References are kept where the version number makes sense in the context.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>LDAP</primary><secondary>backend</secondary></indexterm>
<indexterm><primary>SID</primary></indexterm>
- When Samba-3 is configured to use an LDAP backend, it stores the domain
+ When Samba is configured to use an LDAP backend, it stores the domain
account information in a directory entry. This account entry contains the
domain SID. An unintended but exploitable side effect is that this makes it
possible to operate with more than one PDC on a distributed network.
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>UID</primary></indexterm>
<indexterm><primary>GID</primary></indexterm>
- Samba-3 has the ability to use multiple password (authentication and
+ Samba has the ability to use multiple password (authentication and
identity resolution) backends. The diagram in <link linkend="chap7idres"/>
demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system
password database. The diagram only documents the mechanisms for
<itemizedlist>
<listitem><para>
<indexterm><primary>LDAP</primary></indexterm><indexterm><primary>BDC</primary></indexterm>
- Where Samba-3 is used as a domain controller, the use of LDAP is an
+ Where Samba is used as a domain controller, the use of LDAP is an
essential component to permit the use of BDCs.
</para></listitem>
<title>The 500-User Office</title>
<para>
- The Samba-3 networking you explored in <link linkend="secure"/> covers the finer points of
+ The Samba networking you explored in <link linkend="secure"/> covers the finer points of
configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
implementation of a simple configuration of the services that are important adjuncts
to successful deployment of Samba.
</para></listitem>
<listitem><para>
- Joining a Samba-3 domain member server to a Samba-3 domain
+ Joining a Samba domain member server to a Samba-3 domain
</para></listitem>
<listitem><para>
<answer>
<para>
- Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
+ Unless configured to do otherwise, the default behavior with Samba and Windows XP Professional
clients is to use roaming profiles.
</para>
<indexterm><primary>Domain Member</primary><secondary>client</secondary></indexterm>
<indexterm><primary>Domain Controller</primary></indexterm>
The domain member server and the domain member client are at the center of focus in this chapter.
- Configuration of Samba-3 domain controller is covered in earlier chapters, so if your
+ Configuration of Samba domain controller is covered in earlier chapters, so if your
interest is in domain controller configuration, you will not find that here. You will find good
oil that helps you to add domain member servers and clients.
</para>
<indexterm><primary>Active Directory</primary><secondary>join</secondary></indexterm>
<indexterm><primary>Kerberos</primary></indexterm>
<indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm>
- One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory
+ One of the much-sought-after features new to Samba is the ability to join an Active Directory
domain using Kerberos protocols. This makes it possible to operate an entire Windows network
without the need to run NetBIOS over TCP/IP and permits more secure networking in general. An
exhaustively complete discussion of the protocols is not possible in this book; perhaps a
- later book may explore the intricacies of the NetBIOS-less operation that Samba-3 can participate
- in. For now, we simply focus on how a Samba-3 server can be made a domain member server.
+ later book may explore the intricacies of the NetBIOS-less operation that Samba can participate
+ in. For now, we simply focus on how a Samba server can be made a domain member server.
</para>
<para>
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>Identity resolution</primary></indexterm>
<indexterm><primary>Kerberos</primary></indexterm>
- The diagram in <link linkend="ch9-adsdc"/> demonstrates how Samba-3 interfaces with
+ The diagram in <link linkend="ch9-adsdc"/> demonstrates how Samba interfaces with
Microsoft Active Directory components. It should be noted that if Microsoft Windows Services
for UNIX (SFU) has been installed and correctly configured, it is possible to use client LDAP
- for identity resolution just as can be done with Samba-3 when using an LDAP passdb backend.
+ for identity resolution just as can be done with Samba when using an LDAP passdb backend.
The UNIX tool that you need for this, as in the case of LDAP on UNIX/Linux, is the PADL
Software nss_ldap tool-set. Compared with use of winbind and Kerberos, the use of
LDAP-based identity resolution is a little less secure. In view of the fact that this solution
requires additional software to be installed on the Windows 200x ADS domain controllers,
- and that means more management overhead, it is likely that most Samba-3 ADS client sites
+ and that means more management overhead, it is likely that most Samba ADS client sites
may elect to use winbind.
</para>
<para>
- Do not attempt to use this procedure if you are not 100 percent certain that the build of Samba-3
+ Do not attempt to use this procedure if you are not 100 percent certain that the build of Samba
you are using has been compiled and linked with all the tools necessary for this to work.
- Given the importance of this step, you must first validate that the Samba-3 message block
+ Given the importance of this step, you must first validate that the Samba message block
daemon (<command>smbd</command>) has the necessary features.
</para>
<step><para>
<indexterm><primary>smbd</primary></indexterm>
- Before you try to use Samba-3, you want to know for certain that your executables have
+ Before you try to use Samba, you want to know for certain that your executables have
support for Kerberos and for LDAP. Execute the following to identify whether or
not this build is perhaps suitable for use:
<screen>
<indexterm><primary>SerNet</primary></indexterm>
<indexterm><primary>validated</primary></indexterm>
The next step is to identify which version of the Kerberos libraries have been used.
- In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is
+ In order to permit Samba to interoperate with Windows 2003 Active Directory, it is
essential that it has been linked with either MIT Kerberos version 1.3.1 or later,
or that it has been linked with Heimdal Kerberos 0.6 plus specific patches. You may
identify what version of the MIT Kerberos libraries are installed on your system by
</para>
<para>
- From this point on, you are certain that the Samba-3 build you are using has the
- necessary capabilities. You can now configure Samba-3 and the NSS.
+ From this point on, you are certain that the Samba build you are using has the
+ necessary capabilities. You can now configure Samba and the NSS.
</para></step>
<step><para>
Using short domain name -- LONDON
Joined 'FRAN' to realm 'LONDON.ABMAS.BIZ'
</screen>
- You have successfully made your Samba-3 server a member of the ADS domain
+ You have successfully made your Samba server a member of the ADS domain
using Kerberos protocols.
</para>
<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>info</tertiary></indexterm>
<indexterm><primary>Active Directory</primary><secondary>server</secondary></indexterm>
<indexterm><primary>Kerberos</primary></indexterm>
- You may now perform final verification that communications between Samba-3 winbind and
+ You may now perform final verification that communications between Samba winbind and
the Active Directory server is using Kerberos protocols. Execute the following:
<screen>
&rootprompt; net ads info
[Read All Properties]
-------------- End Of Security Descriptor
</programlisting>
- And now you have conclusive proof that your Samba-3 ADS domain member server
+ And now you have conclusive proof that your Samba ADS domain member server
called <constant>FRAN</constant> is able to communicate fully with the ADS
domain controllers.
</para></step>
<para>
- Your Samba-3 ADS domain member server is ready for use. During training sessions,
+ Your Samba ADS domain member server is ready for use. During training sessions,
you may be asked what is inside the <filename>winbindd_cache.tdb and winbindd_idmap.tdb</filename>
files. Since curiosity just took hold of you, execute the following:
<programlisting>
<para>
<indexterm><primary>ADAM</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
- The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as
+ The storage of IDMAP information in LDAP can be used with both NT4/Samba-style domains as well as
with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant
LDAP server can be used. It is therefore possible to deploy this IDMAP configuration using
the Sun iPlanet LDAP server, Novell eDirectory, Microsoft ADS plus ADAM, and so on.
<para>
<indexterm><primary>realm</primary></indexterm>
- In the case of an NT4 or Samba-
3-style domain the <parameter>realm</parameter> is not used, and the
+ In the case of an NT4 or Samba-style domain the <parameter>realm</parameter> is not used, and the
command used to join the domain is <command>net rpc join</command>. The above example also demonstrates
advanced error reporting techniques that are documented in the chapter called "Reporting Bugs" in
- <quote>The Official Samba-3 HOWTO and Reference Guide, Second Edition</quote> (TOSHARG2).
+ <quote>The Official Samba HOWTO and Reference Guide, Second Edition</quote> (TOSHARG2).
</para>
<para>
You should note that it is possible to use LDAP-based PAM and NSS tools to permit distributed
systems logons (SSO), providing user and group accounts are stored in an LDAP directory. This
provides logon services for UNIX/Linux users, while Windows users obtain their sign-on
- support via Samba-3.
+ support via Samba.
</para>
<para>
<para>
The following steps provide a Linux system that users can log onto using
- Windows NT4 (or Samba-3) domain network credentials:
+ Windows NT4 (or Samba) domain network credentials:
</para>
<procedure>
<question>
<para>
- Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into
+ Is proper DNS operation necessary for Samba plus LDAP? If so, what must I put into
my DNS configuration?
</para>
<para>
Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we
- use Samba-3 with that configuration?
+ use Samba with that configuration?
</para>
</question>
</indexterm><indexterm>
<primary>authentication</primary>
</indexterm>
- No. This is not okay. It means that your Samba-3 client has joined the ADS domain as
- a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication.
+ No. This is not okay. It means that your Samba client has joined the ADS domain as
+ a Windows NT4 client, and Samba will not be using Kerberos-based authentication.
</para>
</answer>
<para>
Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
- Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
+ Samba. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
See <link linkend="swxpp004"></link>.
<figure id="swxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure>
</para></step>
</para>
<para>
- Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
+ Enter the name <quote>root</quote> and the root password from your Samba server. See <link linkend="swxpp008"></link>.
<figure id="swxpp008"><title>Computer Name Changes &smbmdash; User name and Password Panel</title><imagefile>wxpp008</imagefile></figure>
</para></step>
Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations
as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet
card connected using a hub. Also required is one additional server (either Windows
- NT4 Server, Windows 2000 Server, or a Samba-3 on UNIX/Linux server) running a network
+ NT4 Server, Windows 2000 Server, or a Samba on UNIX/Linux server) running a network
sniffer and analysis application (Wireshark is a good choice). All work should be undertaken
on a quiet network where there is no other traffic. It is best to use a dedicated hub
with only the machines under test connected at the time of the exercises.
</para>
<para>
- Recommended preparatory reading: <emphasis>The Official Samba-3 HOWTO and Reference Guide, Second
+ Recommended preparatory reading: <emphasis>The Official Samba HOWTO and Reference Guide, Second
Edition</emphasis> (TOSHARG2) Chapter 9, <quote>Network Browsing,</quote> and Chapter 3,
<quote>Server Types and Security Modes.</quote>
</para>
</sect2>
<sect2>
- <title>Windows 200x/XP Client Interaction with Samba-3</title>
+ <title>Windows 200x/XP Client Interaction with Samba</title>
<para>
By now you may be asking, <quote>Why did you choose to work with Windows 9x/Me?</quote>
networking operations. Such passwords cannot be provided from the UNIX <filename>/etc/passwd</filename>
database and thus must be stored elsewhere on the UNIX system in a manner that Samba can
use. Samba-2.x permitted such encrypted passwords to be stored in the <constant>smbpasswd</constant>
- file or in an LDAP database. Samba
-3 permits use of multiple <parameter>passdb backend</parameter>
+ file or in an LDAP database. Samba permits use of multiple <parameter>passdb backend</parameter>
databases in concurrent deployment. Refer to <emphasis>TOSHARG2</emphasis>, Chapter 10, <quote>Account Information Databases.</quote>
</para></listitem>
</itemizedlist>
<question>
<para>
- Is it possible to reduce network broadcast activity with Samba-3?
+ Is it possible to reduce network broadcast activity with Samba?
</para>
</question>
<note><para>
Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as
- well as with Samba-3.
+ well as with Samba.
</para></note>
</answer>
</para>
<para>
- Samba-3 supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling.
+ Samba supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling.
Just create user accounts by running <command>smbpasswd -a 'username'</command>
</para>
<para>
The parameter in the &smb.conf; file that controls this behavior is known as <parameter>encrypt
- passwords</parameter>. The default setting for this in Samba-3 is <constant>Yes (Enabled)</constant>.
+ passwords</parameter>. The default setting for this in Samba is <constant>Yes (Enabled)</constant>.
</para>
</answer>
<para>
Is it necessary to specify <smbconfoption name="encrypt passwords">Yes</smbconfoption>
- when Samba-3 is configured as a domain member?
+ when Samba is configured as a domain member?
</para>
</question>
<question>
<para>
- Is it necessary to specify a <parameter>guest account</parameter> when Samba-3 is configured
+ Is it necessary to specify a <parameter>guest account</parameter> when Samba is configured
as a domain member server?
