1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
4 <title>Small Office Networking</title>
7 So far, this book has focused on the basics of simple yet effective
8 network solutions. Network administrators who take pride in their work
9 (that's most of us, right?) take care to deliver what our users want,
10 but not too much more. If we make things too complex, we confound our users and
11 increase costs of network ownership. A professional network manager
12 avoids the temptation to put too much pizazz into the way that the network
13 operates. Some creativity is helpful, but do keep it under control.
17 <primary>Netware</primary>
19 Five years ago there were two companies from which a lesson can be learned.
20 In one case the network administrator spent three months building a new
21 network to replace an old Netware server. What he delivered had all the
22 bells and whistles he could muster. There were a few teething problems
23 during the change-over, nothing serious but a little disruptive all the
24 same. Users were exposed to many changes at once. The network
25 administrator was asked to resign two months after implementing the
26 new system. This was necessary because so many staff had complained
27 they had lost time and were not happy with the new network.
28 Everything was automated and he delivered more features than any advanced
29 user could think of. He was just too smart for his own good.
33 In the case of the other company, a new network manager was appointed
34 to oversee the replacement of a LanTastic network with an MS Windows
35 NT 4.0 network. He had the replacement installed and operational within
36 two weeks. Before installation and change-over, he called a meeting to
37 explain to all users what was going to happen, how it would affect them
38 and that he would be available 24 hours a day to help them transition.
39 One week after conversion, he held another meeting asking for cooperation
40 in the introduction of a few new features that would help to make life
41 easier. Network users were thrilled with what he was doing to help
42 them. The network he implemented was nowhere near as complex as the first example, had fewer
43 features, and yet he had happy users. Months later he was still adding
44 new innovations. He always asked the users if a
45 particular feature was what they wanted. He asked his boss for a raise
46 and got it. He often told me, <quote>Always keep a few new tricks up your
47 sleeves for when you need them.</quote> Was he smart? You decide. Let's
48 get on with our next exercise.
52 <title>Introduction</title>
55 Abmas Accounting Inc. has grown. Mr. Meany likes you and says he knew you
56 were the right person for the job. That's why he asked you to install the
57 new server. The past few months have been hard work. You advised Mr. Meany
58 that it is time for a change. Abmas now has 52 users, having acquired an
59 investment consulting business recently. The new users were added to the
60 network without any problems.
64 Some of the Windows clients are getting to be past their use-by date.
65 You have found damaged and unusable software on some of the workstations
66 that came with the acquired business and found some machines that are
67 in need of both hardware and software maintenance.
71 <title>Assignment Tasks</title>
74 <indexterm><primary>Windows XP</primary></indexterm>
75 Mr. Meany has decided to retire in 12 months. He wants you to help him
76 make the business run better. Many of the new staff want notebook computers.
77 They visit customer business premises with the need to use local network
78 facilities; these users are technically competent. The company uses a
79 business application that requires Windows XP Professional. In short, a
80 complete client upgrade is about to happen. Mr. Meany told you that he is working
81 on another business acquisition and that by the time he retires there will be
86 Mr. Meany is not concerned about security. He wants to make it easier for
87 staff to do their work. He has hired you to help him appoint a full-time
88 network manager before he retires. Above all, he says he is investing in
89 the ability to grow. He is determined to live his lifelong dream and
90 hand the business over to a bright and capable executive who can make
91 things happen. This means your network design must cope well with
96 In a few months, Abmas will require an Internet connection for email
97 and so staff easily obtain software updates. Mr. Meany is warming up to the
98 installation of anti-virus software, but is not yet ready to approve
99 this expense. He told you to spend the money a virus scanner costs
100 on better quality notebook computers for mobile users.
104 One of Mr. Meany's golfing partners sold him on the idea to buy new laser
105 printers. One black only, the other a color laser printer. Staff support
106 the need for a color printer so they can present more attractive proposals
111 Mr. Meany also asked if it would be possible for one of the staff to manage
112 user accounts from the Windows desktop. That person will be responsible for
120 <title>Dissection and Discussion</title>
123 What are the key requirements in this business example? A quick review indicates
129 Scalability &smbmdash; from 52 to over 100 users in 12 months
133 Mobile computing capability
134 <indexterm><primary>mobile computing</primary></indexterm>
138 Improved reliability and usability
142 Easier administration
147 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
148 (as in <link linkend="AccountingOffice"/>).
