" name="id2560146"></a>
 406                         Join the domain. Note: Do not start Samba until this step has been completed!
 407 </p><pre class="screen">
 408 <code class="prompt">root# </code><strong class="userinput"><code>net rpc join -Uroot%'bigsecret'</code></strong>
 409 Joined domain MIDEARTH.
 410 </pre><p>
 411                         </p></li><li><p>
 412                         Make absolutely certain that you disable (shut down) the <span><strong class="command">nscd</strong></span>
 413                         daemon on any system on which <span><strong class="command">winbind</strong></span> is configured to run.
 414                         </p></li><li><p>
 415                         Start Samba following the normal method for your operating system platform.
 416                         If you wish to do this manually, execute as root:
 417                         <a class="indexterm" name="id2560203"></a>
 418                         <a class="indexterm" name="id2560210"></a>
 419                         <a class="indexterm" name="id2560217"></a>
 420                         <a class="indexterm" name="id2560224"></a>
 421                         <a class="indexterm" name="id2560233"></a>
 422                         <a class="indexterm" name="id2560242"></a>
 423 </p><pre class="screen">
 424 <code class="prompt">root# </code><strong class="userinput"><code>nmbd; smbd; winbindd;</code></strong>
 425 </pre><p>
 426                         </p></li><li><p>
 427                         Configure the name service switch (NSS) control file on your system to resolve user and group names
 428                         via winbind. Edit the following lines in <code class="filename">/etc/nsswitch.conf</code>:
 429 </p><pre class="programlisting">
 430 passwd: files winbind
 431 group:  files winbind
 432 hosts:  files dns winbind
 433 </pre><p>
 434                         </p></li><li><p>
 435                         Set the password for <span><strong class="command">wbinfo</strong></span> to use:
 436 </p><pre class="screen">
 437 <code class="prompt">root# </code><strong class="userinput"><code>wbinfo --set-auth-user=root%'bigsecret'</code></strong>
 438 </pre><p>
 439                         </p></li><li><p>
 440                         Validate that domain user and group credentials can be correctly resolved by executing:
 441 </p><pre class="screen">
 442 <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -u</code></strong>
 443 MIDEARTH\maryo
 444 MIDEARTH\jackb
 445 MIDEARTH\ameds
 446 ...
 447 MIDEARTH\root
 448
 449 <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -g</code></strong>
 450 MIDEARTH\Domain Users
 451 MIDEARTH\Domain Admins
 452 MIDEARTH\Domain Guests
 453 ...
 454 MIDEARTH\Accounts
 455 </pre><p>
 456                         </p></li><li><p>
 457                         Check that <span><strong class="command">winbind</strong></span> is working. The following demonstrates correct
 458                         username resolution via the <span><strong class="command">getent</strong></span> system utility:
 459 </p><pre class="screen">
 460 <code class="prompt">root# </code><strong class="userinput"><code>getent passwd maryo</code></strong>
 461 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
 462 </pre><p>
 463                         </p></li><li><p>
 464                         A final test that we have this under control might be reassuring:
 465 </p><pre class="screen">
 466 <code class="prompt">root# </code><strong class="userinput"><code>touch /export/a_file</code></strong>
 467 <code class="prompt">root# </code><strong class="userinput"><code>chown maryo /export/a_file</code></strong>
 468 <code class="prompt">root# </code><strong class="userinput"><code>ls -al /export/a_file</code></strong>
 469 ...
 470 -rw-r--r--    1 maryo    users       11234 Jun 21 15:32 a_file
 471 ...
 472
 473 <code class="prompt">root# </code><strong class="userinput"><code>rm /export/a_file</code></strong>
 474 </pre><p>
 475                         </p></li><li><p>
 476                         Configuration is now mostly complete, so this is an opportune time
 477                         to configure the directory structure for this site:
 478 </p><pre class="screen">
 479 <code class="prompt">root# </code><strong class="userinput"><code>mkdir -p /export/{spytfull,public}</code></strong>
 480 <code class="prompt">root# </code><strong class="userinput"><code>chmod ug=rwxS,o=x /export/{spytfull,public}</code></strong>
 481 <code class="prompt">root# </code><strong class="userinput"><code>chown maryo.Accounts /export/{spytfull,public}</code></strong>
 482 </pre><p>
 483                         </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2560504"></a>Domain Controller</h3></div></div></div><p>
 484         <a class="indexterm" name="id2560511"></a>
 485         For the remainder of this chapter the focus is on the configuration of domain control.
 486         The examples that follow are for two implementation strategies. Remember, our objective is
 487         to create a simple but working solution. The remainder of this book should help to highlight
 488         opportunity for greater functionality and the complexity that goes with it.
