MANPAGES_NAMES=findsmb.1 smbclient.1 \
smbspool.8 lmhosts.5 \
- smbcontrol.1 smbstatus.1 \
- make_smbcodepage.1 smbd.8 \
- smbtar.1 nmbd.8 smbmnt.8 \
- smbumount.8 nmblookup.1 \
- smbmount.8 swat.8 rpcclient.1 \
+ smbcontrol.1 smbstatus.1 \
+ smbd.8 net.8 smbtar.1 nmbd.8 \
+ smbmnt.8 smbumount.8 nmblookup.1 \
+ smbmount.8 swat.8 rpcclient.1 \
smbpasswd.5 testparm.1 samba.7 \
smbpasswd.8 testprns.1 \
smb.conf.5 wbinfo.1 pdbedit.8 \
smbcacls.1 smbsh.1 winbindd.8 \
- make_unicodemap.1 net.8 \
smbgroupedit.8 vfstest.1
## This part contains only rules. You shouldn't need to change it
<!ENTITY printing SYSTEM "printing.sgml">
<!ENTITY wins SYSTEM "wins.sgml">
<!ENTITY sam SYSTEM "sam.sgml">
+<!ENTITY encryption SYSTEM "encryption.sgml">
]>
<book id="Samba-Developers-Guide">
&printing;
&wins;
&sam;
+&encryption;
</book>
<sect1>
<title>Locking</title>
+<para>
+Since samba 2.2, samba supports other types of locking as well. This
+section is outdated.
+</para>
+
<para>
The locking calls available under a DOS/Windows environment are much
richer than those available in unix. This means a unix server (like
</para>
</sect1>
+<sect1>
+<title>I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</title>
+<para>Your loopback device isn't working correctly. Make sure it's running.
+</para>
+</sect1>
+
</chapter>
-2Q
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
<refentry id="nmbd">
<refsect1>
<title>VERSION</title>
- <para>This man page is correct for version 2.2 of
+ <para>This man page is correct for version 3.0 of
the Samba suite.</para>
</refsect1>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [
+<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities;
+]>
<refentry id="pdbedit">
<refmeta>
<arg choice="opt">-u username</arg>
<arg choice="opt">-f fullname</arg>
<arg choice="opt">-h homedir</arg>
- <arg choice="opt">-d drive</arg>
- <arg choice="opt">-s script</arg>
+ <arg choice="opt">-D drive</arg>
+ <arg choice="opt">-S script</arg>
<arg choice="opt">-p profile</arg>
<arg choice="opt">-a</arg>
<arg choice="opt">-m</arg>
<arg choice="opt">-i passdb-backend</arg>
<arg choice="opt">-e passdb-backend</arg>
<arg choice="opt">-b passdb-backend</arg>
- <arg choice="opt">-D debuglevel</arg>
+ <arg choice="opt">-d debuglevel</arg>
+ <arg choice="opt">-s configfile</arg>
<arg choice="opt">-P account-policy</arg>
<arg choice="opt">-V value</arg>
</cmdsynopsis>
</varlistentry>
-
<varlistentry>
- <term>-d drive</term>
+ <term>-D drive</term>
<listitem><para>This option can be used while adding or
modifing a user account. It will specify the windows drive
letter to be used to map the home directory.</para>
<varlistentry>
- <term>-s script</term>
+ <term>-S script</term>
<listitem><para>This option can be used while adding or
modifing a user account. It will specify the user's logon
script path.</para>
</programlisting></para>
</listitem>
</varlistentry>
+
+ &stdarg.debuglevel;
+ &stdarg.help;
+ &stdarg.configfile;
</variablelist>
</refsect1>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [
+<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities;
+]>
<refentry id="rpcclient">
<refmeta>
- <varlistentry>
- <term>-d|--debug=debuglevel</term>
- <listitem><para>set the debuglevel. Debug level 0 is the lowest
- and 100 being the highest. This should be set to 100 if you are
- planning on submitting a bug report to the Samba team (see <filename>BUGS.txt</filename>).
- </para></listitem>
- </varlistentry>
-
-
-
-
- <varlistentry>
- <term>-h|--help</term>
- <listitem><para>Print a summary of command line options.