154 <title>Technical Issues</title>
157 <indexterm><primary>smbpasswd</primary></indexterm>
158 <indexterm><primary>DHCP</primary></indexterm>
159 <indexterm><primary>DNS</primary></indexterm>
160 <indexterm><primary>WINS</primary></indexterm>
161 <indexterm><primary>Domain</primary></indexterm>
162 It is time to implement a domain security environment. You will use the <constant>
163 smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
164 run DNS at this time, but the system will use WINS. The Domain name will be <constant>
165 BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
169 All printers will be configured as DHCP clients. The DHCP server will assign
170 the printer a fixed IP address by way of its Ethernet interface (MAC) address.
171 See <link linkend="dhcp01"/>.
175 The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
176 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
177 possible to start with the installation that you have created here, migrate it
178 to a Samba-3 configuration and then secure the system further. Configurations following
179 this one will utilize features that may not be supported in Samba-2.2.x releases.
180 However, you should note that the examples in each chapter start with the assumption
181 that a fresh new installation is being effected.
185 Later on, when the Internet connection is implemented, you will add DNS as well as
186 other enhancements. It is important that you plan accordingly.
190 <indexterm><primary>ether-switch</primary></indexterm>
191 You have split the network into two separate areas. Each has its own ether-switch.
192 There are 20 users on the accounting network and 32 users on the financial services
193 network. The server has two network interfaces, one serving each network. The
194 network printers will be located in a central area. You plan to install the new
195 printers and keep the old printer in use also.
199 You will provide separate file storage areas for each business entity. The old system
200 will go away, accounting files will be handled under a single directory, and files will
201 be stored under customer name, not under a personal work area. Staff will be made
202 responsible for file location, so maintain the old share point.
206 Given that DNS will not be used, you will configure WINS name resolution for UNIX
207 hostname name resolution.
211 <indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
212 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
213 It is necessary to map Windows Domain Groups to UNIX groups as a minimum. It is
214 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
215 key staff groups in the firm are Accounting Staff and Financial Services Staff.
216 For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
220 In the sample &smb.conf; file, you have configured Samba to call the UNIX <command>groupadd</command>
221 to add group entries. This utility does not permit the addition of group names that
222 contain upper-case characters or spaces. This is considered a bug. The <command>groupadd</command>
223 is part of the <command>shadow-utils</command> Open Source Software package.
224 A later release of this package may have been patched to resolve this bug.
225 If your operating platform has this bug, it means that attempts to add a Windows Domain
226 Group that has either a space or upper-case characters in it will fail. See <emphasis>TOSHARG</emphasis>, Section 11.3.1,
227 Example 11.1, for more information.
231 <indexterm><primary>CUPS</primary></indexterm>
232 Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler
233 on the UNIX host will be operated in <constant>raw</constant> mode.
239 <title>Political Issues</title>
242 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
243 He is willing to spend money on things he believes are of value. You need more
244 time to convince him of real priorities.
248 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
249 supplied with anti-virus software? Above all, demonstrate good purchase value and remember
250 to make your users happy.
258 <title>Implementation</title>
261 <primary>migration</primary>
263 In this example, the assumption is made that this server is being configured from a clean start.
264 The alternate approach could be to demonstrate the migration of the system that is documented
265 in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
266 future examples, as a new installation is based on the premise that you can determine
267 the migration steps from the information provided in the separate chapter on this subject.
268 Additionally, a fresh installation makes the example easier to follow.
272 <primary>group membership</primary>
274 Each user will be given a home directory on the UNIX system, which will be available as a private
275 share. Two additional shares will be created, one for the Accounting Department and the other for
276 the Financial Services Department. Network users will be given access to these shares by way
281 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
282 UNIX group membership is the primary mechanism by which Windows Domain users will be granted
283 rights and privileges within the Windows environment.
287 <primary>sticky bit</primary>
289 The user <command>alanm</command> will be made the owner of all files. This will be preserved
290 by setting the sticky bit (set UID/GID) on the top-level directories.