 489         </p><p>
 490         A domain controller configuration can be achieved with a simple configuration using the new
 491         tdbsam password backend. This type of configuration is good for small
 492         offices, but has limited scalability (cannot be replicated), and performance can be expected
 493         to fall as the size and complexity of the domain increases.
 494         </p><p>
 495         The use of tdbsam is best limited to sites that do not need
 496         more than a Primary Domain Controller (PDC). As the size of a domain grows the need
 497         for additional domain controllers becomes apparent. Do not attempt to under-resource
 498         a Microsoft Windows network environment; domain controllers provide essential
 499         authentication services. The following are symptoms of an under-resourced domain control
 500         environment:
 501         </p><div class="itemizedlist"><ul type="disc"><li><p>
 502                  Domain logons intermittently fail.
 503                 </p></li><li><p>
 504                 File access on a domain member server intermittently fails, giving a permission denied
 505                 error message.
 506                 </p></li></ul></div><p>
 507         A more scalable domain control authentication backend option might use
 508         Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
 509         for both options as a domain member server. As a PDC, Samba-3 is not able to provide
 510         an exact alternative to the functionality that is available with Active Directory.
 511         Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
 512         </p><p>
 513         The tdbsam authentication backend provides no facility to replicate
 514         the contents of the database, except by external means (i.e., there is no self-contained protocol
 515         in Samba-3 for Security Account Manager database [SAM] replication).
 516         </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
 517         If you need more than one domain controller, do not use a tdbsam authentication backend.
 518         </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2560584"></a>Example: Engineering Office</h4></div></div></div><p>
 519                 The engineering office network server we present here is designed to demonstrate use
 520                 of the new tdbsam password backend. The tdbsam
 521                 facility is new to Samba-3. It is designed to provide many user and machine account controls
 522                 that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
 523                 </p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example 2.7. Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560660"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2560672"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2560685"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2560698"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2560711"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id2560724"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id2560738"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id2560751"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id2560764"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2560778"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2560791"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id2560814"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id2560832"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560844"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2560857"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560870"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560883"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2560895"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560908"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560921"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2560934"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2560947"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example 2.8. Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2560986"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2560998"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2561011"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561023"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561049"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2561062"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561075"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561088"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2561100"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561113"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561126"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2561147"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2561160"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2561173"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id2561186"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2561212"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2561225"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2561238"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561250"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561263"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td>#  shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2561293"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2561306"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2561319"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561332"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
 524                         A working PDC configuration using the tdbsam
 525                         password backend can be found in <a href="FastStart.html#fast-engoffice-global" title="Example 2.7. Engineering Office smb.conf (globals)">Engineering Office smb.conf
 526                         (globals)</a> together with <a href="FastStart.html#fast-engoffice-shares" title="Example 2.8. Engineering Office smb.conf (shares and services)">Engineering Office smb.conf
 527                         (shares and services)</a>:
 528                         <a class="indexterm" name="id2560628"></a>
 529                         </p></li><li><p>
 530                         Create UNIX group accounts as needed using a suitable operating system tool:
 531 </p><pre class="screen">
 532 <code class="prompt">root# </code><strong class="userinput"><code>groupadd ntadmins</code></strong>
 533 <code class="prompt">root# </code><strong class="userinput"><code>groupadd designers</code></strong>
 534 <code class="prompt">root# </code><strong class="userinput"><code>groupadd engineers</code></strong>
 535 <code class="prompt">root# </code><strong class="userinput"><code>groupadd qateam</code></strong>
 536 </pre><p>
 537                         </p></li><li><p>
 538                         Create user accounts on the system using the appropriate tool
 539                         provided with the operating system. Make sure all user home directories
 540                         are created also. Add users to groups as required for access control
 541                         on files, directories, printers, and as required for use in the Samba
 542                         environment.