</para>
<indexterm><primary>smbpasswd</primary></indexterm>
<indexterm><primary>ldapsam</primary></indexterm>
<indexterm><primary>Active Directory</primary></indexterm>
- You've come a long way now. You have pretty much mastered Samba-3 for
- most uses it can be put to. Up until now, you have cast Samba-3 in the leading
+ You've come a long way now. You have pretty much mastered Samba for
+ most uses it can be put to. Up until now, you have cast Samba in the leading
role, and where authentication was required, you have used one or another of
Samba's many authentication backends (from flat text files with smbpasswd
to LDAP directory integration with ldapsam). Now you can design a
</para>
<para>
- You have decided to set the ball rolling by introducing Samba-3 into the network
+ You have decided to set the ball rolling by introducing Samba into the network
gradually, taking over key services and easing the way to a full migration and,
therefore, integration into Abmas's existing business later.
</para>
<indexterm><primary>Kerberos</primary></indexterm><indexterm><primary>token</primary></indexterm>
Functionally, the user's Internet Explorer requests a browsing session with the
Squid proxy, for which it offers its AD authentication token. Squid hands off
- the authentication request to the Samba-3 authentication helper application
+ the authentication request to the Samba authentication helper application
called <command>ntlm_auth</command>. This helper is a hook into winbind, the
- Samba-3 NTLM authentication daemon. Winbind enables UNIX services to authenticate
+ Samba NTLM authentication daemon. Winbind enables UNIX services to authenticate
against Microsoft Windows domains, including Active Directory domains. As Active
Directory authentication is a modified Kerberos authentication, winbind is assisted
in this by local Kerberos 5 libraries configured to check passwords with the Active
</para></listitem>
<listitem><para>
- Configuring, compiling, and then installing the supporting Samba-3 components
+ Configuring, compiling, and then installing the supporting Samba components
</para></listitem>
<listitem><para>
<indexterm><primary>Squid</primary></indexterm>
First, your system needs to be prepared and in a known good state to proceed. This consists
of making sure that everything the system depends on is present and that everything that could
- interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3
+ interfere or conflict with the system is removed. You will be configuring the Squid and Samba
packages and updating them if necessary. If conflicting packages of these programs are installed,
they must be removed.
</para>
<para>
<indexterm><primary>Active Directory</primary></indexterm>
- Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it
+ Samba must be configured to correctly use Active Directory. Samba must be used, since it
has the necessary components to interface with Active Directory.
</para>
<procedure>
- <title>Securing Samba-3 With ADS Support Steps</title>
+ <title>Securing Samba With ADS Support Steps</title>
<step><para>
<indexterm><primary>Red Hat Linux</primary></indexterm>
<indexterm><primary>Red Hat Fedora Linux</primary></indexterm>
<indexterm><primary>MIT KRB5</primary></indexterm>
<indexterm><primary>ntlm_auth</primary></indexterm>
- Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team
+ Download the latest stable Samba for Red Hat Linux from the official Samba Team
<ulink url="http://ftp.samba.org">FTP site.</ulink> The official Samba Team
RPMs for Red Hat Fedora Linux contain the <command>ntlm_auth</command> tool
needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use.
<step><para>
<indexterm><primary>Squid</primary></indexterm>
<indexterm><primary>ntlm_auth</primary></indexterm>
- Squid uses the <command>ntlm_auth</command> helper build with Samba-3.
+ Squid uses the <command>ntlm_auth</command> helper build with Samba.
You may test <command>ntlm_auth</command> with the command:
<screen>
&rootprompt; /usr/bin/ntlm_auth --username=jht
<indexterm><primary>NSS</primary></indexterm>
<indexterm><primary>winbind</primary></indexterm>
<indexterm><primary>authentication</primary></indexterm>
- For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
+ For Squid to benefit from Samba, NSS must be updated to allow winbind as a valid route to user authentication.
</para>
<para>
<para>
<indexterm><primary>Squid</primary></indexterm>
<indexterm><primary>Active Directory</primary><secondary>authentication</secondary></indexterm>
- Squid must be configured correctly to interact with the Samba-3
+ Squid must be configured correctly to interact with the Samba
components that handle Active Directory authentication.
</para>
<indexterm><primary>daemon</primary></indexterm>
<indexterm><primary>smbd</primary></indexterm>
<indexterm><primary>file and print server</primary></indexterm>
- Samba-3 is a file and print server. The core components that provide this functionality are <command>smbd</command>,
+ Samba is a file and print server. The core components that provide this functionality are <command>smbd</command>,
<command>nmbd</command>, and the identity resolver daemon, <command>winbindd</command>.
</para>
<para>
<indexterm><primary>SMB/CIFS</primary></indexterm>
<indexterm><primary>smbclient</primary></indexterm>
- Samba-3 is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>.
+ Samba is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>.
</para>
<para>
<indexterm><primary>validation</primary></indexterm>
<indexterm><primary>inter-operability</primary></indexterm>
<indexterm><primary>authentication</primary></indexterm>
- Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.
- Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
+ Samba includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.
+ Samba includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
servers and clients. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts
- as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switch (NSS) modules
+ as well as logins to an SMB/CIFS authentication server backend. Samba includes name service switch (NSS) modules
to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial
server products).
</para>
Well, you have reached one of the last chapters of this book. It is customary to attempt
to wrap up the theme and contents of a book in what is generally regarded as the
chapter that should draw conclusions. This book is a suspense thriller, and since
- the plot of the stories told mostly lead you to bigger, better Samba-3 networking
+ the plot of the stories told mostly lead you to bigger, better Samba networking
solutions, it is perhaps appropriate to close this book with a few pertinent comments
- regarding some of the things everyone can do to deliver a reliable Samba-3 network.
+ regarding some of the things everyone can do to deliver a reliable Samba network.
</para>
<blockquote><attribution>Anonymous</attribution><para>
<para><indexterm>
<primary>experiment</primary>
</indexterm>
- By this point in the book, you have been exposed to many Samba-3 features and capabilities.
+ By this point in the book, you have been exposed to many Samba features and capabilities.
More importantly, if you have implemented the examples given, you are well on your way to becoming
- a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to
+ a Samba networking guru who knows a lot about Microsoft Windows. If you have taken the time to
practice, you likely have thought of improvements and scenarios with which you can experiment. You
are rather well plugged in to the many flexible ways Samba can be used.
</para>
<para><indexterm>
<primary>criticism</primary>
</indexterm>
- This is a book about Samba-3. Understandably, its intent is to present it in a positive light.
+ This is a book about Samba. Understandably, its intent is to present it in a positive light.
The casual observer might conclude that this book is one-eyed about Samba. It is &smbmdash; what
would you expect? This chapter exposes some criticisms that have been raised concerning
the use of Samba. For each criticism, there are good answers and appropriate solutions.
<para><indexterm>
<primary>straw-man</primary>
</indexterm>
- This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled
+ This chapter provides a shameless self-promotion of Samba. The objections raised were not pulled
out of thin air. They were drawn from comments made by Samba users and from criticism during
discussions with Windows network administrators. The tone of the objections reflects as closely
as possible that of the original. The case presented is a straw-man example that is designed to
<primary>Active Directory</primary>
</indexterm>
You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory.
- The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform.
+ The IT team, led by Stan Soroka, is committed to Samba and to maintaining a uniform technology platform.
Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to
operate with a solution that is viewed by Christine and her group as <quote>an island of broken
technologies.</quote> This comment was made by one of Christine's staff as they were installing a new
- Samba-3 server at the new business.
+ Samba server at the new business.
</para>
<primary>consultant</primary>
</indexterm>
I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP,
- plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect
+ plus Samba will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect
to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent,
I would like to hire the services of a well-known Samba consultant to set the record straight.
</para>
</indexterm><indexterm>
<primary>employment</primary>
</indexterm>
- Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to
+ Samba is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to
make or reject. It is likely that your decision to use Samba can greatly benefit your company.
The Samba Team obviously believes that the Samba software is a worthy choice.
If you hire a consultant to assist with the installation and/or deployment of Samba, or if you hire
The report correctly mentions that Samba did not support the most recent
<constant>schannel</constant> and <constant>digital sign'n'seal</constant> features
of Microsoft Windows NT/200x/XPPro products. This is one of the key features
- of the Samba-3 release. Market research reports take so long to generate that they are
+ of the Samba release. Market research reports take so long to generate that they are
seldom a reflection of current practice, and in many respects reports are like a
pathology report &smbmdash; they reflect accurately (at best) status at a snapshot in time.
Meanwhile, the world moves on.
</indexterm><indexterm>
<primary>schannel</primary>
</indexterm>
- Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential
+ Sign'n'seal (plus schannel support) has been implemented in Samba. Beware of potential
problems acknowledged by Microsoft as having been fixed but reported by some as still
possibly an open issue.
</para></listitem>
<primary>inter-operability</primary>
</indexterm>
The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft
- Active Directory. The possibility to do this is not planned in the current Samba-3
- roadmap. Samba-3 does aim to provide further improvements in interoperability so that
+ Active Directory. The possibility to do this is not planned in the current Samba
+ roadmap. Samba does aim to provide further improvements in interoperability so that
UNIX/Linux systems may be fully integrated into Active Directory domains.
</para></listitem>
</indexterm><indexterm>
<primary>registry change</primary>
</indexterm>
- No. Samba-3 fully supports <constant>Sign'n'seal</constant> as well as <constant>schannel</constant>
- operation. The registry change should not be applied when Samba-3 is used as a domain controller.
+ No. Samba fully supports <constant>Sign'n'seal</constant> as well as <constant>schannel</constant>
+ operation. The registry change should not be applied when Samba is used as a domain controller.
</para>
</answer>
<question>
<para>
- Does Samba-3 support Active Directory?
+ Does Samba support Active Directory?
</para>
</question>
<para><indexterm>
<primary>Active Directory</primary>
</indexterm>
- Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not
+ Yes. Samba can be a fully participating native mode Active Directory client. Samba-3 does not
provide Active Directory services. It cannot be used to replace a Microsoft Active Directory
- server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit,
+ server implementation. Samba can function as an Active Directory client (workstation) toolkit,
and it can function as an Active Directory domain member server.
</para>
<para><indexterm>
<primary>mixed-mode</primary>
</indexterm>
- When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
+ When Samba is used with Active Directory, is it necessary to run mixed-mode operation, as was
necessary with Samba-2?
</para>
<para><indexterm>
<primary>native</primary>
</indexterm>
- No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x
+ No. Samba can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x
Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation,
- because Samba-3 can join a native Windows 2003 Server ADS domain.
+ because Samba can join a native Windows 2003 Server ADS domain.
</para>
</answer>
<para><indexterm>
<primary>share ACLs</primary>
</indexterm>
- Is it mandatory to set share ACLs to get a secure Samba-3 server?
+ Is it mandatory to set share ACLs to get a secure Samba server?
</para>
</question>
</indexterm><indexterm>
<primary>security</primary>
</indexterm>
- No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides
+ No. Samba honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides
means of securing shares through share definition controls in the &smb.conf; file. The additional
support for share-level ACLs is like frosting on the cake. It adds to security but is not essential
to it.
<para><indexterm>
<primary>Computer Management</primary>
</indexterm>
- In the book, <quote>The Official Samba-3 HOWTO and Reference Guide</quote>, you recommended use
+ In the book, <quote>The Official Samba HOWTO and Reference Guide</quote>, you recommended use
of the Windows NT4 Server Manager (part of the <filename>SRVTOOLS.EXE</filename>) utility. Why
have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
</para>
<indexterm><primary>OpenLDAP</primary></indexterm>
The implementation of Samba BDCs necessitates the installation and configuration of LDAP.
For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial
- LDAP servers in current use with Samba-3 include:
+ LDAP servers in current use with Samba include:
</para>
<itemizedlist>
A word of caution is fully in order. OpenLDAP is purely an LDAP server, and unlike commercial
offerings, it requires that you manually edit the server configuration files and manually
initialize the LDAP directory database. OpenLDAP itself has only command-line tools to
- help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges.
+ help you to get OpenLDAP and Samba running as required, albeit with some learning curve challenges.
</para>
<para>
if you find the challenge of learning about LDAP directories, schemas, configuration, and management
tools and the creation of shell and Perl scripts a bit
challenging. OpenLDAP can be easily customized, though it includes
- many ready-to-use schemas. Samba-3 provides an OpenLDAP schema file
+ many ready-to-use schemas. Samba provides an OpenLDAP schema file
that is required for use as a passdb backend.
</para>
<para>
<indexterm><primary>interoperability</primary></indexterm>
- For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability,
+ For those who are willing to brave the process of installing and configuring LDAP and Samba interoperability,
there are a few nice Web-based tools that may help you to manage your users and groups more effectively.