293 <image id="acct2net">
294 <imagedescription>Abmas Accounting &smbmdash; 52 User Network Topology</imagedescription>
295 <imagefile scale="65">acct2net</imagefile>
300 Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
304 <indexterm><primary>/etc/hosts</primary></indexterm>
305 Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
306 The printers are network attached, so it is desirable that there should be entries for the
307 network printers also. An example <filename>/etc/hosts</filename> file is shown here:
309 192.168.1.1 sleeth sleeth1
318 Install the Samba-3 binary RPM from the Samba-Team FTP site.
322 Install the ISC DHCP server using the UNIX/Linux system tools available to you.
325 <step><para><indexterm>
326 <primary>/etc/rc.d/rc.local</primary>
327 </indexterm><indexterm>
328 <primary>IP forwarding</primary>
329 </indexterm><indexterm>
330 <primary>router</primary>
331 </indexterm><indexterm>
332 <primary>/proc/sys/net/ipv4/ip_forward</primary>
334 Given that Samba will be operating over two network interfaces and clients on each side
335 may want to be able to reach clients on the other side, it is imperative that IP forwarding
336 shall be enabled. Use the system tool of your choice to enable IP forwarding. In the
337 absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
338 file an entry as follows:
340 echo 1 > /proc/sys/net/ipv4/ip_forward
342 This causes the Linux kernel to forward IP packets so that it acts as a router.
346 Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and
347 <link linkend="acct3conf"/>. Combine these two examples to form a single
348 <filename>/etc/samba/smb.conf</filename> file.
351 <step><para><indexterm>
352 <primary>smbpasswd</primary>
354 Add the user <command>root</command> to the Samba password backend:
356 &rootprompt; smbpasswd -a root
357 New SMB password: XXXXXXX
358 Retype new SMB password: XXXXXXX
361 <indexterm><primary>administrator</primary></indexterm>
362 This is the Windows Domain Administrator password. Never delete this account from
363 the password backend after Windows Domain Groups have been initialized. If you delete
364 this account, your system is crippled. You cannot restore this account
365 and your Samba server is no longer capable of being administered.
369 <indexterm><primary>username map</primary></indexterm>
370 Create the username map file to permit the <constant>root</constant> account to be called
371 <constant>Administrator</constant> from the Windows network environment. To do this, create
372 the file <filename>/etc/samba/smbusers</filename> with the following contents:
379 # Unix_ID = Windows_ID
382 # root = Administrator
383 # janes = "Jane Smith"
386 # Note: If the name contains a space it must be double quoted.
387 # In the example above the name 'jimbo' will be mapped to Windows
388 # user names 'Jim' and 'Bones' because the space was not quoted.
389 #######################################################################
398 <indexterm><primary>initGrps.sh</primary></indexterm>
399 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
400 <link linkend="initGrps"/>. Create a file containing this script. We called ours
401 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
402 and then execute the script. Sample output should be as follows:
404 <example id="initGrps">
405 <title>Script to Map Windows NT Groups to UNIX Groups</title>
406 <indexterm><primary>initGrps.sh</primary></indexterm>
417 # Map Windows Domain Groups to UNIX groups
418 net groupmap modify ntgroup="Domain Admins" unixgroup=root
419 net groupmap modify ntgroup="Domain Users" unixgroup=users
420 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
422 # Add Functional Domain Groups
423 net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
424 net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
429 &rootprompt; chmod 755 initGrps.sh
430 &rootprompt; cd /etc/samba
431 &rootprompt; ./initGrps.sh
432 Updated mapping entry for Domain Admins
433 Updated mapping entry for Domain Users
434 Updated mapping entry for Domain Guests
435 No rid or sid specified, choosing algorithmic mapping
436 Successfully added group Accounts Dept to the mapping db
437 No rid or sid specified, choosing algorithmic mapping
438 Successfully added group Domain Guests to the mapping db
440 &rootprompt; cd /etc/samba
441 &rootprompt; net groupmap list | sort
442 Account Operators (S-1-5-32-548) -> -1
443 Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
444 Administrators (S-1-5-32-544) -> -1
445 Backup Operators (S-1-5-32-551) -> -1
446 Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
447 Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
448 Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
449 Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
450 Guests (S-1-5-32-546) -> -1
451 Power Users (S-1-5-32-547) -> -1
452 Print Operators (S-1-5-32-550) -> -1
453 Replicators (S-1-5-32-552) -> -1
454 System Operators (S-1-5-32-549) -> -1
455 Users (S-1-5-32-545) -> -1
460 <indexterm><primary>/etc/passwd</primary></indexterm>
461 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
462 <indexterm><primary>smbpasswd</primary></indexterm>
463 For each user who needs to be given a Windows Domain account, make an entry in the
464 <filename>/etc/passwd</filename> file as well as in the Samba password backend.