 543                         </p></li><li><p>
 544                         <a class="indexterm" name="id2561423"></a>
 545                         <a class="indexterm" name="id2561432"></a>
 546                         Assign each of the UNIX groups to NT groups by executing this shell script
 547                         (You could name the script <code class="filename">initGroups.sh</code>):
 548 </p><pre class="screen">
 549 #!/bin/bash
 550 #### Keep this as a shell script for future re-use
 551
 552 # First assign well known groups
 553 net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins rid=512 type=d
 554 net groupmap add ntgroup="Domain Users"  unixgroup=users rid=513 type=
 555 net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
 556
 557 # Now for our added Domain Groups
 558 net groupmap add ntgroup="Designers" unixgroup=designers type=d
 559 net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
 560 net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d
 561 </pre><p>
 562                         </p></li><li><p>
 563                         Create the <code class="filename">scripts</code> directory for use in the
 564                         <em class="parameter"><code>[NETLOGON]</code></em> share:
 565 </p><pre class="screen">
 566 <code class="prompt">root# </code><strong class="userinput"><code>mkdir -p /var/lib/samba/netlogon/scripts</code></strong>
 567 </pre><p>
 568                         Place the logon scripts that will be used (batch or cmd scripts)
 569                         in this directory.
 570                         </p></li></ol></div><p>
 571                 The above configuration provides a functional PDC
 572                 system to which must be added file shares and printers as required.
 573                 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2561508"></a>A Big Organization</h4></div></div></div><p>
 574                 In this section we finally get to review in brief a Samba-3 configuration that
 575                 uses a Lightweight Directory Access (LDAP)-based authentication backend. The
 576                 main reasons for this choice are to provide the ability to host primary
 577                 and Backup Domain Control (BDC), as well as to enable a higher degree of
 578                 scalability to meet the needs of a very distributed environment.
 579                 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2561523"></a>The Primary Domain Controller</h5></div></div></div><p>
 580                         This is an example of a minimal configuration to run a Samba-3 PDC
 581                         using an LDAP authentication backend. It is assumed that the operating system
 582                         has been correctly configured.
 583                         </p><p>
 584                         The Idealx scripts (or equivalent) are needed to manage LDAP-based POSIX and/or
 585                         SambaSamAccounts. The Idealx scripts may be downloaded from the <a href="http://www.idealx.org" target="_top">
 586                         Idealx</a> Web site. They may also be obtained from the Samba tarball. Linux
 587                         distributions tend to install the Idealx scripts in the
 588                         <code class="filename">/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</code> directory.
 589                         Idealx scripts version <code class="constant">smbldap-tools-0.9.1</code> are known to work well.
 590                         </p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example 2.9. LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561768"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2561781"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2561794"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2561807"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2561820"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561833"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561847"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id2561860"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561874"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561887"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561901"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561915"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561929"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561943"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2561956"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561969"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2561981"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561994"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562007"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2562020"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562032"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562045"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2562058"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562071"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562084"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562097"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562110"></a><em class="parameter"><code>ldap admin dn = cn=Manager</code></em></td></tr><tr><td><a class="indexterm" name="id2562123"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2562136"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562149"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562162"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562175"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
 591                                 Obtain from the Samba sources <code class="filename">~/examples/LDAP/samba.schema</code>
 592                                 and copy it to the <code class="filename">/etc/openldap/schema/</code> directory.
 593                                 </p></li><li><p>
 594                                 Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