- </para></listitem>
- </varlistentry>
-
+ &stdarg.debuglevel;
+ &stdarg.help;
<varlistentry>
<term>-I IP-address</term>
<term><anchor id="ANNOUNCEVERSION">announce version (G)</term>
<listitem><para>This specifies the major and minor version numbers
that nmbd will use when announcing itself as a server. The default
- is 4.2. Do not change this parameter unless you have a specific
+ is 4.9. Do not change this parameter unless you have a specific
need to set a Samba server to be a downlevel server.</para>
- <para>Default: <command>announce version = 4.5</command></para>
+ <para>Default: <command>announce version = 4.9</command></para>
<para>Example: <command>announce version = 2.0</command></para>
</listitem>
<term><anchor id="DOMAINLOGONS">domain logons (G)</term>
<listitem><para>If set to <constant>yes</constant>, the Samba server will serve
Windows 95/98 Domain logons for the <link linkend="WORKGROUP">
- <parameter>workgroup</parameter></link> it is in. Samba 2.2 also
+ <parameter>workgroup</parameter></link> it is in. Samba 2.2
has limited capability to act as a domain controller for Windows
NT 4 Domains. For more details on setting up this feature see
the Samba-PDC-HOWTO included in the <filename>htmldocs/</filename>
system print command such as <command>lpr(1)</command> or <command>
lp(1)</command>.</para>
- <para>This paramater does not accept % macros, because
+ <para>This parameter does not accept % macros, because
many parts of the system require this value to be
constant for correct operation.</para>
<parameter>ldap server</parameter>. Only
available when the backwards-compatiblity <command>
--with-ldapsam</command> option is specified
- to configure. See <link linkend="PASSDBBACKEND"><paramater>passdb backend</parameter></link></para></listitem>
+ to configure. See <link linkend="PASSDBBACKEND"><parameter>passdb backend</parameter></link></para></listitem>
</itemizedlist>
<para>Default : <command>ldap ssl = start_tls</command></para>
<listitem><para>The value of the parameter (a astring) allows
the debug level (logging level) to be specified in the
<filename>smb.conf</filename> file. This parameter has been
- extended since 2.2.x series, now it allow to specify the debug
+ extended since the 2.2.x series, now it allow to specify the debug
level for multiple debug classes. This is to give greater
flexibility in the configuration of the system.</para>
<term><anchor id="PASSDBBACKEND">passdb backend (G)</term>
<listitem><para>This option allows the administrator to chose which backends to retrieve and store passwords with. This allows (for example) both
smbpasswd and tdbsam to be used without a recompile.
- Multiple backends can be specified, seperated by spaces. The backends will be searched in the order they are specified. New users are always added to the first backend specified.
+ Multiple backends can be specified, separated by spaces. The backends will be searched in the order they are specified. New users are always added to the first backend specified.
Experimental backends must still be selected
(eg --with-tdbsam) at configure time.
</para>
<para>LDAP connections should be secured where
possible. This may be done using either
Start-TLS (see <link linkend="LDAPSSL">
- <parameter>ldap ssl</parameter>) or by
- specifying <paramater>ldaps://</paramater> in
+ <parameter>ldap ssl</parameter></link>) or by
+ specifying <parameter>ldaps://</parameter> in
the URL argument.
</para></listitem>
<varlistentry>
<term><anchor id="UNICODE">unicode (G)</term>
<listitem><para>Specifies whether Samba should try
- to use unicode on the wire by default.
+ to use unicode on the wire by default. Note: This does NOT
+ mean that samba will assume that the unix machine uses unicode!
</para>
<para>Default: <command>unicode = yes</command></para>
</para>
<para>Default: <command>unix charset = ASCII</command></para>
+ <para>Example: <command>unix charset = UTF8</command></para>
</listitem>
</varlistentry>
<varlistentry>
<term><anchor id="VFSOBJECT">vfs object (S)</term>
- <listitem><para>This parameter specifies a shared object file that
- is used for Samba VFS I/O operations. By default, normal
+ <listitem><para>This parameter specifies a shared object files that
+ are used for Samba VFS I/O operations. By default, normal
disk I/O operations are used but these can be overloaded
- with a VFS object. The Samba VFS layer is new to Samba 2.2 and
- must be enabled at compile time with --with-vfs.</para>
+ with one or more VFS objects. </para>
<para>Default : <emphasis>no value</emphasis></para>
</listitem>
<varlistentry>
<term><anchor id="VFSOPTIONS">vfs options (S)</term>
<listitem><para>This parameter allows parameters to be passed
- to the vfs layer at initialization time. The Samba VFS layer
- is new to Samba 2.2 and must be enabled at compile time
- with --with-vfs. See also <link linkend="VFSOBJECT"><parameter>
+ to the vfs layer at initialization time.