465 Use the system tool of your choice to create the UNIX system accounts and use the Samba
466 <command>smbpasswd</command> program to create the Domain user accounts.
470 <indexterm><primary>useradd</primary></indexterm>
471 <indexterm><primary>adduser</primary></indexterm>
472 <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
473 There are a number of tools for user management under UNIX. Commonly known ones include:
474 <command>useradd</command>, <command>adduser</command>. In addition to these, there are a plethora of custom
475 tools. With the tool of your choice, create a home directory for each user.
479 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
480 previously as necessary. File system access control will be based on UNIX group membership.
484 Create the directory mount point for the disk sub-system that is mounted to provide
485 data storage for company files. In this case the mount point indicated in the &smb.conf;
486 file is <filename>/data</filename>. Format the file system as required, mount the formatted
487 file system partition using <command>mount</command>,
488 and make the appropriate changes in <filename>/etc/fstab</filename>.
492 Create the top-level file storage directories are follows:
494 &rootprompt; mkdir -p /data/{accounts,finsvcs}
495 &rootprompt; chown -R root.root /data
496 &rootprompt; chown -R alanm.accounts /data/accounts
497 &rootprompt; chown -R alanm.finsvcs /data/finsvcs
498 &rootprompt; chmod -R ug+rwx,o+rx-w /data
500 Each department is responsible for creating its own directory structure within its
501 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
502 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
506 Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
507 Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
508 This allows the CUPS spooler to print using raw mode protocols.
509 <indexterm><primary>CUPS</primary></indexterm>
510 <indexterm><primary>raw printing</primary></indexterm>
514 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm><indexterm>
515 <primary>lpadmin</primary>
517 Configure the CUPS Print Queues as follows:
519 &rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
520 &rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
521 &rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
523 <indexterm><primary>print filter</primary></indexterm>
524 This creates the necessary print queues with no assigned print filter.
528 <indexterm><primary>mime type</primary></indexterm>
529 <indexterm><primary>/etc/mime.convs</primary></indexterm>
530 <indexterm><primary>application/octet-stream</primary></indexterm>
531 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
533 application/octet-stream application/vnd.cups-raw 0 -
538 <indexterm><primary>/etc/mime.types</primary></indexterm>
539 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
541 application/octet-stream
545 <step><para><indexterm>
546 <primary>DHCP Server</primary>
548 Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
549 contents as shown in <link linkend="dhcp01"/>.
550 <example id="dhcp01">
551 <title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
552 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
554 default-lease-time 86400;
555 max-lease-time 172800;
556 default-lease-time 86400;
558 option ntp-servers 192.168.1.1;
559 option domain-name "abmas.biz";
560 option domain-name-servers 192.168.1.1, 192.168.2.1;
561 option netbios-name-servers 192.168.1.1, 192.168.2.1;
562 option netbios-node-type 8;
564 # netbios-node-type=8 means set clients to Hybrid Mode
565 # so they will use Unicast communication with the WINS
566 # server and thus reduce the level of UDP broadcast
567 # traffic by up to 90%.