 595                                 The <code class="filename">/etc/openldap/slapd.conf</code> file.
 596                                 <a class="indexterm" name="id2561598"></a>
 597 <font color="red">&lt;title&gt;Example slapd.conf File&lt;/title&gt;</font>
 598 </p><pre class="screen">
 599 # Note commented out lines have been removed
 600 include         /etc/openldap/schema/core.schema
 601 include         /etc/openldap/schema/cosine.schema
 602 include         /etc/openldap/schema/inetorgperson.schema
 603 include         /etc/openldap/schema/nis.schema
 604 include         /etc/openldap/schema/samba.schema
 605
 606 pidfile         /var/run/slapd/slapd.pid
 607 argsfile        /var/run/slapd/slapd.args
 608
 609 database        bdb
 610 suffix          "dc=quenya,dc=org"
 611 rootdn          "cn=Manager,dc=quenya,dc=org"
 612 rootpw          {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
 613 # The password for the above is 'nastyon3'
 614
 615 directory     /var/lib/ldap
 616
 617 index   objectClass     eq
 618 index cn                      pres,sub,eq
 619 index sn                      pres,sub,eq
 620 index uid                     pres,sub,eq
 621 index displayName             pres,sub,eq
 622 index uidNumber               eq
 623 index gidNumber               eq
 624 index memberUid               eq
 625 index   sambaSID              eq
 626 index   sambaPrimaryGroupSID  eq
 627 index   sambaDomainName       eq
 628 index   default               sub
 629 </pre><p>
 630                                 </p></li><li><p>
 631                                 Create the following file <code class="filename">initdb.ldif</code>:
 632                                 <a class="indexterm" name="id2561645"></a>
 633 </p><pre class="programlisting">
 634 # Organization for SambaXP Demo
 635 dn: dc=quenya,dc=org
 636 objectclass: dcObject
 637 objectclass: organization
 638 dc: quenya
 639 o: SambaXP Demo
 640 description: The SambaXP Demo LDAP Tree
 641
 642 # Organizational Role for Directory Management
 643 dn: cn=Manager,dc=quenya,dc=org
 644 objectclass: organizationalRole
 645 cn: Manager
 646 description: Directory Manager
 647
 648 # Setting up the container for users
 649 dn: ou=People, dc=quenya, dc=org
 650 objectclass: top
 651 objectclass: organizationalUnit
 652 ou: People
 653
 654 # Set up an admin handle for People OU
 655 dn: cn=admin, ou=People, dc=quenya, dc=org
 656 cn: admin
 657 objectclass: top
 658 objectclass: organizationalRole
 659 objectclass: simpleSecurityObject
 660 userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
 661 # The password for above is 'mordonL8'
 662 </pre><p>
 663                                 </p></li><li><p>
 664                                 Load the initial data above into the LDAP database:
 665 </p><pre class="screen">
 666 <code class="prompt">root# </code><strong class="userinput"><code>slapadd -v -l initdb.ldif</code></strong>
 667 </pre><p>
 668                                 </p></li><li><p>
 669                                 Start the LDAP server using the appropriate tool or method for
 670                                 the operating system platform on which it is installed.
 671                                 </p></li><li><p>
 672                                 Install the Idealx script files in the <code class="filename">/usr/local/sbin</code> directory,
 673                                 then configure the smbldap_conf.pm file to match your system configuration.
 674                                 </p></li><li><p>
 675                                 The <code class="filename">smb.conf</code> file that drives this backend can be found in example <a href="FastStart.html#fast-ldap" title="Example 2.9. LDAP backend smb.conf for PDC">LDAP backend smb.conf for PDC</a>. Add additional stanzas
 676                                 as required.
 677                                 </p></li><li><p>
 678                                 Add the LDAP password to the <code class="filename">secrets.tdb</code> file so Samba can update
 679                                 the LDAP database:
 680 </p><pre class="screen">
 681 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -w mordonL8</code></strong>
 682 </pre><p>
 683                                 </p></li><li><p>
 684                                 Add users and groups as required. Users and groups added using Samba tools
 685                                 will automatically be added to both the LDAP backend and the operating
 686                                 system as required.
 687                                 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2562230"></a>Backup Domain Controller</h5></div></div></div><p>
 688                         <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">???</a> shows the example configuration for the BDC. Note that
 689                         the <code class="filename">smb.conf</code> file does not specify the smbldap-tools scripts  they are
 690                         not needed on a BDC. Add additional stanzas for shares and printers as required.
 691                         </p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example 2.10. Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562310"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2562322"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2562335"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2562349"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2562362"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2562375"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2562388"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2562401"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2562413"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2562426"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562439"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id2562452"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562465"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562477"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2562490"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562503"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562516"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562530"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2562543"></a><em class="parameter"><code>ldap admin dn = cn=Manager</code></em></td></tr><tr><td><a class="indexterm" name="id2562556"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2562568"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562581"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562594"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562607"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
 692                                 Decide if the BDC should have its own LDAP server or not. If the BDC is to be
 693                                 the LDAP server, change the following <code class="filename">smb.conf</code> as indicated. The default
 694                                 configuration in <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">Remote LDAP BDC smb.conf</a>
 695                                 uses a central LDAP server.
 696                                 </p></li><li><p>
 697                                 Configure the NETLOGON and PROFILES directory as for the PDC in <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">???</a>.
 698                                 </p></li></ol></div></div></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="introduction.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 1. How to Install and Test SAMBA </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Part II. Server Configuration Basics</td></tr></table></div></body></html>