The Web-based tools you might like to consider include the
<ulink url="http://lam.sourceforge.net/">LDAP Account Manager</ulink> (LAM) and the Webmin-based
The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory
server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system
accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account
- attributes Samba needs. Samba-3 can use the LDAP backend to store:
+ attributes Samba needs. Samba can use the LDAP backend to store:
</para>
<itemizedlist>
<indexterm><primary>NSS</primary></indexterm>
<indexterm><primary>UID</primary></indexterm>
<indexterm><primary>nss_ldap</primary></indexterm>
- The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking
+ The use of LDAP with Samba makes it necessary to store UNIX accounts as well as Windows Networking
accounts in the LDAP backend. This implies the need to use the
<ulink url="http://www.padl.com/Contents/OpenSourceSoftware.html">PADL LDAP tools</ulink>. The resolution
of the UNIX group name to its GID must be enabled from either the <filename>/etc/group</filename>
</para>
<para>
- This book is about Samba-3, so you can confine the printing style to just the smart
+ This book is about Samba, so you can confine the printing style to just the smart
style of installation. Those interested in further information regarding intelligent
printing should review documentation on the Easy Software Products Web site.
</para>
<itemizedlist>
- <listitem><para>Samba-3 PDC Server Configuration</para>
+ <listitem><para>Samba PDC Server Configuration</para>
<orderedlist>
<listitem><para>DHCP and DNS servers</para></listitem>
<listitem><para>OpenLDAP server</para></listitem>
<listitem><para>PAM and NSS client tools</para></listitem>
- <listitem><para>Samba-3 PDC</para></listitem>
+ <listitem><para>Samba PDC</para></listitem>
<listitem><para>Idealx smbldap scripts</para></listitem>
<listitem><para>LDAP initialization</para></listitem>
<listitem><para>Create user and group accounts</para></listitem>
<listitem><para>Configuration of user rights and privileges</para></listitem>
</orderedlist>
</listitem>
- <listitem><para>Samba-3 BDC Server Configuration</para>
+ <listitem><para>Samba BDC Server Configuration</para>
<orderedlist>
<listitem><para>DHCP and DNS servers</para></listitem>
<listitem><para>PAM and NSS client tools</para></listitem>
</table>
<para>
- Samba-3 and OpenLDAP will have a degree of interdependence that is unavoidable. The method
- for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you
+ Samba and OpenLDAP will have a degree of interdependence that is unavoidable. The method
+ for bootstrapping the LDAP and Samba configuration is relatively straightforward. If you
follow these guidelines, the resulting system should work fine.
</para>
<step><para>
<indexterm><primary>secrets.tdb</primary></indexterm>
<indexterm><primary>smbpasswd</primary></indexterm>
- Samba-3 communicates with the LDAP server. The password that it uses to
+ Samba communicates with the LDAP server. The password that it uses to
authenticate to the LDAP server must be stored in the <filename>secrets.tdb</filename>
file. Execute the following to create the new <filename>secrets.tdb</filename> files
and store the password for the LDAP Manager:
<step><para>
<indexterm><primary>smbd</primary></indexterm>
<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
- Samba-3 generates a Windows Security Identifier (SID) only when <command>smbd</command>
+ Samba generates a Windows Security Identifier (SID) only when <command>smbd</command>
has been started. For this reason, you start Samba. After a few seconds delay,
execute:
<screen>
</procedure>
<para>
- Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with
+ Your Samba PDC is now ready to communicate with the LDAP password backend. Let's get on with
configuration of the LDAP server.
</para>
<para>
<indexterm><primary>Idealx</primary><secondary>smbldap-tools</secondary></indexterm>
- The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts
+ The Idealx scripts, or equivalent, are necessary to permit Samba to manage accounts
on the LDAP server. You have chosen the Idealx scripts because they are the best-known
LDAP configuration scripts. The use of these scripts will help avoid the necessity
to create custom scripts. It is easy to download them from the Idealx
</para>
<para>
- At this time, Samba-3 requires that on a PDC all UNIX (POSIX) group accounts that are
+ At this time, Samba requires that on a PDC all UNIX (POSIX) group accounts that are
mapped (linked) to Windows domain group accounts must be in the LDAP database. It does not
hurt to have UNIX user and group accounts in both the system files as well as in the LDAP
database. From a UNIX system perspective, the NSS resolver checks system files before
<indexterm><primary>directory</primary><secondary>People container</secondary></indexterm>
<indexterm><primary>directory</primary><secondary>Computers container</secondary></indexterm>
In the following examples, as the LDAP database is initialized, we do create a container
- for Computer (machine) accounts. In the Samba-3 &smb.conf; files, specific use is made
+ for Computer (machine) accounts. In the Samba &smb.conf; files, specific use is made
of the People container, not the Computers container, for domain member accounts. This is not a
mistake; it is a deliberate action that is necessitated by the fact that the resolution of
a machine (computer) account to a UID is done via NSS. The only way this can be handled is
<step><para>
<indexterm><primary>ldapsam</primary></indexterm>
<indexterm><primary>pdbedit</primary></indexterm>
- The final validation step involves making certain that Samba-3 can obtain the user
+ The final validation step involves making certain that Samba can obtain the user
accounts from the LDAP ldapsam passwd backend. Execute the following command as shown:
<screen>
&rootprompt; pdbedit -Lv chrisr
<step><para>
The server you have so carefully built is now ready for another important step. You
- start the Samba-3 server and validate its operation. Execute the following to render all
+ start the Samba server and validate its operation. Execute the following to render all
the processes needed fully operative so that, on system reboot, they are automatically
started:
<screen>
<step><para>
<indexterm><primary>smbclient</primary></indexterm>
- You may now check Samba-3 operation as follows:
+ You may now check Samba operation as follows:
<screen>
&rootprompt; smbclient -L massive -U%
<para>
<indexterm><primary>CUPS</primary></indexterm>
- The configuration for Samba-3 to enable CUPS raw-print-through printing has already been
+ The configuration for Samba to enable CUPS raw-print-through printing has already been
taken care of in the &smb.conf; file. The only preparation needed for <constant>smart</constant>
- printing to be possible involves creation of the directories in which Samba-3 stores
+ printing to be possible involves creation of the directories in which Samba stores
Windows printing driver files.
</para>
</sect1>
<sect1 id="sbehap-bldg1">
- <title>Samba-3 BDC Configuration</title>
+ <title>Samba BDC Configuration</title>
<procedure>
<title>Configuration of BDC Called: <constant>BLDG1</constant></title>
<step><para>
<indexterm><primary>smbpasswd</primary></indexterm>
- You must now set the LDAP administrative password into the Samba-3 <filename>secrets.tdb</filename>
+ You must now set the LDAP administrative password into the Samba <filename>secrets.tdb</filename>
file by executing this command:
<screen>
&rootprompt; smbpasswd -w not24get
<step><para>
Now you must obtain the domain SID from the PDC and store it into the
<filename>secrets.tdb</filename> file also. This step is not necessary with an LDAP
- passdb backend because Samba-3 obtains the domain SID from the
+ passdb backend because Samba obtains the domain SID from the
sambaDomain object it automatically stores in the LDAP backend. It does not hurt to
add the SID to the <filename>secrets.tdb</filename>, and if you wish to do so, this
command can achieve that:
Storing SID S-1-5-21-3504140859-1010554828-2431957765 \
for Domain MEGANET2 in secrets.tdb
</screen>
- When configuring a Samba-3 BDC that has an LDAP backend, there is no need to take
+ When configuring a Samba BDC that has an LDAP backend, there is no need to take
any special action to join it to the domain. However, winbind communicates with the
domain controller that is running on the localhost and must be able to authenticate,
thus requiring that the BDC should be joined to the domain. The process of joining
<indexterm>
<primary>pdbedit</primary>
</indexterm>
- Verify that user and group account resolution works via Samba-3 tools as follows:
+ Verify that user and group account resolution works via Samba tools as follows:
<screen>
&rootprompt; pdbedit -L
root:0:root
<step><para>
The server you have so carefully built is now ready for another important step. Now
- start the Samba-3 server and validate its operation. Execute the following to render all
+ start the Samba server and validate its operation. Execute the following to render all
the processes needed fully operative so that, upon system reboot, they are automatically
started:
<screen>
&rootprompt; rcsmb start
&rootprompt; rcwinbind start
</screen>
- Samba-3 should now be running and is ready for a quick test. But not quite yet!
+ Samba should now be running and is ready for a quick test. But not quite yet!
</para></step>
<step><para>
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<chapter id="ntmigration">
- <title>Migrating NT4 Domain to Samba-3</title>
+ <title>Migrating NT4 Domain to Samba</title>
<para>
Ever since Microsoft announced that it was discontinuing support for Windows
NT4, Samba users started to ask for detailed instructions on how to migrate
- from NT4 to Samba-3. This chapter provides background information that should
+ from NT4 to Samba. This chapter provides background information that should
meet these needs.
</para>
<indexterm><primary>accounts</primary><secondary>user</secondary></indexterm>
<indexterm><primary>accounts</primary><secondary>group</secondary></indexterm>
<indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm>
- The migration from NT4 to Samba-3 can involve a number of factors, including
+ The migration from NT4 to Samba can involve a number of factors, including
migration of data to another server, migration of network environment controls
such as group policies, and migration of the users, groups, and machine
accounts.
<para>
<indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm>
It should be pointed out now that it is possible to migrate some systems from
- a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly
+ a Windows NT4 domain environment to a Samba domain environment. This is certainly
not possible in every case. It is possible to just migrate the domain accounts
- to Samba-3 and then to switch machines, but as a hands-off transition, this is more
+ to Samba and then to switch machines, but as a hands-off transition, this is more
the exception than the rule. Most systems require some tweaking after
migration before an environment that is acceptable for immediate use
is obtained.
<indexterm><primary>ldapsam</primary></indexterm>
<indexterm><primary>passdb backend</primary></indexterm>
You are about to migrate an MS Windows NT4 domain accounts database to
- a Samba-3 server. The Samba-3 server is using a
+ a Samba server. The Samba-3 server is using a
<parameter>passdb backend</parameter> based on LDAP. The
<constant>ldapsam</constant> is ideal because an LDAP backend can be distributed
for use with BDCs &smbmdash; generally essential for larger networks.
<para>
Your objective is to document the process of migrating user and group accounts
- from several NT4 domains into a single Samba-3 LDAP backend database.
+ from several NT4 domains into a single Samba LDAP backend database.
</para>
</sect2>
<para>
<indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm>
<indexterm><primary>disruptive</primary></indexterm>
- Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are.
- While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server,
+ Before commencing an NT4 to Samba migration, you should consider what your objectives are.
+ While in some cases it is possible simply to migrate an NT4 domain to a single Samba server,
that may not be a good idea from an administration perspective. Since the process involves going
through a certain amount of disruptive activity anyhow, why not take this opportunity to
review the structure of the network, how Windows clients are controlled and how they
have done little to keep the NT4 server environment up to date with more recent Windows releases,
particularly Windows XP Professional. The migration provides opportunity to revise and update
roaming profile deployment as well as folder redirection. Given that you must port the
- greater network configuration of this from the old NT4 server to the new Samba-3 server.
+ greater network configuration of this from the old NT4 server to the new Samba server.
Do not forget to validate the security descriptors in the profiles share as well as network logon
- scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this
+ scripts. Feedback from sites that are migrating to Samba suggests that many are using this
as a good time to update desktop systems also. In all, the extra effort should constitute no
real disruption to users, but rather, with due diligence and care, should make their network experience
a much happier one.
<para>
<indexterm><primary>strategic</primary></indexterm>
<indexterm><primary>active directory</primary></indexterm>
- Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic
+ Migration of an NT4 domain user and group database to Samba involves a certain strategic
element. Many sites have asked for instructions regarding merging of multiple NT4
- domains into one Samba-3 LDAP database. It seems that this is viewed as a significant
+ domains into one Samba LDAP database. It seems that this is viewed as a significant
added value compared with the alternative of migration to Windows Server 200x and Active
Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration
from a Windows NT4 domain to a Samba domain.
<title>Political Issues</title>
<para>
- The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3
+ The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba
domain may be seen by those who had power over them as a loss of prestige or a loss of
power. The imposition of a single domain may even be seen as a threat. So in migrating and
merging account databases, be consciously aware of the political fall-out in which you
<para>
The best advice that can be given to those who set out to merge NT4 domains into a single
- Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers
+ Samba domain is to promote (sell) the action as one that reduces costs and delivers
greater network interoperability and manageability.
</para>
<para>
From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
- to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX
+ to Samba are being performed using a new server or a new installation of a Linux or UNIX
server. If you contemplate doing this, please note that the steps that follow in this
chapter assume familiarity with the information that has been previously covered in this
book. You are particularly encouraged to be familiar with <link linkend="secure"/>,
</para>
<para>
- We present here the steps and example output for two NT4 to Samba-3 domain migrations. The
+ We present here the steps and example output for two NT4 to Samba domain migrations. The
first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter>
collection of parameters are used to effect the addition of accounts into the passdb backend.