570 subnet 192.168.1.0 netmask 255.255.255.0 {
571 range dynamic-bootp 192.168.1.128 192.168.1.254;
572 option subnet-mask 255.255.255.0;
573 option routers 192.168.1.1;
574 allow unknown-clients;
576 hardware ethernet 08:00:46:7a:35:e4;
577 fixed-address 192.168.1.10;
580 hardware ethernet 00:03:47:cb:81:e0;
581 fixed-address 192.168.1.11;
584 subnet 192.168.2.0 netmask 255.255.255.0 {
585 range dynamic-bootp 192.168.2.128 192.168.2.254;
586 option subnet-mask 255.255.255.0;
587 option routers 192.168.2.1;
588 allow unknown-clients;
590 hardware ethernet 01:04:31:db:e1:c0;
591 fixed-address 192.168.1.10;
594 subnet 127.0.0.0 netmask 255.0.0.0 {
602 Use the standard system tool to start Samba and CUPS and configure them to start
603 automatically at every system reboot. For example:
607 <indexterm><primary>chkconfig</primary></indexterm>
608 <indexterm><primary>starting dhcpd</primary></indexterm>
609 <indexterm><primary>starting samba</primary></indexterm>
610 <indexterm><primary>starting CUPS</primary></indexterm><indexterm>
611 <primary>chkconfig</primary>
614 &rootprompt; chkconfig dhpc on
615 &rootprompt; chkconfig smb on
616 &rootprompt; chkconfig cups on
617 &rootprompt; /etc/rc.d/init.d/dhcp restart
618 &rootprompt; /etc/rc.d/init.d/smb restart
619 &rootprompt; /etc/rc.d/init.d/cups restart
624 <indexterm><primary>Name Service Switch</primary></indexterm>
625 <indexterm><primary>NSS</primary><see>Name Service Switch</see></indexterm>
626 <indexterm><primary>DNS</primary></indexterm><indexterm>
627 <primary>DNS server</primary>
629 <indexterm><primary>WINS</primary></indexterm>
630 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
631 Configure the Name Service Switch (NSS) to handle WINS based name resolution.
632 Since this system does not use a DNS server, it is safe to remove this option from
633 the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
634 the <constant>hosts:</constant> entry looks like this:
642 <smbconfexample id="acct2conf">
643 <title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
644 <smbconfcomment>Global parameters</smbconfcomment>
645 <smbconfsection name="[global]"/>
646 <smbconfoption name="workgroup">BILLMORE</smbconfoption>
647 <smbconfoption name="passwd chat">*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</smbconfoption>