+ See also <link linkend="VFSOBJECT"><parameter>
vfs object</parameter></link>.</para>
<para>Default : <emphasis>no value</emphasis></para>
<arg choice="opt">-l logfile</arg>
<arg choice="opt">-L <netbios name></arg>
<arg choice="opt">-I destinationIP</arg>
- <arg choice="opt">-E <terminal code></arg>
+ <arg choice="opt">-E</arg>
<arg choice="opt">-c <command string></arg>
<arg choice="opt">-i scope</arg>
<arg choice="opt">-O <socket options></arg>
<cmdsynopsis>
<command>smbd</command>
<arg choice="opt">-D</arg>
- <arg choice="opt">-a</arg>
<arg choice="opt">-i</arg>
- <arg choice="opt">-o</arg>
- <arg choice="opt">-P</arg>
<arg choice="opt">-h</arg>
<arg choice="opt">-V</arg>
-
<arg choice="opt">-b</arg>
+ <arg choice="opt">-b</arg>
<arg choice="opt">-d <debug level></arg>
<arg choice="opt">-l <log directory></arg>
<arg choice="opt">-p <port number></arg>
</para></listitem>
</varlistentry>
- <varlistentry>
- <term>-a</term>
- <listitem><para>If this parameter is specified, each new
- connection will append log messages to the log file.
- This is the default.</para></listitem>
- </varlistentry>
-
<varlistentry>
<term>-i</term>
<listitem><para>If this parameter is specified it causes the
</para></listitem>
</varlistentry>
- <varlistentry>
- <term>-o</term>
- <listitem><para>If this parameter is specified, the
- log files will be overwritten when opened. By default,
- <command>smbd</command> will append entries to the log
- files.</para></listitem>
- </varlistentry>
-
- <varlistentry>
- <term>-P</term>
- <listitem><para>Passive option. Causes <command>smbd</command> not to
- send any network traffic out. Used for debugging by
- the developers only.</para></listitem>
- </varlistentry>
-
<varlistentry>
<term>-h</term>
<listitem><para>Prints the help information (usage)
</varlistentry>
<varlistentry>
- <term>-v</term>
+ <term>-V</term>
<listitem><para>Prints the version number for
<command>smbd</command>.</para></listitem>
</varlistentry>
</para>
<itemizedlist>
- <listitem><para><emphasis>Account Validation</emphasis>: All acccesses to a
+ <listitem><para><emphasis>Account Validation</emphasis>: All accesses to a
samba server are checked
against PAM to see if the account is vaild, not disabled and is permitted to
login at this time. This also applies to encrypted logins.
<refsect1>
<title>VERSION</title>
- <para>This man page is correct for version 2.2 of
+ <para>This man page is correct for version 3.0 of
the Samba suite.</para>
</refsect1>
<arg choice="opt">-h</arg>
<arg choice="opt">-s</arg>
<arg choice="opt">-w pass</arg>
+ <arg choice="opt">-i</arg>
+ <arg choice="opt">-L</arg>
<arg choice="opt">username</arg>
</cmdsynopsis>
</refsynopsisdiv>
</para>
</listitem>
</varlistentry>
-
+
+ <varlistentry>
+ <term>-i</term>
+ <listitem><para>This option tells smbpasswd that the account
+ being changed is an interdomain trust account. Currently this is used
+ when Samba is being used as an NT Primary Domain Controller.
+ The account contains the info about another trusted domain.</para>
+
+ <para>This option is only available when running smbpasswd as root.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>-L</term>
+ <listitem><para>Run in local mode.</para></listitem>
+ </varlistentry>
<varlistentry>
<term>username</term>
</refsect1>
</refentry>
-
-
-
-
<refsect1>
<title>VERSION</title>
- <para>This man page is correct for version 2.2 of
+ <para>This man page is correct for version 3.0 of
the Samba suite.</para>
</refsect1>
<arg choice="opt">-h</arg>
<arg choice="opt">-v</arg>
<arg choice="opt">-L <servername></arg>
+ <arg choice="opt">-t <encoding></arg>
<arg choice="req">config filename</arg>
- <arg choice="opt">hostname hostIP</arg>
+ <arg choice="opt">hostname hostIP</arg>
</cmdsynopsis>
</refsynopsisdiv>
their defaults.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term>-t encoding</term>
+ <listitem><para>
+ Output data in specified encoding.
