1 <chapter id="StandAloneServer">
5 <title>Stand-Alone Servers</title>
8 Stand-Alone servers are independant of Domain Controllers on the network.
9 They are NOT domain members and function more like workgroup servers. In many
10 cases a stand-alone server is configured with a minimum of security control
11 with the intent that all data served will be readilly accessible to all users.
15 <title>Features and Benefits</title>
18 Stand-Alone servers can be as secure or as insecure as needs dictate. They can
19 have simple or complex configurations. Above all, despite the hoopla about
20 Domain security they remain a very common installation.
24 If all that is needed is a server for read-only files, or for
25 printers alone, it may not make sense to affect a complex installation.
26 For example: A drafting office needs to store old drawings and reference
27 standards. No-one can write files to the server as it is legislatively
28 important that all documents remain unaltered. A share mode read-only stand-alone
29 server is an ideal solution.
33 Another situation that warrants simplicity is an office that has many printers
34 that are queued off a single central server. Everyone needs to be able to print
35 to the printers, there is no need to affect any access controls and no files will
36 be served from the print server. Again a share mode stand-alone server makes
42 <title>Background</title>
45 The term <emphasis>stand-alone server</emphasis> means that the server
46 will provide local authentication and access control for all resources
47 that are available from it. In general this means that there will be a
48 local user database. In more technical terms, it means that resources
49 on the machine will be made available in either SHARE mode or in
54 No special action is needed other than to create user accounts. Stand-alone
55 servers do NOT provide network logon services. This means that machines that
56 use this server do NOT perform a domain log onto it. Whatever logon facility
57 the workstations are subject to is independant of this machine. It is however
58 necessary to accomodate any network user so that the logon name they use will
59 be translated (mapped) locally on the stand-alone server to a locally known
60 user name. There are several ways this cane be done.
64 Samba tends to blur the distinction a little in respect of what is
65 a stand-alone server. This is because the authentication database may be
66 local or on a remote server, even if from the samba protocol perspective
67 the samba server is NOT a member of a domain security context.
71 Through the use of PAM (Pluggable Authentication Modules) and nsswitch
72 (the name service switcher) the source of authentication may reside on
73 another server. We would be inclined to call this the authentication server.
74 This means that the samba server may use the local Unix/Linux system password database
75 (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use
76 an LDAP back end, or even via PAM and Winbind another CIFS/SMB server
83 <title>Example Configuration</title>
86 The following examples are designed to inspire simplicity. It is too easy to
87 attempt a high level of creativity and to introduce too much complexity in
88 server and network design.
92 <title>Reference Documentation Server</title>
95 Configuration of a read-only data server that EVERYONE can access is very simple.
96 Here is the smb.conf file that will do this. Assume that all the reference documents
97 are stored in the directory /export, that the documents are owned by a user other than
98 nobody. No home directories are shared, that are no users in the <filename>/etc/passwd</filename>
99 Unix system database. This is a very simple system to administer.
104 <title>Share Mode Read Only Stand-Alone Server</title>
108 netbios name = REFDOCS
110 passdb backend = guest
111 wins server = 192.168.1.1
121 In the above example the machine name is set to REFDOCS, the workgroup is set to the name
122 of the local workgroup so that the machine will appear in with systems users are familiar
123 with. The only password backend required is the "guest" backend so as to allow default
124 unprivilidged account names to be used. Given that there is a WINS server on this network
131 <title>Central Print Serving</title>
134 Configuration of a simple print server is very simple if you have all the right tools
139 <title> Assumptions:</title>
141 The print server must require no administration
145 The print spooling and processing system on our print server will be CUPS.
146 (Please refer to the chapter on printing for more information).
150 All printers will that the print server will service will be network
151 printers. They will be correctly configured, by the administrator,
152 in the CUPS environment.
156 All workstations will be installed using postscript drivers. The printer
157 of choice is the Apple Color LaserWriter.
162 In this example our print server will spool all incoming print jobs to
163 <filename>/var/spool/samba</filename> until the job is ready to be submitted by
164 samba to the CUPS print processor. Since all incoming connections will be as
165 the anonymous (guest) user two things will be required:
169 <title>Enablement for Anonymous Printing</title>
171 The Unix/Linux system must have a <command>guest</command> account.
172 The default for this is usually the account <command>nobody</command>.
173 To find the correct name to use for your version of Samba do the
176 testparm -s -v | grep "guest account"
178 Then make sure that this account exists in your system password
179 database (<filename>/etc/passwd</filename>).
183 The directory into which Samba will spool the file must have write
184 access for the guest account. The following commands will ensure that
185 this directory is available for use:
187 mkdir /var/spool/samba
188 chown nobody.nobody /var/spool/samba
189 chmod a+rwt /var/spool/samba
196 <title>Simple Central Print Server</title>
200 netbios name = PTRSVR1
202 passdb backend = guest
203 wins server = 192.168.1.1
206 comment = All Printers
207 path = /var/spool/samba
212 use client driver = Yes
222 <title>Common Errors</title>
225 The greatest mistake so often made is to make a network configuration too complex.
226 It pays to use the simplest solution that will meet the needs of the moment.