648 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
649 <smbconfoption name="syslog">0</smbconfoption>
650 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
651 <smbconfoption name="printcap name">CUPS</smbconfoption>
652 <smbconfoption name="show add printer wizard">No</smbconfoption>
653 <smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
654 <smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
655 <smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
656 <smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
657 <smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
658 <smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption>
659 <smbconfoption name="logon script">scripts\login.bat</smbconfoption>
660 <smbconfoption name="logon path"> </smbconfoption>
661 <smbconfoption name="logon drive">X:</smbconfoption>
662 <smbconfoption name="domain logons">Yes</smbconfoption>
663 <smbconfoption name="preferred master">Yes</smbconfoption>
664 <smbconfoption name="wins support">Yes</smbconfoption>
665 <smbconfoption name="printing">CUPS</smbconfoption>
668 <smbconfexample id="acct3conf">
669 <title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
670 <smbconfsection name="[homes]"/>
671 <smbconfoption name="comment">Home Directories</smbconfoption>
672 <smbconfoption name="valid users">%S</smbconfoption>
673 <smbconfoption name="read only">No</smbconfoption>
674 <smbconfoption name="browseable">No</smbconfoption>
676 <smbconfsection name="[printers]"/>
677 <smbconfoption name="comment">SMB Print Spool</smbconfoption>
678 <smbconfoption name="path">/var/spool/samba</smbconfoption>
679 <smbconfoption name="printable">Yes</smbconfoption>
680 <smbconfoption name="guest ok">Yes</smbconfoption>
681 <smbconfoption name="use client driver">Yes</smbconfoption>
682 <smbconfoption name="browseable">No</smbconfoption>
684 <smbconfsection name="[netlogon]"/>
685 <smbconfoption name="comment">Network Logon Service</smbconfoption>
686 <smbconfoption name="path">/data/%U</smbconfoption>
687 <smbconfoption name="valid users">%S</smbconfoption>
688 <smbconfoption name="read only">No</smbconfoption>
690 <smbconfsection name="[accounts]"/>
691 <smbconfoption name="comment">Accounting Files</smbconfoption>
692 <smbconfoption name="path">/data/accounts</smbconfoption>
693 <smbconfoption name="valid users">%G</smbconfoption>
694 <smbconfoption name="read only">No</smbconfoption>
696 <smbconfsection name="[finsvcs]"/>
697 <smbconfoption name="comment">Financial Service Files</smbconfoption>
698 <smbconfoption name="path">/data/finsvcs</smbconfoption>
699 <smbconfoption name="valid users">%G</smbconfoption>
700 <smbconfoption name="read only">No</smbconfoption>
704 <title>Validation</title>
707 Does everything function as it ought? That is the key question at this point.
708 Here are some simple steps to validate your Samba server configuration.
713 <step><para><indexterm>
714 <primary>testparm</primary>
716 If your &smb.conf; file has bogus options or parameters, this may cause Samba
717 to refuse to start. The first step should always be to validate the contents
718 of this file by running:
720 &rootprompt; testparm -s
721 Load smb config files from smb.conf
722 Processing section "[homes]"
723 Processing section "[printers]"
724 Processing section "[netlogon]"
725 Processing section "[accounts]"
726 Processing section "[service]"
727 Loaded services file OK.
731 passwd chat = *New*Password* \
732 %n\n *Re-enter*new*password* %n\n *Password*changed*
733 username map = /etc/samba/smbusers
735 name resolve order = wins bcast hosts
737 show add printer wizard = No
738 add user script = /usr/sbin/useradd -m '%u'
739 delete user script = /usr/sbin/userdel -r '%u'
740 add group script = /usr/sbin/groupadd '%g'
741 delete group script = /usr/sbin/groupdel '%g'
742 add user to group script = /usr/sbin/usermod -G '%g' '%u'
743 add machine script = /usr/sbin/useradd
744 -s /bin/false -d /var/lib/nobody '%u'
745 logon script = scripts\logon.bat
749 preferred master = Yes
753 ### Remainder cut to save space ###
755 The inclusion of an invalid parameter (say one called dogbert) would generate an
758 Unknown parameter encountered: "dogbert"
759 Ignoring unknown parameter "dogbert"
761 Clear away all errors before proceeding and start or restart samba as necessary.
765 <indexterm><primary>check samba
766 daemons</primary></indexterm><indexterm>
767 <primary>nmbd</primary>
768 </indexterm><indexterm>
769 <primary>smbd</primary>
770 </indexterm><indexterm>
771 <primary>winbindd</primary>
773 Check that the Samba server is running:
775 &rootprompt; ps ax | grep mbd
776 14244 ? S 0:00 /usr/sbin/nmbd -D
777 14245 ? S 0:00 /usr/sbin/nmbd -D
778 14290 ? S 0:00 /usr/sbin/smbd -D
780 $rootprompt; ps ax | grep winbind
781 14293 ? S 0:00 /usr/sbin/winbindd -B
782 14295 ? S 0:00 /usr/sbin/winbindd -B
784 The <command>winbindd</command> daemon is running in split mode (normal) so there are also
785 two instances of it. For more information regarding winbindd, see <emphasis>TOSHARG</emphasis>,
786 Chapter 22, Section 22.3. The single instance of <command>smbd</command> is normal.
790 <indexterm><primary>anonymous connection</primary></indexterm>
791 Check that an anonymous connection can be made to the Samba server:
793 &rootprompt; smbclient -L localhost -U%
795 Sharename Type Comment
796 --------- ---- -------
797 netlogon Disk Network Logon Service
798 accounts Disk Accounting Files
799 finsvcs Disk Financial Service Files
800 IPC$ IPC IPC Service (Samba3)
801 ADMIN$ IPC IPC Service (Samba3)
802 hplj4 Printer Hewlett-Packard LaserJet 4
803 hplj6 Printer Hewlett-Packard LaserJet 6
804 qms Printer QMS Magicolor Laser Printer XXXX
814 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
815 of browsing the server from a Windows client to obtain a list of shares on the server.
816 The <constant>-U%</constant> argument means, send a "<constant>NULL</constant> username and
817 a <constant>NULL</constant> password."
821 <indexterm><primary>dhcp client validation</primary></indexterm>
822 <indexterm><primary>printer
823 validation</primary></indexterm><indexterm>
824 <primary>/etc/dhcpd.conf</primary>
826 Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
827 The easiest way to do this is to ping the printer name. Immediately after the ping response
828 has been received, execute <command>arp -a</command> to find the MAC address of the printer
829 that has responded. Now you can compare the IP address and the MAC address of the printer
830 with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
831 should, of course, match. For example:
833 &rootprompt; ping hplj4
834 PING hplj4 (192.168.1.11) 56(84) bytes of data.
835 64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
838 hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
840 The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
841 IP address from which the printer has responded and with the entry for it in the
842 <filename>/etc/dhcpd.conf</filename> file.