+ </para></listitem>
+
<varlistentry>
<term>configfilename</term>
<listitem><para>This is the name of the configuration file
<refsect1>
<title>VERSION</title>
- <para>This man page is correct for version 2.2 of
+ <para>This man page is correct for version 3.0 of
the Samba suite.</para>
</refsect1>
</refsect1>
</refentry>
-
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [
+<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities;
+]>
+
<refentry id="vfstest">
<refmeta>
<varlistentry>
<term>-c|--command=command</term>
- <listitem><para>Execute the specified (colon-seperated) commands.
+ <listitem><para>Execute the specified (colon-separated) commands.
See below for the commands that are available.
</para> </listitem>
</varlistentry>
- <varlistentry>
- <term>-d|--debug=debuglevel</term>
- <listitem><para>set the debuglevel. Debug level 0 is the lowest
- and 100 being the highest. This should be set to 100 if you are
- planning on submitting a bug report to the Samba team (see
- <filename>BUGS.txt</filename>).
- </para></listitem>
- </varlistentry>
-
- <varlistentry>
- <term>-h|--help</term>
- <listitem><para>Print a summary of command line options.
- </para></listitem>
- </varlistentry>
+ &stdarg.debuglevel;
+ &stdarg.help;
<varlistentry>
<term>-l|--logfile=logbasename</term>
<command>wbinfo</command>
<arg choice="opt">-u</arg>
<arg choice="opt">-g</arg>
- <arg choice="opt">-h name</arg>
<arg choice="opt">-i ip</arg>
+ <arg choice="opt">-N netbios-name</arg>
<arg choice="opt">-n name</arg>
<arg choice="opt">-s sid</arg>
<arg choice="opt">-U uid</arg>
<arg choice="opt">-r user</arg>
<arg choice="opt">-a user%password</arg>
<arg choice="opt">-A user%password</arg>
+ <arg choice="opt">-p</arg>
</cmdsynopsis>
</refsynopsisdiv>
<command>winbindd(8)</command>. </para></listitem>
</varlistentry>
-
<varlistentry>
- <term>-h name</term>
- <listitem><para>The <parameter>-h</parameter> option
+ <term>-N name</term>
+ <listitem><para>The <parameter>-N</parameter> option
queries <command>winbindd(8)</command> to query the WINS
server for the IP address associated with the NetBIOS name
specified by the <parameter>name</parameter> parameter.
<varlistentry>
- <term>-i ip</term>
- <listitem><para>The <parameter>-i</parameter> option
+ <term>-I ip</term>
+ <listitem><para>The <parameter>-I</parameter> option
queries <command>winbindd(8)</command> to send a node status
request to get the NetBIOS name associated with the IP address
specified by the <parameter>ip</parameter> parameter.
<refsect1>
<title>VERSION</title>
- <para>This man page is correct for version 2.2 of
+ <para>This man page is correct for version 3.0 of
the Samba suite.</para>
</refsect1>
<pubdate>2002</pubdate>
</chapterinfo>
-<title>Using samba 3.0 with ActiveDirectory support</title>
+<title>Samba as a ADS domain member</title>
<para>
-This is a VERY ROUGH guide to setting up the current (November 2001)
-pre-alpha version of Samba 3.0 with kerberos authentication against a
-Windows2000 KDC. The procedures listed here are likely to change as
-the code develops.
+This is a rough guide to setting up Samba 3.0 with kerberos authentication against a
+Windows2000 KDC.
</para>
<para>Pieces you need before you begin:
<para><programlisting>
realm = YOUR.KERBEROS.REALM
- ads server = your.kerberos.server
security = ADS
encrypt passwords = yes
</programlisting></para>
-<para>Strictly speaking, you can omit the realm name and you can use an IP
- address for the ads server. In that case Samba will auto-detect these.</para>
+<para>
+In case samba can't figure out your ads server using your realm name, use the
+<command>ads server</command> option in <filename>smb.conf</filename>:
+<programlisting>
+ ads server = your.kerberos.server
+</programlisting>
+</para>
<para>You do *not* need a smbpasswd file, although it won't do any harm
and if you have one then Samba will be able to fall back to normal
</para>
<para>
-<command> wins server = >name or IP address<</command>
+<command>wins server = >name or IP address<</command>
</para>
<para>
</para>
<para>
-<command> domain master = yes</command>
+<command>domain master = yes</command>
</para>
<para>
<title>Introduction</title>
<para>
-The email address for bug reports is samba@samba.org
+The email address for bug reports for stable releases is <ulink url="samba@samba.org">samba@samba.org</ulink>.