<itemizedlist>
<listitem><para>
- Prepare the target Samba-3 server. This involves configuring Samba-3 for
+ Prepare the target Samba server. This involves configuring Samba-3 for
migration to either a tdbsam or an ldapsam backend.
</para></listitem>
</para></listitem>
<listitem><para>
- Upgrade the Samba-3 server from a BDC to a PDC, and validate all account
+ Upgrade the Samba server from a BDC to a PDC, and validate all account
information.
</para></listitem>
</itemizedlist>
<title>NT4 Migration Using LDAP Backend</title>
<para>
- In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about
+ In this example, the migration is of an NT4 PDC to a Samba PDC with an LDAP backend. The accounts about
to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the
smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
Four scripts are essential to the migration process. Other scripts will be required
</para></step>
<example id="sbent4smb">
-<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: A</title>
+<title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: A</title>
<smbconfblock>
<smbconfsection name="[global]"/>
<smbconfoption name="workgroup">DAMNATION</smbconfoption>
</example>
<example id="sbent4smb2">
-<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: B</title>
+<title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: B</title>
<smbconfblock>
<smbconfsection name="[apps]"/>
<smbconfoption name="comment">Application Data</smbconfoption>
<para>
Another way to obtain the domain SID from the target NT4 domain that is being
- migrated to Samba-3 is by executing the following:
+ migrated to Samba is by executing the following:
<screen>
&rootprompt; net rpc info -S TRANSGRESSION
</screen>
<step><para>
Now it is time to join the Samba BDC to the target NT4 domain that is being
- migrated to Samba-3 by executing the following:
+ migrated to Samba by executing the following:
<screen>
&rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get
merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
<step><para>
The final responsibility in the migration process is to create identical
- shares and printing resources on the new Samba-3 server, copy all data
+ shares and printing resources on the new Samba server, copy all data
across, set up privileges, and set share and file/directory access controls.
</para></step>
<step><para>
Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
- NT4 BDCs have been shut down can the Samba-3 PDC be started.
+ NT4 BDCs have been shut down can the Samba PDC be started.
</para></step>
<step><para>
</para></step>
<step><para>
- The configuration of Samba-3 BDC servers can be accomplished now or at any
+ The configuration of Samba BDC servers can be accomplished now or at any
convenient time in the future. Please refer to the carefully detailed process
for doing so is outlined in <link linkend="sbehap-bldg1"/>.
</para></step>
<title>Migration Steps Using tdbsam</title>
<step><para>
- Prepare a Samba-3 server precisely per the instructions shown in <link linkend="Big500users"/>.
+ Prepare a Samba server precisely per the instructions shown in <link linkend="Big500users"/>.
Set the workgroup name to <constant>MEGANET</constant>.
</para></step>
<title>Key Points Learned</title>
<para>
- Migration of an NT4 PDC database to a Samba-3 PDC is possible.
+ Migration of an NT4 PDC database to a Samba PDC is possible.
</para>
<itemizedlist>
</para></listitem>
<listitem><para>
- Multiple NT4 domains can be merged into a single Samba-3
+ Multiple NT4 domains can be merged into a single Samba
domain.
</para></listitem>
<listitem><para>
- The net Samba-3 domain most likely requires some
+ The net Samba domain most likely requires some
administration and updating before going live.
</para></listitem>
</itemizedlist>
</indexterm><indexterm>
<primary>LDAP database</primary>
</indexterm>
- Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
+ Samba must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
does not fabricate the UNIX IDs from thin air, but rather requires them to be located
in a suitable place.
</para>
<secondary>machine</secondary>
</indexterm>
I want to change my domain name after I migrate all accounts from an NT4 domain to a
- Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
+ Samba domain. Does it make any sense to migrate the machine accounts in that case?
</para>
</question>
</indexterm>
I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
- unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid
+ unjoin the domain and then rejoin the newly renamed Samba domain, you can be certain to avoid
this tattooing effect.
</para>
<para><indexterm>
<primary>multiple group mappings</primary>
</indexterm>
- After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
+ After merging multiple NT4 domains into a Samba domain, I lost all multiple group mappings. Why?
</para>
</question>
</indexterm><indexterm>
<primary>/etc/group</primary>
</indexterm>
- Samba-3 currently does not implement multiple group membership internally. If you use the Windows
+ Samba currently does not implement multiple group membership internally. If you use the Windows
NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
then multiple group membership is handled through the UNIX groups file. When you dump the user
<para><indexterm>
<primary>vampire</primary>
</indexterm>
- My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
+ My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba
LDAP backend system using the vampire process?
</para>
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<chapter id="nw4migration">
- <title>Migrating NetWare Server to Samba-3</title>
+ <title>Migrating NetWare Server to Samba</title>
<para>
<indexterm><primary>Novell</primary></indexterm>
grapple with a similar migration challenge. Let there be no confusion,
the information presented in this chapter is provided to demonstrate
how Misty dealt with a particular NetWare migration requirement, and
- it provides an overall approach to the implementation of a Samba-3
+ it provides an overall approach to the implementation of a Samba
environment that is significantly divergent from that presented in
<link linkend="happy"/>.
</para>
you designed and built a network that provides a high degree of flexibility, integrity,
and dependability. It was enough for the basic needs each was designed to fulfill. In
this chapter you address a more complex set of needs. The solution you explore
- introduces you to basic features that are specific to Samba-3.
+ introduces you to basic features that are specific to Samba.
</para>
<para>
You should note that a working and secure solution could be implemented using Samba-2.2.x.
- In the exercises presented here, you are gradually using more Samba-3-specific features,
+ In the exercises presented here, you are gradually using more Samba-specific features,
so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given.
- To avoid confusion, this book is all about Samba-3. Let's get the exercises in this
+ To avoid confusion, this book is all about Samba. Let's get the exercises in this
chapter underway.
</para>
<para>
Many of the conclusions you draw here are obvious. Some requirements are not very clear
- or may simply be your means of drawing the most out of Samba-3. Much can be done more simply
+ or may simply be your means of drawing the most out of Samba. Much can be done more simply
than you will demonstrate here, but keep in mind that the network must scale to at least 500
users. This means that some functionality will be overdesigned for the current 130-user
environment.
<para>
The configuration of Web serving, Web proxy services, electronic mail, and the details of
generic antivirus handling are beyond the scope of this book and therefore are not
- covered except insofar as this affects Samba-3.
+ covered except insofar as this affects Samba.
</para>
<para>
<title>Samba Configuration Steps</title>
<step><para>
- Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary
+ Install the Samba binary RPM from the Samba-Team FTP site. Assuming that the binary
RPM file is called <filename>samba-3.0.20-1.i386.rpm</filename>, one way to install this
file is as follows:
<screen>
<para>
The guideline provided in <emphasis>TOSHARG2</emphasis>, Chapter 10, Section 10.1.2,
is to limit the number of accounts in the tdbsam backend to 250. This is the point
- at which most networks tend to want backup domain controllers (BDCs). Samba-3 does
+ at which most networks tend to want backup domain controllers (BDCs). Samba does
not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The
limitation of 250 users per tdbsam is predicated only on the need for replication,
not on the limits<footnote><para>Bench tests have shown that tdbsam is a very
<answer>
<para>
- The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port
+ The default order by which Samba attempts to communicate with MS Windows clients is via port 445 (the TCP port
used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS
over TCP/IP. In this configuration Windows network operations are predicated around NetBIOS over TCP/IP. By
specifying the use of only port 139, the intent is to reduce unsuccessful service connection attempts.
- The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain
+ The result of this is improved network performance. Where Samba is installed as an Active Directory Domain
member, the default behavior is highly beneficial and should not be changed.
</para>
This chapter lays the groundwork for understanding the basics of Samba operation.
Instead of a bland technical discussion, each principle is demonstrated by way of a
real-world scenario for which a working solution<footnote><para>The examples given mirror those documented
- in The Official Samba-3 HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional
+ in The Official Samba HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional
insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4.
</para></footnote> is fully described.
</para>
<title>Samba Server Configuration</title>
<step><para>
- Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba
+ Download the Samba RPM packages for Red Hat Fedora Core2 from the Samba
<ulink url="http://www.samba.org">FTP servers.</ulink>
</para></step>
directories are created with the same owner and group as the directory in which they are
created. Any new directories created still have the same owner, group, and permissions as the
directory they are in. This should eliminate all permissions-based file access problems. For
- more information on this subject, refer to TOSHARG2<footnote><para>The Official Samba-3 HOWTO and
+ more information on this subject, refer to TOSHARG2<footnote><para>The Official Samba HOWTO and
Reference Guide, Chapter 15, File, Directory and Share Access Controls.</para></footnote> or refer
to the UNIX man page for the <command>chmod</command> and the <command>chown</command> commands.
</para></step>
<step><para>
Install the &smb.conf; file shown in <link linkend="charity-smbconfnew"/> in the
<filename>/etc/samba</filename> directory. This newer &smb.conf; file uses user-mode security
- and is more suited to the mode of operation of Samba-3 than the older share-mode security
+ and is more suited to the mode of operation of Samba than the older share-mode security
configuration that was shown in the first edition of this book.
</para>
</table>
<procedure>
- <title>Migration from Windows NT4 Workstation System to Samba-3</title>
+ <title>Migration from Windows NT4 Workstation System to Samba</title>
<step><para><indexterm>
<primary>migration</primary>
</para></step>
<step><para>
- Install the latest Samba-3 binary Red Hat Linux RPM that is available from the
+ Install the latest Samba binary Red Hat Linux RPM that is available from the
Samba FTP site.
</para></step>
</step>
<step><para>
- Verify that the files are being copied correctly from the Windows NT4 machine to the Samba-3 server.
- This is best done on the Samba-3 server. Check the contents of the directory tree under
+ Verify that the files are being copied correctly from the Windows NT4 machine to the Samba server.
+ This is best done on the Samba server. Check the contents of the directory tree under
<filename>/data</filename> by executing the following command:
<screen>
&rootprompt; ls -aR /data
The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
possible to start with the installation that you have created here, migrate it
- to a Samba-3 configuration, and then secure the system further. Configurations following
+ to a Samba configuration, and then secure the system further. Configurations following
this one utilize features that may not be supported in Samba-2.2.x releases.
However, you should note that the examples in each chapter start with the assumption
that a fresh new installation is being effected.
</para></step>
<step><para>
- Install the Samba-3 binary RPM from the Samba-Team FTP site.
+ Install the Samba binary RPM from the Samba-Team FTP site.
</para></step>
<step><para>
<answer>
<para>
- Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
+ Samba does not permit a Domain Group to become visible to Domain network clients unless the account
has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
<guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>.
</para>
<para>
If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
- SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3)
+ SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba)
or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
to check the man page for this command for detailed instructions regarding the steps involved.
</para>
<answer>
<para>
- Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
+ Samba implements a Windows NT4-style security domain architecture. This type of Domain cannot
be managed using tools present on a Windows XP Professional installation. You may download from the
Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event
- Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
+ Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba
Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
- for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
+ for the Samba Domain. It may help to log on as the <constant>root</constant> account.
</para>
</answer>
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<chapter id="upgrades">
-<title>Updating Samba-3</title>
+<title>Updating Samba</title>
<para>
<indexterm><primary>migrate</primary></indexterm>
<para>
<indexterm><primary>smbpasswd</primary></indexterm>
<indexterm><primary>passdb backend</primary></indexterm>
-There has also been much talk about migration of Samba-3 from an smbpasswd
+There has also been much talk about migration of Samba from an smbpasswd
passdb backend to the use of the tdbsam or ldapsam facilities that are new
-to Samba-3.
+to Samba.
</para>
<para>
<indexterm><primary>stand-alone server</primary></indexterm>
<indexterm><primary>SAS</primary></indexterm>
<indexterm><primary>SID</primary></indexterm>
- In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain
+ In Samba on a domain controller (PDC or BDC), the domain name controls the domain
SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled
the SID. On a standalone server the hostname still controls the SID.
</para>
<para>
<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
<indexterm><primary>net</primary><secondary>setlocalsid</secondary></indexterm>
- The local machine SID can be backed up using this procedure (Samba-3):
+ The local machine SID can be backed up using this procedure (Samba):
<screen>
&rootprompt; net getlocalsid > /etc/samba/my-local-SID
</screen>
<para>
Where the <filename>secrets.tdb</filename> file exists and a version of Samba 2.x or later
- has been used, there is no specific need to go through this update process. Samba-3 has the
+ has been used, there is no specific need to go through this update process. Samba has the
ability to read the older tdb file and to perform an in-situ update to the latest tdb format.
This is not a reversible process &smbmdash; it is a one-way upgrade.