846 <indexterm><primary>authenticated connection</primary></indexterm>
847 Make an authenticated connection to the server using the <command>smbclient</command> tool:
849 &rootprompt; smbclient //sleeth/accounts -U alanm
852 . D 0 Sun Nov 9 01:28:34 2003
853 .. D 0 Sat Aug 16 17:24:26 2003
854 .mc DH 0 Sat Nov 8 21:57:38 2003
855 .qt DH 0 Fri Sep 5 00:48:25 2003
856 SMB D 0 Sun Oct 19 23:04:30 2003
857 Documents D 0 Sat Nov 1 00:31:51 2003
858 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
860 65387 blocks of size 65536. 28590 blocks available
871 <title>Windows XP Professional Client Configuration</title>
874 Configure clients to the network settings shown in <link linkend="acct2net"/>.
875 All clients use DHCP for TCP/IP protocol stack configuration.
876 <indexterm><primary>WINS</primary></indexterm>
877 <indexterm><primary>DHCP</primary></indexterm>
878 DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
882 Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
883 user name <constant>root</constant> and the SMB password you assigned to this account.
884 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
885 a Windows Domain is given in <link linkend="domjoin"/>.
886 Reboot the machine as prompted and then logon using a Domain User account.
890 Verify on each client that the machine called <constant>SLEETH</constant>
891 is visible in <guimenu>My Network Places</guimenu>, that it is
892 possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
893 and <guimenuitem>finsvcs</guimenuitem>,
894 and that it is possible to open that share to reveal its contents.
898 Instruct all users to log onto the workstation using their assigned user name and password.
902 Install a printer on each using the following steps:
908 <guimenu>Start</guimenu>
909 <guimenuitem>Settings</guimenuitem>
910 <guimenuitem>Printers</guimenuitem>
911 <guiicon>Add Printer</guiicon>
912 <guibutton>Next</guibutton>
913 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
914 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
918 Click <guibutton>Next</guibutton>. In the panel labeled
919 <guimenuitem>Manufacturer:</guimenuitem>, select <constant>HP</constant>.
920 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
921 <constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
925 In the panel labeled <guimenuitem>Available ports:</guimenuitem>, select
926 <constant>FILE:</constant>. Accept the default printer name by clicking
927 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
928 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
929 <guibutton>Finish</guibutton>.
933 You may be prompted for the name of a file to print to. If so, close the
934 dialog panel. Right-click <menuchoice>
935 <guiicon>HP LaserJet 4</guiicon>
936 <guimenuitem>Properties</guimenuitem>
937 <guisubmenu>Details (Tab)</guisubmenu>
938 <guimenuitem>Add Port</guimenuitem>
943 In the panel labeled <guimenuitem>Network</guimenuitem>, enter the name of
944 the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
946 <guibutton>OK</guibutton>
947 <guibutton>OK</guibutton>
948 </menuchoice> to complete the installation.
952 Repeat the printer installation steps above for the HP LaserJet 6 printer
953 as well as for the QMS Magicolor XXXX laser printer.
960 <title>Notebook Computers: A Special Case</title>
963 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
964 Professional systems. This is the preferred solution to provide continuity of work for notebook users
965 so that absence from the office network environment does not become a barrier to productivity.
969 By creating a local machine account that has the same user name and password as you create for that
970 user in the Windows Domain environment, the user can log onto the machine locally and still
971 transparently access network resources as if logged onto the domain itself. There are some trade-offs
972 that mean that as the network is more tightly secured it becomes necessary to modify Windows client
973 configuration somewhat.
979 <title>Key Points Learned</title>
982 In this network design and implementation exercise, you have created a Windows NT4 style Domain
983 Controller using Samba-3.0.12. As a result of following these guidelines meant that you experienced
984 and implemented several important aspects of Windows networking. In the next chapter of this book,
985 you build on the experience gained. These are the highlights from this chapter:
990 <indexterm><primary>DHCP</primary></indexterm>
991 You implemented a DHCP Server and Microsoft Windows clients were able to obtain all necessary
992 network configuration settings from this server.