+Bug reports for alpha releases should go to <ulink url="mailto:samba-technical@samba.org">samba-technical@samba.org</ulink>.
</para>
<para>
<para>
You may also like to look though the recent mailing list archives,
which are conveniently accessible on the Samba web pages
-at http://samba.org/samba/
+at <ulink url="http://samba.org/samba/">http://samba.org/samba/</ulink>.
</para>
</sect1>
</chapterinfo>
-<title>security = domain in Samba 2.x</title>
+<title>Samba as a NT4 domain member</title>
<sect1>
<sect1>
<title>Samba and Windows 2000 Domains</title>
+<!-- FIXME: this section is partly obsoleted - jelmer@samba.org -->
<para>
Many people have asked regarding the state of Samba's ability to participate in
-a Windows 2000 Domain. Samba 2.2 is able to act as a member server of a Windows
+a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows
2000 domain operating in mixed or native mode.
</para>
</sect1>
-
<sect1>
<title>Why is this better than security = server?</title>
<address><email>tridge@samba.org</email></address>
</affiliation>
</author>
- <pubdate> 1 November 1999</pubdate>
+ <author>
+ <firstname>Jelmer</firstname><surname>Vernooij</surname>
+ <affiliation>
+ <orgname>Samba Team</orgname>
+ <address><email>jelmer@samba.org</email></address>
+ </affiliation>
+ </author>
+ <pubdate>$Id: Diagnosis.sgml,v 1.1.2.3 2002/11/22 00:32:23 tpot Exp $</pubdate>
</chapterinfo>
<title>Diagnosing your samba server</title>
</para>
<para>
-You should do ALL the tests, in the order shown. I have tried to
+You should do ALL the tests, in the order shown. We have tried to
carefully choose them so later tests only use capabilities verified in
the earlier tests.
</para>
<para>
-If you send me an email saying "it doesn't work" and you have not
-followed this test procedure then you should not be surprised if I
-ignore your email.
+If you send one of the samba mailing lists an email saying "it doesn't work"
+and you have not followed this test procedure then you should not be surprised
+your email is ignored.
</para>
</sect1>
<title>Assumptions</title>
<para>
-In all of the tests I assume you have a Samba server called BIGSERVER
-and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the
-PC is running windows for workgroups with a recent copy of the
-microsoft tcp/ip stack. Alternatively, your PC may be running Windows
-95 or Windows NT (Workstation or Server).
+In all of the tests it is assumed you have a Samba server called
+BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.
</para>
<para>
</para>
<para>
-I also assume you know the name of an available share in your
+It is also assumed you know the name of an available share in your
smb.conf. I will assume this share is called "tmp". You can add a
"tmp" share like by adding the following to smb.conf:
</para>
</para>
<para>
-THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME
+THESE TESTS ASSUME VERSION 3.0.0 OR LATER OF THE SAMBA SUITE. SOME
COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS
</para>
</para>
<para>
-Note: Your smb.conf file may be located in: <filename>/etc</filename>
+Note: Your smb.conf file may be located in: <filename>/etc/samba</filename>
Or in: <filename>/usr/local/samba/lib</filename>
</para>
</sect2>
<affiliation>
<orgname>Samba Team</orgname>
<address>
- <email>samba@samba.org</email>
+ <email>jra@samba.org</email>
</address>
</affiliation>
</author>
-
- <pubdate>19 Apr 1999</pubdate>
+ <author>
+ <firstname>Jelmer</firstname><surname>Vernooij</surname>
+ <affiliation>
+ <orgname>Samba Team</orgname>
+ <address>
+ <email>jelmer@samba.org</email>
+ </address>
+ </affiliation>
+ </author>
+
+ <pubdate>4 November 2002</pubdate>
</chapterinfo>
-<title>LanMan and NT Password Encryption in Samba 2.x</title>
+<title>LanMan and NT Password Encryption in Samba</title>
<sect1>
<title>Introduction</title>
- <para>With the development of LanManager and Windows NT
- compatible password encryption for Samba, it is now able
- to validate user connections in exactly the same way as
- a LanManager or Windows NT server.</para>
-
- <para>This document describes how the SMB password encryption
- algorithm works and what issues there are in choosing whether
- you want to use it. You should read it carefully, especially
- the part about security and the "PROS and CONS" section.</para>
-
-</sect1>
-
-<sect1>
- <title>How does it work?</title>
-
- <para>LanManager encryption is somewhat similar to UNIX
- password encryption. The server uses a file containing a
- hashed value of a user's password. This is created by taking
- the user's plaintext password, capitalising it, and either
- truncating to 14 bytes or padding to 14 bytes with null bytes.