</para>
<screen>
&rootprompt; rpcclient hostname lsaquery -Uroot%password
</screen>
- This can also be done with Samba-3 by executing:
+ This can also be done with Samba by executing:
<screen>
&rootprompt; net rpc info -Uroot%password
Domain Name: MIDEARTH
<para>
<indexterm><primary>compile-time</primary></indexterm>
- Samba-3 provides a neat new way to track the location of all control files as well as to
+ Samba provides a neat new way to track the location of all control files as well as to
find the compile-time options used as the Samba package was built. Here is how the dark
secrets of the internals of the location of control files within Samba executables can
be uncovered:
<indexterm><primary>codepage</primary></indexterm>
<indexterm><primary>internationalization</primary></indexterm>
Samba-2.x had no support for Unicode; instead, all national language character-set support in file names
- was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus
+ was done using particular locale codepage mapping techniques. Samba supports Unicode in file names, thus
providing true internationalization support.
</para>
<para>
<indexterm><primary>UTF-8</primary></indexterm>
- Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a
+ Files that are created with Samba will use UTF-8 encoding. Should the file system ever end up with a
mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some
effort to set straight.
</para>
<para>
<indexterm><primary>parameters</primary></indexterm>
- The following parameters are new to Samba-3 and should be correctly configured.
+ The following parameters are new to Samba and should be correctly configured.
Please refer to <link linkend="secure"/> through <link linkend="net2000users"/>
in this book for examples of use of the new parameters shown here:
<indexterm><primary>add group script</primary></indexterm>
<indexterm><primary>add machine script</primary></indexterm>
<indexterm><primary>add user script</primary></indexterm>
The <parameter>add machine script</parameter> functionality was previously
- handled by the <parameter>add user script</parameter>, which in Samba-3 is
+ handled by the <parameter>add user script</parameter>, which in Samba is
used exclusively to add user accounts.
</para>
<para>
Samba version 2.x could be compiled for use either with or without LDAP.
The LDAP control settings in the &smb.conf; file in this old version are
- completely different (and less complete) than they are with Samba-3. This
+ completely different (and less complete) than they are with Samba. This
means that after migrating the control files, it is necessary to reconfigure
the LDAP settings entirely.
</para>
</para>
<sect2>
- <title>Samba-3 to Samba-3 Updates on the Same Server</title>
+ <title>Samba to Samba-3 Updates on the Same Server</title>
<para>
The guidance in this section deals with updates to an existing
- Samba-3 server installation.
+ Samba server installation.
</para>
<sect3>
<title>Updating from Samba Versions Earlier than 3.0.5</title>
<para>
- With the provision that the binary Samba-3 package has been built
- with the same path and feature settings as the existing Samba-3
- package that is being updated, an update of Samba-3 versions 3.0.0
+ With the provision that the binary Samba package has been built
+ with the same path and feature settings as the existing Samba
+ package that is being updated, an update of Samba versions 3.0.0
through 3.0.4 can be updated to 3.0.5 without loss of functionality
and without need to change either the &smb.conf; file or, where
used, the LDAP schema.
<para>
<indexterm><primary>schema</primary></indexterm>
<indexterm><primary>LDAP</primary><secondary>schema</secondary></indexterm>
- When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10,
+ When updating versions of Samba prior to 3.0.6 to 3.0.6 through 3.0.10,
it is necessary only to update the LDAP schema (where LDAP is used).
- Always use the LDAP schema file that is shipped with the latest Samba-3
+ Always use the LDAP schema file that is shipped with the latest Samba
update.
</para>
</sect2>
<sect2>
- <title>Migrating Samba-3 to a New Server</title>
+ <title>Migrating Samba to a New Server</title>
<para>
The two most likely candidates for replacement of a server are
<para>
This book is your means to the straight path. It provides step-by-step,
proven, working examples of Samba deployments. If you want to deploy
- Samba-3 with the least effort, or if you want to become an expert at deploying
- Samba-3 without having to search through lots of documentation, this
+ Samba with the least effort, or if you want to become an expert at deploying
+ Samba without having to search through lots of documentation, this
book is the ticket to your destination.
</para>
</para>
<para>
- The focus of attention in this book is Samba-3. Specific notes are made in
+ The focus of attention in this book is Samba. Specific notes are made in
respect of how Samba may be made secure. This book does not attempt to provide
detailed information regarding secure operation and configuration of peripheral
services and applications such as OpenLDAP, DNS and DHCP, the need for which
environmental contexts, providing documented step-by-step implementations.
All example case configuration files, scripts, and other tools are provided
on the CD-ROM. This book is descriptive, provides detailed diagrams, and
- makes deployment of Samba-3 a breeze.
+ makes deployment of Samba a breeze.
</para>
<sect2>
and enhancements between samba-3.0.2 and samba-3.0.14 (the current release) that
necessitate this documentation update. This update has the specific intent to
refocus this book so that its guidance can be followed for samba-3.0.20
- and beyond. Further changes are expected as Samba-3 matures further and will
+ and beyond. Further changes are expected as Samba matures further and will
be reflected in future updates.
</para>
</varlistentry>
<varlistentry>
- <term>Chapter 8 &smbmdash; Updating Samba-3.</term><listitem>
+ <term>Chapter 8 &smbmdash; Updating Samba.</term><listitem>
<para>
This chapter is the result of repeated requests for better documentation of the steps
that must be followed when updating or upgrading a Samba server. It attempts to cover
</varlistentry>
<varlistentry>
- <term>Chapter 9 &smbmdash; Migrating NT4 Domain to Samba-3.</term><listitem>
+ <term>Chapter 9 &smbmdash; Migrating NT4 Domain to Samba.</term><listitem>
<para>
Another six months have passed. Abmas has acquired yet another company. You will find a
way to migrate all users off the old network onto the existing network without loss
<term>Chapter 10 &smbmdash; Migrating NetWare 4.11 Server to Samba.</term><listitem>
<para>
Misty Stanley-Jones has contributed information that summarizes her experience at migration
- from a NetWare server to Samba-3.
+ from a NetWare server to Samba.
</para>
<para><emphasis>TechInfo</emphasis> &smbmdash; The documentation provided demonstrates
<varlistentry>
<term>Chapter 12 &smbmdash; Integrating Additional Services.</term><listitem>
<para>
- The battle is almost over, Samba-3 has won the day. Your team are delighted and now you
+ The battle is almost over, Samba has won the day. Your team are delighted and now you
find yourself at yet another cross-roads. Abmas have acquired a snack food business, you
made promises you must keep. IT costs must be reduced, you have new resistance, but you
will win again. This time you choose to install the Squid proxy server to validate the
<para><emphasis>TechInfo</emphasis> &smbmdash; Samba provides the <command>ntlm_auth</command>
module that makes it possible for MS Windows Internet Explorer to connect via the Squid Web
- and FTP proxy server. You will configure Samba-3 as well as Squid to deliver authenticated
+ and FTP proxy server. You will configure Samba as well as Squid to deliver authenticated
access control using the Active Directory Domain user security credentials.
</para>
</listitem>
<title>Domain Members, Updating Samba and Migration</title>\r
\r
<para>\r
-This section <emphasis>Samba-3 by Example</emphasis> covers two main topics: How to add\r
-Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other\r
-subject is that of how to migrate from and NT4 Domain, a NetWare server, or from an earlier\r
-Samba version to environments that use the most recent Samba-3 release. \r
-</para>\r
-\r
-<para>\r
+This section <emphasis>Samba-3 by Example</emphasis> covers two main topics: How to add
+Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other
+subject is that of how to migrate from and NT4 Domain, a NetWare server, or from an earlier
+Samba version to environments that use the most recent Samba release.
+</para>
+
+<para>
Those who are making use of the chapter on Adding UNIX clients and servers running Samba\r
to a Samba or a Windows networking domain may also benefit by referring to the book\r
<emphasis>The Official Samba-3 HOWTO and Reference Guide.</emphasis>\r
<para>
<indexterm><primary>network administrator</primary></indexterm>
The purpose of this chapter is to present each of the points of control that are possible with
-Samba-3 in the hope that this will help the network administrator to find the optimum method
+Samba in the hope that this will help the network administrator to find the optimum method
for delivering the best environment for MS Windows desktop users.
</para>
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>LDAP</primary><secondary>slave</secondary></indexterm>
<indexterm><primary>scalability</primary></indexterm>
-Samba-3 can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
-Samba-3 PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
+Samba can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
+Samba PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
server or a slave server. The use of a slave LDAP server has the benefit that when the master is down, clients
may still be able to log onto the network. This effectively gives Samba a high degree of scalability and is
an effective solution for large organizations. If you use an LDAP slave server for a PDC, you will need to
<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
<indexterm><primary>non-LDAP</primary><secondary>backend</secondary></indexterm>
<indexterm><primary>propagate</primary></indexterm>
-It is not possible to run a Samba-3 BDC with a non-LDAP backend, as that backend must allow some form of
+It is not possible to run a Samba BDC with a non-LDAP backend, as that backend must allow some form of
"two-way" propagation of changes from the BDC to the master. At this time only LDAP delivers the capability
to propagate identity database changes from the BDC to the PDC. The BDC can use a slave LDAP server, while it
is preferable for the PDC to use as its primary an LDAP master server.
<indexterm><primary>SAM</primary><secondary>delta file</secondary></indexterm>
<indexterm><primary>PDC</primary></indexterm>
<indexterm><primary>BDC</primary></indexterm>
-Samba-3 cannot participate in true SAM replication and is therefore not able to
-employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will
+Samba cannot participate in true SAM replication and is therefore not able to
+employ precisely the same protocols used by MS Windows NT4. A Samba BDC will
not create SAM update delta files. It will not interoperate with a PDC (NT4 or Samba)
to synchronize the SAM from delta files that are held by BDCs.
</para>
<para>
<indexterm><primary>PDC</primary></indexterm>
<indexterm><primary>BDC</primary></indexterm>
-Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
-function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows
+Samba cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
+function correctly as a PDC to an MS Windows NT4 BDC. Both Samba and MS Windows
NT4 can function as a BDC to its own type of PDC.
</para>
In the event that the NT4 PDC should need to be taken out of service, or if it dies, one of the NT4 BDCs can
be promoted to a PDC. If this happens while the original NT4 PDC is online, it is automatically demoted to an
NT4 BDC. This is an important aspect of domain controller management. The tool that is used to effect a
-promotion or a demotion is the Server Manager for Domains. It should be noted that Samba-3 BDCs cannot be
+promotion or a demotion is the Server Manager for Domains. It should be noted that Samba BDCs cannot be
promoted in this manner because reconfiguration of Samba requires changes to the &smb.conf; file. It is easy
enough to manuall change the &smb.conf; file and then restart relevant Samba network services.
</para>
<indexterm><primary>ID mapping</primary></indexterm>
<indexterm><primary>domain member server</primary></indexterm>
<indexterm><primary>idmap backend</primary></indexterm>
-Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it
+Samba has introduced a new ID mapping facility. One of the features of this facility is that it
allows greater flexibility in how user and group IDs are handled in respect to NT domain user and group
SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values
will be consistent on the PDC, all BDCs, and all domain member servers. The parameter that controls this
the Samba source code, and to modify it as needed. This mode of deployment is considered beyond the scope of
this book. However, if someone will contribute more comprehensive documentation we will gladly review it, and
if it is suitable extend this section of this chapter. Until such documentation becomes available the hosting
-of multiple samba servers on a single host is considered not supported for Samba-3 by the Samba Team.
+of multiple samba servers on a single host is considered not supported for Samba by the Samba Team.
</para>
</sect2>
<indexterm><primary>ADS</primary></indexterm>
<indexterm><primary>domain control</primary></indexterm>
<indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
-Samba-3 can join an MS Windows NT4-style domain as a native member server, an
+Samba can join an MS Windows NT4-style domain as a native member server, an
MS Windows Active Directory domain as a native member server, or a Samba domain
control network. Domain membership has many advantages:
</para>
<indexterm><primary>/etc/passwd</primary></indexterm>
A corresponding UNIX account, typically stored in <filename>/etc/passwd</filename>. Work is in progress to
allow a simplified mode of operation that does not require UNIX user accounts, but this has not been a feature
- of the early releases of Samba-3, and is not currently planned for release either.
+ of the early releases of Samba, and is not currently planned for release either.
</para></listitem>
</itemizedlist>
</para>
</para>
<sect2>
-<title>Joining an NT4-type Domain with Samba-3</title>
+<title>Joining an NT4-type Domain with Samba</title>
<para><link linkend="assumptions">Assumptions</link> lists names that are used in the remainder of this chapter.</para>
<indexterm significance="preferred"><primary>ADS</primary><see>Active Directory</see></indexterm>
<indexterm><primary>KDC</primary></indexterm>
<indexterm><primary>Kerberos</primary></indexterm>
-This is a rough guide to setting up Samba-3 with Kerberos authentication against a
+This is a rough guide to setting up Samba with Kerberos authentication against a
Windows 200x KDC. A familiarity with Kerberos is assumed.