996 <indexterm><primary>Domain Controller</primary></indexterm>
997 You created a Windows Domain Controller. You were able to use the network logon service
998 and successfully joined Windows 200x/XP Professional clients to the Domain.
1002 <indexterm><primary>CUPS</primary></indexterm>
1003 You created raw print queues in the CUPS printing system. You maintained a simple
1004 printing system so that all users can share centrally managed printers. You installed
1005 native printer drivers on the Windows clients.
1009 You experienced the benefits of centrally managed user accounts on the server.
1013 You offered Mobile notebook users a solution that allows them to continue to work
1014 while away from the office and not connected to the corporate network.
1023 <title>Questions and Answers</title>
1026 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
1035 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
1042 First and foremost, portability. It means that notebook users can move between
1043 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
1044 reconfigure their machines. It also means that when they work from their home environments
1045 either using DHCP assigned addressing or when using dial-up networking, settings such as
1046 default routes and DNS server addresses that apply only to the Abmas office environment do
1047 not interfere with remote operations. This is an extremely important feature of DHCP.
1057 Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
1058 that should be noted in particular?
1065 Yes. The configuration you created automatically provides each client with the IP address
1066 of your WINS server. It also configures the client to preferentially register NetBIOS names
1067 with the WINS server, and then instructs the client to first query the WINS server when a
1068 NetBIOS machine name needs to be resolved to an IP Address. This means that this configuration
1069 results in far lower UDP broadcast traffic than would be the case if WINS was not used.
1079 Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
1086 You can surely create a Windows Domain Account called <constant>Administrator</constant>. It is also
1087 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
1088 necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
1089 account called <constant>root</constant>.
1099 Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
1106 The Windows Domain <constant>Administrator</constant> account is the most privileged account that
1107 exists on the Windows platform. This user can change any setting, add/delete or modify user
1108 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
1109 environment is the <constant>root</constant> account. If you want to permit the Windows Domain
1110 Administrator to manage accounts, as well as permissions, privileges, and security
1111 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
1112 achieved with the <constant>root</constant> UID equal to 0.
1122 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
1123 <constant>root</constant> access. How can we do this?
1130 Users who are members of the <constant>Domain Admins</constant> group can add machines to the
1131 Domain. This group is mapped to the UNIX group account called <constant>root</constant>
1132 (or equivalent on <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
1133 This must be the primary GID of the account of the user who is a member of the Windows <constant>
1134 Domain Admins</constant> account.
1144 Why must I map Windows Domain Groups to UNIX groups?
1151 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
1152 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are:
1153 <guimenu>Domain Guests, Domain Users, Domain Admins</guimenu>.
1163 I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
1170 This is a nasty problem. Fortunately, here is a solution.
1175 Back up your existing configuration files in case you need to restore them.
1179 Rename the <filename>group_mapping.tdb</filename> file.
1183 Use the <command>smbpasswd</command> to add the root account.
1187 Restore the <filename>group_mapping.tdb</filename> file.
1198 When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
1199 as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
1206 The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
1207 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
1208 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
1209 may change at some later date. These accounts are provided only so that security objects are correctly shown.
1219 What is the effect of changing the name of a Samba server, or of changing the Domain name?
1226 In the event that you elect to change the name of the Samba server, on restarting <command>smbd</command>,
1227 Windows security identifiers are changed. In the case of a Stand-Alone server or a Domain Member server,
1228 the machine SID is changed. This may break Domain Membership. In the case of a change of the Domain name
1229 (Workgroup name), the Domain SID is changed. This affects all Domain Memberships.
1233 If it becomes necessary to change either the Server name or the Domain name, be sure to back up the respective
1234 SID before the change is made. You can back up the SID from use of the <command>net getlocalsid</command> (Samba-3),
1235 or by way of the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
1236 to check the man page for this command for detailed instructions regarding the steps involved.
1246 How can I manage user accounts from my Windows XP Professional workstation?
1253 Samba-3 implements a Windows NT4 style security domain architecture. This type of Domain cannot
1254 be managed using tools present on a Windows XP Professional installation. You may download from the
1255 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
1256 it. This package extracts the tools known as: <command>User Manager for Domains, Server Manager, Event
1257 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
1258 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
1259 for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
git.samba.org / ira / wip.git / blob