- This 14 byte value is used as two 56 bit DES keys to encrypt
- a 'magic' eight byte value, forming a 16 byte value which is
- stored by the server and client. Let this value be known as
- the "hashed password".</para>
-
- <para>Windows NT encryption is a higher quality mechanism,
- consisting of doing an MD4 hash on a Unicode version of the user's
- password. This also produces a 16 byte hash value that is
- non-reversible.</para>
-
- <para>When a client (LanManager, Windows for WorkGroups, Windows
- 95 or Windows NT) wishes to mount a Samba drive (or use a Samba
- resource), it first requests a connection and negotiates the
- protocol that the client and server will use. In the reply to this
- request the Samba server generates and appends an 8 byte, random
- value - this is stored in the Samba server after the reply is sent
- and is known as the "challenge". The challenge is different for
- every client connection.</para>
-
- <para>The client then uses the hashed password (16 byte values
- described above), appended with 5 null bytes, as three 56 bit
- DES keys, each of which is used to encrypt the challenge 8 byte
- value, forming a 24 byte value known as the "response".</para>
-
- <para>In the SMB call SMBsessionsetupX (when user level security
- is selected) or the call SMBtconX (when share level security is
- selected), the 24 byte response is returned by the client to the
- Samba server. For Windows NT protocol levels the above calculation
- is done on both hashes of the user's password and both responses are
- returned in the SMB call, giving two 24 byte values.</para>
+ <para>Newer windows clients send encrypted passwords over
+ the wire, instead of plain text passwords. The newest clients
+ will only send encrypted passwords and refuse to send plain text
+ passwords, unless their registry is tweaked.</para>
- <para>The Samba server then reproduces the above calculation, using
- its own stored value of the 16 byte hashed password (read from the
- <filename>smbpasswd</filename> file - described later) and the challenge
- value that it kept from the negotiate protocol reply. It then checks
- to see if the 24 byte value it calculates matches the 24 byte value
- returned to it from the client.</para>
-
- <para>If these values match exactly, then the client knew the
- correct password (or the 16 byte hashed value - see security note
- below) and is thus allowed access. If not, then the client did not
- know the correct password and is denied access.</para>
+ <para>These passwords can't be converted to unix style encrypted
+ passwords. Because of that you can't use the standard unix
+ user database, and you have to store the Lanman and NT hashes
+ somewhere else. For more information, see the documentation
+ about the <command>passdb backend = </command> parameter.
+ </para>
- <para>Note that the Samba server never knows or stores the cleartext
- of the user's password - just the 16 byte hashed values derived from
- it. Also note that the cleartext password or 16 byte hashed values
- are never transmitted over the network - thus increasing security.</para>
</sect1>
<sect1>
</sect1>
-<sect1>
- <title><anchor id="SMBPASSWDFILEFORMAT">The smbpasswd file</title>
-
- <para>In order for Samba to participate in the above protocol
- it must be able to look up the 16 byte hashed values given a user name.
- Unfortunately, as the UNIX password value is also a one way hash
- function (ie. it is impossible to retrieve the cleartext of the user's
- password given the UNIX hash of it), a separate password file
- containing this 16 byte value must be kept. To minimise problems with
- these two password files, getting out of sync, the UNIX <filename>
- /etc/passwd</filename> and the <filename>smbpasswd</filename> file,
- a utility, <command>mksmbpasswd.sh</command>, is provided to generate
- a smbpasswd file from a UNIX <filename>/etc/passwd</filename> file.
- </para
-
-
- <para>To generate the smbpasswd file from your <filename>/etc/passwd
- </filename> file use the following command :</para>
-
- <para><prompt>$ </prompt><userinput>cat /etc/passwd | mksmbpasswd.sh
- > /usr/local/samba/private/smbpasswd</userinput></para>
-
- <para>If you are running on a system that uses NIS, use</para>
-
- <para><prompt>$ </prompt><userinput>ypcat passwd | mksmbpasswd.sh
- > /usr/local/samba/private/smbpasswd</userinput></para>
-
- <para>The <command>mksmbpasswd.sh</command> program is found in
- the Samba source directory. By default, the smbpasswd file is
- stored in :</para>
-
- <para><filename>/usr/local/samba/private/smbpasswd</filename></para>
-
- <para>The owner of the <filename>/usr/local/samba/private/</filename>
- directory should be set to root, and the permissions on it should
- be set to 0500 (<command>chmod 500 /usr/local/samba/private</command>).