</para>
<indexterm><primary>kinit</primary></indexterm>
<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
When making a Windows client a member of an ADS domain within a complex organization, you
-may want to create the machine trust account within a particular organizational unit. Samba-3 permits
+may want to create the machine trust account within a particular organizational unit. Samba permits
this to be done using the following syntax:
<screen>
&rootprompt; <userinput>kinit Administrator@your.kerberos.REALM</userinput>
<para>
A more scalable domain control authentication backend option might use
- Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
- for both options as a domain member server. As a PDC, Samba-3 is not able to provide
+ Microsoft Active Directory or an LDAP-based backend. Samba provides
+ for both options as a domain member server. As a PDC, Samba is not able to provide
an exact alternative to the functionality that is available with Active Directory.
- Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
+ Samba can provide a scalable LDAP-based PDC/BDC solution.
</para>
<para>
The tdbsam authentication backend provides no facility to replicate
the contents of the database, except by external means (i.e., there is no self-contained protocol
- in Samba-3 for Security Account Manager database [SAM] replication).
+ in Samba for Security Account Manager database [SAM] replication).
</para>
<note><para>
<para>
The engineering office network server we present here is designed to demonstrate use
of the new tdbsam password backend. The tdbsam
- facility is new to Samba-3. It is designed to provide many user and machine account controls
+ facility is new to Samba. It is designed to provide many user and machine account controls
that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
</para>
<title>A Big Organization</title>
<para>
- In this section we finally get to review in brief a Samba-3 configuration that
+ In this section we finally get to review in brief a Samba configuration that
uses a Lightweight Directory Access (LDAP)-based authentication backend. The
main reasons for this choice are to provide the ability to host primary
and Backup Domain Control (BDC), as well as to enable a higher degree of
<title>The Primary Domain Controller</title>
<para>
- This is an example of a minimal configuration to run a Samba-3 PDC
+ This is an example of a minimal configuration to run a Samba PDC
using an LDAP authentication backend. It is assumed that the operating system
has been correctly configured.
</para>
</para>
<orderedlist>
- <listitem><para>For Samba-3 domain controllers and domain member servers/clients.</para></listitem>
+ <listitem><para>For Samba domain controllers and domain member servers/clients.</para></listitem>
<listitem><para>To manage domain member Windows workstations.</para></listitem>
</orderedlist>
When first installed, Windows NT4/200x/XP are preconfigured with certain user, group, and
alias entities. Each has a well-known RID. These must be preserved for continued
integrity of operation. Samba must be provisioned with certain essential domain groups that require
- the appropriate RID value. When Samba-3 is configured to use <constant>tdbsam</constant>, the essential
+ the appropriate RID value. When Samba is configured to use <constant>tdbsam</constant>, the essential
domain groups are automatically created. It is the LDAP administrator's responsibility to create
(provision) the default NT groups.
</para>
<indexterm><primary>GID</primary></indexterm>
The Microsoft Windows operating system has a number of features that impose specific challenges
to interoperability with the operating systems on which Samba is implemented. This chapter deals
-explicitly with the mechanisms Samba-3 (version 3.0.8 and later) uses to overcome one of the
+explicitly with the mechanisms Samba (version 3.0.8 and later) uses to overcome one of the
key challenges in the integration of Samba servers into an MS Windows networking environment.
This chapter deals with identity mapping (IDMAP) of Windows security identifiers (SIDs)
to UNIX UIDs and GIDs.
<indexterm><primary>NT4</primary></indexterm>
<indexterm><primary>SID</primary></indexterm>
<indexterm><primary>Active Directory</primary></indexterm>
- Samba-3 can act as a Windows NT4 PDC or BDC, thereby providing domain control protocols that
- are compatible with Windows NT4. Samba-3 file and print sharing protocols are compatible with
+ Samba can act as a Windows NT4 PDC or BDC, thereby providing domain control protocols that
+ are compatible with Windows NT4. Samba file and print sharing protocols are compatible with
all versions of MS Windows products. Windows NT4, as with MS Active Directory,
extensively makes use of Windows SIDs.
</para>
<indexterm><primary>MS Windows SID</primary></indexterm>
<indexterm><primary>UID</primary></indexterm>
<indexterm><primary>GID</primary></indexterm>
- Samba-3 domain member servers and clients must interact correctly with MS Windows SIDs. Incoming
+ Samba domain member servers and clients must interact correctly with MS Windows SIDs. Incoming
Windows SIDs must be translated to local UNIX UIDs and GIDs. Outgoing information from the Samba
server must provide to MS Windows clients and servers appropriate SIDs.
</para>
server that is a member of a Windows NT4 domain or an ADS domain. A typical example
is an appliance like file server on which no local accounts are configured and
winbind is used to obtain account credentials from the domain controllers for the
- domain. The domain control can be provided by Samba-3, MS Windows NT4, or MS Windows
+ domain. The domain control can be provided by Samba, MS Windows NT4, or MS Windows
Active Directory.
</para>
<para>
IDMAP information can be written directly to the LDAP server so long as all domain controllers
- have access to the master (writable) LDAP server. Samba-3 at this time does not handle LDAP redirects
+ have access to the master (writable) LDAP server. Samba at this time does not handle LDAP redirects
in the IDMAP backend. This means that it is is unsafe to use a slave (replicate) LDAP server with
the IDMAP facility.
</para>
<para>
<indexterm><primary>ADAM</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
- The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains and
+ The storage of IDMAP information in LDAP can be used with both NT4/Samba-style domains and
ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any
standards-complying LDAP server can be used. It is therefore possible to deploy this IDMAP
configuration using the Sun iPlanet LDAP server, Novell eDirectory, Microsoft ADS plus ADAM,
<para>
<indexterm><primary>realm</primary></indexterm>
- In the case of an NT4 or Samba-
3-style domain the <parameter>realm</parameter> is not used, and the
+ In the case of an NT4 or Samba-style domain the <parameter>realm</parameter> is not used, and the
command used to join the domain is <command>net rpc join</command>. The above example also demonstrates
advanced error-reporting techniques that are documented in <link linkend="dbglvl">Reporting Bugs</link>.
</para>
<title>TDB Database File Information</title>
<para>
- This section contains brief descriptions of the databases that are used by Samba-3.
+ This section contains brief descriptions of the databases that are used by Samba.
</para>
<para>
<indexterm><primary>tdb file locations</primary></indexterm>
- The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores
+ The directory in which Samba stores the tdb files is determined by compile-time directives. Samba stores
tdb files in two locations. The best way to determine these locations is to execute the following
command:
<screen>
PRIVATE_DIR: /etc/samba/private
</screen>
This means that the confidential tdb files are stored in the <filename>/etc/samba/private</filename>
- directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
+ directory. Samba also uses a number of tdb files that contain more mundane data. The location of
these files can be found by executing:
<screen>
&rootprompt; smbd -b | grep LOCKDIR
<indexterm><primary>trust relationships</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
<indexterm><primary>LDAP-based</primary></indexterm>
-Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
-will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
+Samba supports NT4-style domain trust relationships. This is a feature that many sites
+will want to use if they migrate to Samba from an NT4-style domain and do not want to
adopt Active Directory or an LDAP-based authentication backend. This chapter explains
some background information regarding trust relationships and how to create them. It is now
-possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba
+possible for Samba to trust NT4 (and vice versa), as well as to create Samba-to-Samba
trusts.
</para>
<para>
<indexterm><primary>scalability</primary></indexterm>
<indexterm><primary>trust relationships</primary></indexterm>
-Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
+Samba can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4.
</para>
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>interdomain trusts</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
-Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its
+Given that Samba can function with a scalable backend authentication database such as LDAP, and given its
ability to run in primary as well as backup domain control modes, the administrator would be well-advised to
consider alternatives to the use of interdomain trusts simply because, by the very nature of how trusts
function, this system is fragile. That was, after all, a key reason for the development and adoption of
New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default.
Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with
Windows 2000 and ADS, the red and blue domains can trust each other. This is an inherent feature of ADS
-domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
+domains. Samba implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
security domains in similar manner to MS Windows NT4-style domains.
</para>
<indexterm><primary>Windows NT4 Server</primary></indexterm>
<indexterm><primary>between domains</primary></indexterm>
Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a
-Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly
+Windows NT4 server. However, the remote end could just as well be another Samba domain. It can be clearly
seen, after reading this document, that combining Samba-specific parts of what's written in the following
sections leads to trust between domains in a purely Samba environment.
</para>
</para>
<para>
-It works with Samba-3 and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
+It works with Samba and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
Both domain controllers, Samba and NT must have the same WINS server; otherwise,
the trust will never work.
</para>
<para>
The real people behind Samba are users like you. You have inspired the
developers (the Samba Team) to do more than any of them imagined could or should
- be done. User feedback drives Samba development. Samba-3 in particular incorporates
+ be done. User feedback drives Samba development. Samba in particular incorporates
a huge amount of work done as a result of user requests, suggestions and direct
code contributions.
</para>
<para>
Existing Samba books are largely addressed to the UNIX administrator.
From the perspective of this target group the existing books serve
- an adequate purpose, with one exception &smbmdash; now that Samba-3 is out
+ an adequate purpose, with one exception &smbmdash; now that Samba is out
they need to be updated!
</para>
<variablelist>
<varlistentry><term>General Installation</term>
<listitem><para>
- Designed to help you get Samba-3 running quickly.
+ Designed to help you get Samba running quickly.
The Fast Start chapter is a direct response to requests from
Microsoft network administrators for some sample configurations
that <emphasis>just work</emphasis>.
<varlistentry><term>Advanced Configuration</term>
<listitem><para>
The mechanics of network browsing have long been the Achilles heel of
- all Microsoft Windows users. Samba-3 introduces new user and machine
+ all Microsoft Windows users. Samba introduces new user and machine
account management facilities, a new way to map UNIX groups and Windows
groups, Interdomain trusts, new loadable file system drivers (VFS), and
more. New with this document is expanded printing documentation, as well
</variablelist>
<para>
-Welcome to Samba-3 and the first published document to help you and your users to enjoy a whole
+Welcome to Samba and the first published document to help you and your users to enjoy a whole
new world of interoperability between Microsoft Windows and the rest of the world.
</para>
<pubdate>April 3, 2003</pubdate>
</chapterinfo>
-<title>Migration from NT4 PDC to Samba-3 PDC</title>
+<title>Migration from NT4 PDC to Samba PDC</title>
<para>
<indexterm><primary>migrate</primary></indexterm>
<indexterm><primary>domain control</primary></indexterm>
This is a rough guide to assist those wishing to migrate from NT4 domain control to
-Samba-3-based domain control.
+Samba-based domain control.
</para>
<sect1>
<para>
<indexterm><primary>migration plan</primary></indexterm>
-Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
+Those wishing to migrate from MS Windows NT4 domain control to a Samba domain control
environment would do well to develop a detailed migration plan. So here are a few pointers to
help migration get underway.
</para>
<para>
<indexterm><primary>migration process</primary></indexterm>
The key objective for most organizations is to make the migration from MS Windows NT4
-to Samba-3 domain control as painless as possible. One of the challenges you may experience
+to Samba domain control as painless as possible. One of the challenges you may experience
in your migration process may well be convincing management that the new environment
should remain in place. Many who have introduced open source technologies have experienced
pressure to return to a Microsoft-based platform solution at the first sign of trouble.
<para>
<indexterm><primary>change motivations</primary></indexterm>
-Before attempting a migration to a Samba-3-controlled network, make every possible effort to
+Before attempting a migration to a Samba-controlled network, make every possible effort to
gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change
is important for the organization. Possible motivations to make a change include:
</para>
<indexterm><primary>migration</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
<indexterm><primary>without ADS</primary></indexterm>
-Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers
+Make sure everyone knows that Samba is not MS Windows NT4. Samba-3 offers
an alternative solution that is both different from MS Windows NT4 and offers
-advantages compared with it. Gain recognition that Samba-3 lacks many of the
+advantages compared with it. Gain recognition that Samba lacks many of the
features that Microsoft has promoted as core values in migration from MS Windows NT4 to
MS Windows 2000 and beyond (with or without Active Directory services).
</para>
<para>
-What are the features that Samba-3 cannot provide?
+What are the features that Samba cannot provide?
</para>
<indexterm><primary>Active Directory Server</primary></indexterm>
</itemizedlist>
<para>
-The features that Samba-3 does provide and that may be of compelling interest to your site
+The features that Samba does provide and that may be of compelling interest to your site
include:
</para>
<para>
<indexterm><primary>successful migration</primary></indexterm>
-Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
+Before migrating a network from MS Windows NT4 to Samba, consider all necessary factors. Users
should be educated about changes they may experience so the change will be a welcome one
and not become an obstacle to the work they need to do. The following sections explain factors that will
help ensure a successful migration.
<indexterm><primary>master server</primary></indexterm>
<indexterm><primary>slave servers</primary></indexterm>
<indexterm><primary>multiple domains</primary></indexterm>
-Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
+Samba can be configured as a domain controller, a backup domain controller (probably best called
a secondary controller), a domain member, or a standalone server. The Windows network security
domain context should be sized and scoped before implementation. Particular attention needs to be
paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs).
-One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP
+One way in which Samba differs from Microsoft technology is that if one chooses to use an LDAP
authentication backend, then the same database can be used by several different domains. In a
complex organization, there can be a single LDAP database, which itself can be distributed (have
a master server and multiple slave servers) that can simultaneously serve multiple domains.
<para>
<indexterm><primary>SID</primary></indexterm>
<indexterm><primary>NTuser.DAT</primary></indexterm>
-Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS
+Profiles may also be managed using the Samba tool <command>profiles</command>. This tool allows the MS
Windows NT-style security identifiers (SIDs) that are stored inside the profile
-<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain.
+<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba domain.
</para>
</sect3>
<indexterm><primary>migrate user</primary></indexterm>
<indexterm><primary>migrate group</primary></indexterm>
<indexterm><primary>map</primary></indexterm>
-It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
-attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
+It is possible to migrate all account settings from an MS Windows NT4 domain to Samba. Before
+attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba the
groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to
suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
should migrate painlessly.
<indexterm><primary>domain controller</primary></indexterm>
<indexterm><primary>netlogon share</primary></indexterm>
<indexterm><primary>BDC</primary></indexterm>
- Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
+ Samba is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
to function as a BDC: <parameter>domain master = No</parameter>.
</para></listitem>
</itemizedlist>
<para>
There are three basic choices for sites that intend to migrate from MS Windows NT4
-to Samba-3:
+to Samba:
</para>
<itemizedlist>
<entry><para>Improve on NT4 functionality, enhance management capabilities</para></entry>
</row>
<row>
- <entry><para>Move all accounts from NT4 into Samba-3</para></entry>
+ <entry><para>Move all accounts from NT4 into Samba</para></entry>
<entry><para>Copy and improve</para></entry>
<entry><para>Authentication regime (database location and access)</para></entry>
</row>
<entry><para>Identify Needs for: <emphasis>Manageability, Scalability, Security, Availability</emphasis></para></entry>
</row>
<row>
- <entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry>
+ <entry><para>Integrate Samba, then migrate while users are active, then change of control (swap out)</para></entry>
<entry><para>Take advantage of lower maintenance opportunity</para></entry>
<entry><para></para></entry>
</row>
</sect2>
<sect2>
-<title>Samba-3 Implementation Choices</title>
+<title>Samba Implementation Choices</title>
<variablelist>
<varlistentry><term>Authentication Database/Backend</term><listitem>
<para>
- Samba-3 can use an external authentication backend:
+ Samba can use an external authentication backend:
</para>
<para>
<listitem><para>Winbind (external Samba or NT4/200x server).</para></listitem>
<listitem><para>External server could use Active Directory or NT4 domain.</para></listitem>
<listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem>
- <listitem><para> Samba
-3 can use a local authentication backend: <parameter>smbpasswd</parameter>,
+ <listitem><para> Samba can use a local authentication backend: <parameter>smbpasswd</parameter>,
<parameter>tdbsam</parameter>, <parameter>ldapsam</parameter>
</para></listitem>
</itemizedlist></para></listitem>
<indexterm><primary>DNS</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
MS Windows 2000 and later versions can be configured to operate with no NetBIOS
-over TCP/IP. Samba-3 and later versions also support this mode of operation.
+over TCP/IP. Samba and later versions also support this mode of operation.
When the use of NetBIOS over TCP/IP has been disabled, the primary
means for resolution of MS Windows machine names is via DNS and Active Directory.
The following information assumes that your site is running NetBIOS over TCP/IP.
<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
<indexterm><primary>DNS/LDAP/ADS</primary></indexterm>
<indexterm><primary>name resolution</primary></indexterm>
-MS Windows 2000 and later versions, as with Samba-3 and later versions, can be
+MS Windows 2000 and later versions, as with Samba and later versions, can be
configured to not use NetBIOS over TCP/IP. When configured this way,
it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
configured and operative. Browsing will not work if name resolution
<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
<indexterm><primary>DNS</primary></indexterm>
-It is possible to operate Samba-3 without NetBIOS over TCP/IP. If you do this, be warned that if used outside
+It is possible to operate Samba without NetBIOS over TCP/IP. If you do this, be warned that if used outside
of MS ADS, this will forgo network browsing support. ADS permits network browsing support through DNS,
providing appropriate DNS records are inserted for all Samba servers.
</para>
<para>
<indexterm><primary>group</primary><secondary>mapping</secondary></indexterm>
-Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
+Samba implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
to explain in a short space). This is discussed more fully in <link linkend="groupmapping">Group Mapping: MS
Windows and UNIX</link>.
</para>
<indexterm><primary>identity information</primary></indexterm>
Primary domain control, if it is to be scalable to meet the needs of large sites, must therefore be capable of
using LDAP. The rapid adoption of OpenLDAP, and Samba configurations that use it, is ample proof that the era
-of the directory has started. Samba-3 does not demand the use of LDAP, but the demand for a mechanism by which
+of the directory has started. Samba does not demand the use of LDAP, but the demand for a mechanism by which
user and group identity information can be distributed makes it an an unavoidable option.
</para>
<indexterm><primary>promote</primary></indexterm>
<indexterm><primary>demote</primary></indexterm>
A Windows NT4 BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to PDC,
-the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic operation; the PDC
+the previous PDC is automatically demoted to a BDC. With Samba, this is not an automatic operation; the PDC
and BDC must be manually configured, and other appropriate changes also need to be made.
</para>
<para>
<indexterm><primary>domain</primary><secondary>control</secondary><tertiary>role</tertiary></indexterm>
<indexterm><primary>native member</primary></indexterm>
-Samba-3 servers can readily be converted to and from domain controller roles through simple changes to the
-&smb.conf; file. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active
+Samba servers can readily be converted to and from domain controller roles through simple changes to the
+&smb.conf; file. Samba is capable of acting fully as a native member of a Windows 200x server Active
Directory domain.
</para>
<para>
<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
<indexterm><primary>SAM</primary><secondary>replication</secondary></indexterm>
-New to Samba-3 is the ability to function fully as an MS Windows NT4-style domain controller,
-excluding the SAM replication components. However, please be aware that Samba-3 also supports the
+New to Samba is the ability to function fully as an MS Windows NT4-style domain controller,
+excluding the SAM replication components. However, please be aware that Samba also supports the
MS Windows 200x domain control protocols.
</para>
</para></note>
<para>
-The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows
+The following are necessary for configuring Samba as an MS Windows NT4-style PDC for MS Windows
NT4/200x/XP clients:
</para>
<indexterm><primary>browse list</primary></indexterm>
It is rather easy to configure Samba to provide these. Each Samba domain controller must provide the NETLOGON
service that Samba calls the <smbconfoption name="domain logons"/> functionality (after the name of the
-parameter in the &smb.conf; file). Additionally, one server in a Samba-3 domain must advertise itself as the
+parameter in the &smb.conf; file). Additionally, one server in a Samba domain must advertise itself as the
domain master browser.<footnote><para>See <link linkend="NetworkBrowsing">Network
Browsing</link>.</para></footnote> This causes the PDC to claim a domain-specific NetBIOS name that identifies
it as a DMB for its given domain or workgroup. Local master browsers (LMBs) in the same domain or workgroup on
<indexterm><primary></primary></indexterm>
This share is used to store user desktop profiles. Each user must have a directory at the root
of this share. This directory must be write-enabled for the user and must be globally read-enabled.
- Samba-3 has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will
+ Samba has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will
allow a Samba administrator to make the directory read-only to everyone. Of course this is useful
only after the profile has been properly created.
</para></listitem>
the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure
that the account name is the machine NetBIOS name with a <quote>$</quote> appended to it (i.e.,
computer_name$). There must be an entry in both the POSIX UNIX system account backend as well as in the
-SambaSAMAccount backend. The default backend for Samba
-3 (i.e., the parameter <parameter>passdb
+SambaSAMAccount backend. The default backend for Samba (i.e., the parameter <parameter>passdb
backend</parameter> is not specified in the &smb.conf; file, or if specified is set to
<literal>smbpasswd</literal>, are respectively the <filename>/etc/passwd</filename> and
<filename>/etc/samba/smbpasswd</filename> (or <filename>/usr/local/samba/lib/private/smbpasswd</filename> if
After successfully joining the domain, user logons fail with one of two messages: one to the
effect that the domain controller cannot be found; the other claims that the account does not
exist in the domain or that the password is incorrect. This may be due to incompatible
-settings between the Windows client and the Samba-3 server for <emphasis>schannel</emphasis>
+settings between the Windows client and the Samba server for <emphasis>schannel</emphasis>
(secure channel) settings or <emphasis>smb signing</emphasis> settings. Check your Samba
settings for <emphasis>client schannel</emphasis>, <emphasis>server schannel</emphasis>,
<emphasis>client signing</emphasis>, <emphasis>server signing</emphasis> by executing:
</para>
<para>
-It is important that these be set consistently with the Samba-3 server settings.
+It is important that these be set consistently with the Samba server settings.
</para>
</sect2>
<title>New Account Storage Systems</title>
<para>
-Samba-3 introduces a number of new password backend capabilities.
+Samba introduces a number of new password backend capabilities.
<indexterm><primary>SAM backend</primary><secondary>tdbsam</secondary></indexterm>
<indexterm><primary>SAM backend</primary><secondary>ldapsam</secondary></indexterm>
</para>
The <emphasis>tdbsam</emphasis> password backend stores the old <emphasis>
smbpasswd</emphasis> information plus the extended MS Windows NT/200x
SAM information into a binary format TDB (trivial database) file.
- The inclusion of the extended information makes it possible for Samba-3
+ The inclusion of the extended information makes it possible for Samba
to implement the same account and system access controls that are possible
with MS Windows NT4/200x-based systems.
</para>
<indexterm><primary>Samba schema</primary></indexterm>
<indexterm><primary>schema file</primary></indexterm>
<indexterm><primary>examples/LDAP</primary></indexterm>
- Samba-3 has a new and extended LDAP implementation that requires configuration
+ Samba has a new and extended LDAP implementation that requires configuration
of OpenLDAP with a new format Samba schema. The new format schema file is
included in the <filename class="directory">examples/LDAP</filename> directory of the Samba distribution.
</para>
<indexterm><primary>domain member servers</primary></indexterm>
<indexterm><primary>NFS</primary></indexterm>
<indexterm><primary>rsync</primary></indexterm>
- Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs
+ Samba has a special facility that makes it possible to maintain identical UIDs and GIDs
on all servers in a distributed network. A distributed network is one where there exists
a PDC, one or more BDCs, and/or one or more domain member servers. Why is this important?
This is important if files are being shared over more than one protocol (e.g., NFS) and where
The need to be familiar with the Samba tools and facilities that permit information systems operation
in compliance with government laws and regulations is clear to all. The <command>pdbedit</command> is
currently the only Samba tool that provides the capacity to manage account and systems access controls
- and policies. During the remaining life-cycle of the Samba-3 series it is possible the new tools may
+ and policies. During the remaining life-cycle of the Samba series it is possible the new tools may
be implemented to aid in this important area.
</para>
<warning><para>
Account policies must be set individually on each PDC and BDC. At this time (Samba 3.0.11 to Samba 3.0.14a)
account policies are not replicated automatically. This may be fixed before Samba 3.0.20 ships or some
-time there after. Please check the WHATSNEW.txt file in the Samba-3 tarball for specific update notiations
+time there after. Please check the WHATSNEW.txt file in the Samba tarball for specific update notiations
regarding this facility.
</para></warning>
objectclass: organization
dc: quenya
o: Quenya Org Network
-description: The Samba-3 Network LDAP Example
+description: The Samba Network LDAP Example
# Organizational Role for Directory Management
dn: cn=Manager,dc=quenya,dc=org
<note><para>
<indexterm><primary>secrets.tdb</primary></indexterm>
Before Samba can access the LDAP server, you need to store the LDAP admin password
- in the Samba-3 <filename>secrets.tdb</filename> database by:
+ in the Samba <filename>secrets.tdb</filename> database by:
<indexterm><primary>smbpasswd</primary></indexterm>
<screen>
&rootprompt;<userinput>smbpasswd -w <replaceable>secret</replaceable></userinput>
<indexterm><primary>posixGroup</primary></indexterm>
<indexterm><primary>Domain Groups</primary></indexterm>
<indexterm><primary>ADS</primary></indexterm>
- In Samba-3, the group management system is based on POSIX
+ In Samba, the group management system is based on POSIX
groups. This means that Samba makes use of the posixGroup ObjectClass.