- </para>
-
- <para>Likewise, the smbpasswd file inside the private directory should
- be owned by root and the permissions on is should be set to 0600
- (<command>chmod 600 smbpasswd</command>).</para>
-
-
- <para>The format of the smbpasswd file is (The line has been
- wrapped here. It should appear as one entry per line in
- your smbpasswd file.)</para>
-
- <para><programlisting>
-username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
- [Account type]:LCT-<last-change-time>:Long name
- </programlisting></para>
-
- <para>Although only the <replaceable>username</replaceable>,
- <replaceable>uid</replaceable>, <replaceable>
- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</replaceable>,
- [<replaceable>Account type</replaceable>] and <replaceable>
- last-change-time</replaceable> sections are significant
- and are looked at in the Samba code.</para>
-
- <para>It is <emphasis>VITALLY</emphasis> important that there by 32
- 'X' characters between the two ':' characters in the XXX sections -
- the smbpasswd and Samba code will fail to validate any entries that
- do not have 32 characters between ':' characters. The first XXX
- section is for the Lanman password hash, the second is for the
- Windows NT version.</para>
-
- <para>When the password file is created all users have password entries
- consisting of 32 'X' characters. By default this disallows any access
- as this user. When a user has a password set, the 'X' characters change
- to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii
- representation of the 16 byte hashed value of a user's password.</para>
-
- <para>To set a user to have no password (not recommended), edit the file
- using vi, and replace the first 11 characters with the ascii text
- <constant>"NO PASSWORD"</constant> (minus the quotes).</para>
-
- <para>For example, to clear the password for user bob, his smbpasswd file
- entry would look like :</para>
-
- <para><programlisting>
- bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
- </programlisting></para>
-
- <para>If you are allowing users to use the smbpasswd command to set
- their own passwords, you may want to give users NO PASSWORD initially
- so they do not have to enter a previous password when changing to their
- new password (not recommended). In order for you to allow this the
- <command>smbpasswd</command> program must be able to connect to the
- <command>smbd</command> daemon as that user with no password. Enable this
- by adding the line :</para>
-
- <para><command>null passwords = yes</command></para>
-
- <para>to the [global] section of the smb.conf file (this is why
- the above scenario is not recommended). Preferably, allocate your
- users a default password to begin with, so you do not have
- to enable this on your server.</para>
-
- <para><emphasis>Note : </emphasis>This file should be protected very
- carefully. Anyone with access to this file can (with enough knowledge of
- the protocols) gain access to your SMB server. The file is thus more
- sensitive than a normal unix <filename>/etc/passwd</filename> file.</para>
-</sect1>
-
-
<sect1>
<title>The smbpasswd Command</title>
install it in <filename>/usr/local/samba/bin/</filename> (or your
main Samba binary directory).</para>
- <para>Note that as of Samba 1.9.18p4 this program <emphasis>MUST NOT
- BE INSTALLED</emphasis> setuid root (the new <command>smbpasswd</command>
- code enforces this restriction so it cannot be run this way by
- accident).</para>
-
<para><command>smbpasswd</command> now works in a client-server mode
where it contacts the local smbd to change the user's password on its
behalf. This has enormous benefits - as follows.</para>
- <itemizedlist>
- <listitem><para>smbpasswd no longer has to be setuid root -
- an enormous range of potential security problems is
- eliminated.</para></listitem>
-
- <listitem><para><command>smbpasswd</command> now has the capability
- to change passwords on Windows NT servers (this only works when
- the request is sent to the NT Primary Domain Controller if you
- are changing an NT Domain user's password).</para></listitem>
- </itemizedlist>
+ <para><command>smbpasswd</command> now has the capability
+ to change passwords on Windows NT servers (this only works when
+ the request is sent to the NT Primary Domain Controller if you
+ are changing an NT Domain user's password).</para>
<para>To run smbpasswd as a normal user just type :</para>
to the man page which will always be the definitive reference.</para>
</sect1>
-
-<sect1>
- <title>Setting up Samba to support LanManager Encryption</title>
-
- <para>This is a very brief description on how to setup samba to
- support password encryption. </para>
-
- <orderedlist numeration="Arabic">
- <listitem><para>compile and install samba as usual</para>
- </listitem>
-