For now, there is no NT-like group system management (global and local
- groups). Samba-3 knows only about <constant>Domain Groups</constant>
- and, unlike MS Windows 2000 and Active Directory, Samba-3 does not
+ groups). Samba knows only about <constant>Domain Groups</constant>
+ and, unlike MS Windows 2000 and Active Directory, Samba does not
support nested groups.
</para>
<title>Password Synchronization</title>
<para>
- Samba-3 and later can update the non-Samba (LDAP) password stored with an account. When
+ Samba and later can update the non-Samba (LDAP) password stored with an account. When
using pam_ldap, this allows changing both UNIX and Windows passwords at once.
</para>
<indexterm><primary>SOFTQ printing system</primary></indexterm>
The <smbconfoption name="printing"/> parameter is normally a service-level parameter. Since it is included
here in the <smbconfsection name="[global]"/> section, it will take effect for all printer shares that are not
- defined differently. Samba-3 no longer supports the SOFTQ printing system.
+ defined differently. Samba no longer supports the SOFTQ printing system.
</para></caution>
</listitem></varlistentry>
<para>
<indexterm><primary>ADS</primary></indexterm>
<indexterm><primary>LDAP</primary></indexterm>
-A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP).
+A benefit of updating is that Samba is able to publish its printers to Active Directory (or LDAP).
</para>
<para>
<indexterm><primary>read-write access</primary></indexterm>
<indexterm><primary>ACLs</primary></indexterm>
These parameters, including the <parameter>printer driver file</parameter> parameter,
- are now removed and cannot be used in installations of Samba-3. The share name
+ are now removed and cannot be used in installations of Samba. The share name
<smbconfsection name="[print$]"/> is now used for the location of downloadable printer
drivers. It is taken from the <smbconfsection name="[print$]"/> service created
by Windows NT PCs when a printer is shared by them. Windows NT print servers always have a
<listitem><para>
An existing <filename>printers.def</filename> file (the one specified in the now removed parameter
- <parameter>printer driver file</parameter>) will no longer work with Samba-3. In 3.0, smbd attempts
+ <parameter>printer driver file</parameter>) will no longer work with Samba. In 3.0, smbd attempts
to locate Windows 9x/Me driver files for the printer in <smbconfsection name="[print$]"/>
and additional settings in the TDB and only there; if it fails, it will <emphasis>not</emphasis>
(as 2.2.x used to do) drop down to using a <filename>printers.def</filename> (and all associated
</para>
<para>
-With Samba-3, you can have a global profile setting in &smb.conf;, and you can override this by
+With Samba, you can have a global profile setting in &smb.conf;, and you can override this by
per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </para>
<para> In any case, you can configure only one profile per user. That profile can be either: </para>
<indexterm><primary>rights</primary></indexterm>
<indexterm><primary>privileges</primary></indexterm>
<indexterm><primary>manage privileges</primary></indexterm>
-Currently, the rights supported in Samba-3 are listed in <link linkend="rp-privs"/>.
+Currently, the rights supported in Samba are listed in <link linkend="rp-privs"/>.
The remainder of this chapter explains how to manage and use these privileges on Samba servers.
</para>
<itemizedlist>
<listitem><para>
<indexterm><primary>domain</primary><secondary>controller</secondary></indexterm>
- Samba-3 can replace an MS Windows NT4 domain controller.
+ Samba can replace an MS Windows NT4 domain controller.
</para></listitem>
<listitem><para>
<indexterm><primary>active directory</primary></indexterm>
- Samba-3 offers excellent interoperability with MS Windows NT4-style
+ Samba offers excellent interoperability with MS Windows NT4-style
domains as well as natively with Microsoft Active Directory domains.
</para></listitem>
<listitem><para>
<indexterm><primary>interdomain</primary><secondary>trustrs</secondary></indexterm>
- Samba-3 permits full NT4-style interdomain trusts.
+ Samba permits full NT4-style interdomain trusts.
</para></listitem>
<listitem><para>
<listitem><para>
<indexterm><primary>account</primary><secondary>database</secondary><tertiary>backends</tertiary></indexterm>
<indexterm><primary>encrypted</primary></indexterm>
- Samba-3 permits use of multiple concurrent account database backends.
+ Samba permits use of multiple concurrent account database backends.
(Encrypted passwords that are stored in the account database are in
formats that are unique to Windows networking).
</para></listitem>
<listitem><para>
<indexterm><primary>replicated</primary></indexterm>
The account database backends can be distributed
- and replicated using multiple methods. This gives Samba-3
+ and replicated using multiple methods. This gives Samba
greater flexibility than MS Windows NT4 and in many cases a
significantly higher utility than Active Directory domains
with MS Windows 200x.
</para>
<para>
-If you are using Active Directory, starting with Samba-3 you can join as a native AD member. Why would you
+If you are using Active Directory, starting with Samba you can join as a native AD member. Why would you
want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All
your machines are running Windows 2000 and above and all use Kerberos. In this case, Samba, as an NT4-style
domain, would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos
<indexterm><primary>remote management</primary></indexterm>
<indexterm><primary>command-line</primary></indexterm>
<indexterm><primary>scripted control</primary></indexterm>
-The <command>net</command> command is one of the new features of Samba-3 and is an attempt to provide a useful
+The <command>net</command> command is one of the new features of Samba and is an attempt to provide a useful
tool for the majority of remote management operations necessary for common tasks. The <command>net</command>
tool is flexible by design and is intended for command-line use as well as for scripted control application.
</para>
</para>
<para>
-A Samba-3 administrator cannot afford to gloss over this chapter because to do so will almost certainly cause
+A Samba administrator cannot afford to gloss over this chapter because to do so will almost certainly cause
the infliction of self-induced pain, agony, and desperation. Be warned: this is an important chapter.
</para>
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>DMS</primary></indexterm>
<indexterm><primary>authentication</primary></indexterm>
- The tasks that follow the installation of a Samba-3 server, whether standalone or domain member, of a
+ The tasks that follow the installation of a Samba server, whether standalone or domain member, of a
domain controller (PDC or BDC) begins with the need to create administrative rights. Of course, the
creation of user and group accounts is essential for both a standalone server and a PDC.
In the case of a BDC or a Domain Member server (DMS), domain user and group accounts are obtained from
<indexterm><primary>domain authentication</primary></indexterm>
<indexterm><primary>trust accounts</primary></indexterm>
<indexterm><primary>net</primary></indexterm>
- UNIX systems that are hosting a Samba-3 server that is running as a member (PDC, BDC, or DMS) must have
+ UNIX systems that are hosting a Samba server that is running as a member (PDC, BDC, or DMS) must have
a machine security account in the domain authentication database (or directory). The creation of such
security (or trust) accounts is also handled using the <command>net</command> command.
</para>
<indexterm><primary>net</primary></indexterm>
<indexterm><primary>man pages</primary></indexterm>
The overall picture should be clear now: the <command>net</command> command plays a central role
- on the Samba-3 stage. This role will continue to be developed. The inclusion of this chapter is
+ on the Samba stage. This role will continue to be developed. The inclusion of this chapter is
evidence of its importance, one that has grown in complexity to the point that it is no longer considered
prudent to cover its use fully in the online UNIX man pages.
</para>
<indexterm><primary>domain</primary><secondary>groups</secondary></indexterm>
<indexterm><primary>local</primary><secondary>groups</secondary></indexterm>
<indexterm><primary>domain user accounts</primary></indexterm>
- Samba-3 recognizes two types of groups: <emphasis>domain groups</emphasis> and <emphasis>local
+ Samba recognizes two types of groups: <emphasis>domain groups</emphasis> and <emphasis>local
groups</emphasis>. Domain groups can contain (have as members) only domain user accounts. Local groups
can contain local users, domain users, and domain groups as members.
</para>
</para>
<para>
- A Samba-3 server that is a Windows ADS domain member can execute the following command to detach from the
+ A Samba server that is a Windows ADS domain member can execute the following command to detach from the
domain:
<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>leave</tertiary></indexterm>
<screen>
<title>Printers and ADS</title>
<para>
- When Samba-3 is used within an MS Windows ADS environment, printers shared via Samba will not be browseable
+ When Samba is used within an MS Windows ADS environment, printers shared via Samba will not be browseable
until they have been published to the ADS domain. Information regarding published printers may be obtained
from the ADS server by executing the <command>net ads print info</command> command following this syntax:
<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>printer info</tertiary></indexterm>
<para>
<indexterm><primary>codepages</primary></indexterm>
Samba-2.x supported a single locale through a mechanism called
-<emphasis>codepages</emphasis>. Samba-3 is destined to become a truly transglobal
+<emphasis>codepages</emphasis>. Samba is destined to become a truly transglobal
file- and printer-sharing platform.
</para>
</para>
<para>
- To use CAP encoding on Samba-3, you should use the unix charset parameter and VFS
+ To use CAP encoding on Samba, you should use the unix charset parameter and VFS
as in <link linkend="vfscap-intl">the VFS CAP smb.conf file</link>.
</para>
<title>default_quota</title>
<para>
- This module allows the default quota values, in the windows explorer GUI, to be stored on a Samba-3 server.
+ This module allows the default quota values, in the windows explorer GUI, to be stored on a Samba server.
The challenge is that linux filesystems only store quotas for users and groups, but no default quotas.
</para>
<indexterm><primary>Debian Sarge</primary></indexterm>
At the time of this writing, not much testing has been done. I tested the shadow copy VFS module with a
specific scenario which was not deployed in a production environment, but more as a proof of concept. The
- scenario involved a Samba-3 file server on Debian Sarge with an XFS file system and LVM1. I do NOT recommend
+ scenario involved a Samba file server on Debian Sarge with an XFS file system and LVM1. I do NOT recommend
you use this as a solution without doing your own due diligence with regard to all the components presented
here. That said, following is an basic outline of how I got things going.
</para>
<para>
<indexterm><primary>winbindd</primary></indexterm>
<indexterm><primary>daemon</primary></indexterm>
-The latest version of Samba
-3 includes a functioning winbindd daemon. Please refer to the <ulink
+The latest version of Samba includes a functioning winbindd daemon. Please refer to the <ulink
url="http://samba.org/">main Samba Web page</ulink>, or better yet, your closest Samba mirror site for
instructions on downloading the source code.
</para>
<indexterm><primary>Winbind</primary></indexterm>
<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install
-the <filename>pam-devel</filename> libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3
+the <filename>pam-devel</filename> libraries that are needed to build PAM-enabled Samba. Additionally, Samba
may auto-install the Winbind files into their correct locations on your system, so before you get too far down
the track, be sure to check if the following configuration is really
necessary. You may only need to configure
<indexterm><primary>Network ID</primary></indexterm>
<indexterm><primary>configuration wizard</primary></indexterm>
Clicking the <guimenu>Network ID</guimenu> button will launch the configuration wizard. Do not use this with
- Samba-3. If you wish to change the computer name or join or leave the domain, click the <guimenu>Change</guimenu> button.
+ Samba. If you wish to change the computer name or join or leave the domain, click the <guimenu>Change</guimenu> button.
See <link linkend="wxpp004"></link>.
<figure id="wxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure>
</para></step>
<para>
<indexterm><primary>root</primary></indexterm>
- Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="wxpp008"></link>.
+ Enter the name <quote>root</quote> and the root password from your Samba server. See <link linkend="wxpp008"></link>.
<figure id="wxpp008">
<title>Computer Name Changes &smbmdash; Username and Password Panel.</title><imagefile>wxpp008</imagefile>
</figure>
<para>
This book provides example configurations, it documents key aspects of Microsoft
Windows networking, provides in-depth insight into the important configuration of
-Samba-3, and helps to put all of these into a useful framework.
+Samba, and helps to put all of these into a useful framework.
</para>
<para>
</para>
<para>
- There is a bug in Samba-3 that breaks operation of browsing and access to shares if the netbios name
- is set to the literal name <literal>PIPE</literal>. To avoid this problem, do not name your Samba-3
+ There is a bug in Samba that breaks operation of browsing and access to shares if the netbios name
+ is set to the literal name <literal>PIPE</literal>. To avoid this problem, do not name your Samba
server <literal>PIPE</literal>.
</para>
</description>
git.samba.org / samba.git / commitdiff