- <listitem><para>enable encrypted passwords in <filename>
- smb.conf</filename> by adding the line <command>encrypt
- passwords = yes</command> in the [global] section</para>
- </listitem>
-
- <listitem><para>create the initial <filename>smbpasswd</filename>
- password file in the place you specified in the Makefile
- (--prefix=<dir>). See the notes under the <link
- linkend="SMBPASSWDFILEFORMAT">The smbpasswd File</link>
- section earlier in the document for details.</para>
- </listitem>
- </orderedlist>
-
- <para>Note that you can test things using smbclient.</para>
-</sect1>
-
</chapter>
</para>
<para>
-Samba version 2.2.0 will add Linux support for extensions to
+Starting with version 2.2.0 samba has Linux support for extensions to
the name service switch infrastructure so that linux clients will
be able to obtain resolution of MS Windows NetBIOS names to IP
Addresses. To gain this functionality Samba needs to be compiled
+++ /dev/null
-<chapter id="printingdebug">
-<chapterinfo>
- <author>
- <firstname>Patrick</firstname><surname>Powell</surname>
- <affiliation>
- <address><email>papowell@lprng.org</email></address>
- </affiliation>
- </author>
- <pubdate>11 August 2000</pubdate>
-</chapterinfo>
-
-<title>Debugging Printing Problems</title>
-
-<sect1>
-<title>Introduction</title>
-
-<para>
-This is a short description of how to debug printing problems with
-Samba. This describes how to debug problems with printing from a SMB
-client to a Samba server, not the other way around. For the reverse
-see the examples/printing directory.
-</para>
-
-<para>
-Ok, so you want to print to a Samba server from your PC. The first
-thing you need to understand is that Samba does not actually do any
-printing itself, it just acts as a middleman between your PC client
-and your Unix printing subsystem. Samba receives the file from the PC
-then passes the file to a external "print command". What print command
-you use is up to you.
-</para>
-
-<para>
-The whole things is controlled using options in smb.conf. The most
-relevant options (which you should look up in the smb.conf man page)
-are:
-</para>
-
-<para><programlisting>
- [global]
- print command - send a file to a spooler
- lpq command - get spool queue status
- lprm command - remove a job
- [printers]
- path = /var/spool/lpd/samba
-</programlisting></para>
-
-<para>
-The following are nice to know about:
-</para>
-
-<para><programlisting>
- queuepause command - stop a printer or print queue
- queueresume command - start a printer or print queue
-</programlisting></para>
-
-<para>
-Example:
-</para>
-
-<para><programlisting>
- print command = /usr/bin/lpr -r -P%p %s
- lpq command = /usr/bin/lpq -P%p %s
- lprm command = /usr/bin/lprm -P%p %j
- queuepause command = /usr/sbin/lpc -P%p stop
- queuepause command = /usr/sbin/lpc -P%p start
-</programlisting></para>
-
-<para>
-Samba should set reasonable defaults for these depending on your
-system type, but it isn't clairvoyant. It is not uncommon that you
-have to tweak these for local conditions. The commands should
-always have fully specified pathnames, as the smdb may not have
-the correct PATH values.
-</para>
-
-<para>
-When you send a job to Samba to be printed, it will make a temporary
-copy of it in the directory specified in the [printers] section.
-and it should be periodically cleaned out. The lpr -r option
-requests that the temporary copy be removed after printing; If
-printing fails then you might find leftover files in this directory,
-and it should be periodically cleaned out. Samba used the lpq
-command to determine the "job number" assigned to your print job
-by the spooler.
-</para>
-
-<para>
-The %>letter< are "macros" that get dynamically replaced with appropriate
-values when they are used. The %s gets replaced with the name of the spool
-file that Samba creates and the %p gets replaced with the name of the
-printer. The %j gets replaced with the "job number" which comes from
-the lpq output.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Debugging printer problems</title>
-
-<para>
-One way to debug printing problems is to start by replacing these
-command with shell scripts that record the arguments and the contents
-of the print file. A simple example of this kind of things might
-be:
-</para>
-
-<para><programlisting>
- print command = /tmp/saveprint %p %s
-
- #!/bin/saveprint
- # we make sure that we are the right user
- /usr/bin/id -p >/tmp/tmp.print
- # we run the command and save the error messages
- # replace the command with the one appropriate for your system
- /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print
-</programlisting></para>
-
-<para>
-Then you print a file and try removing it. You may find that the
-print queue needs to be stopped in order to see the queue status
-and remove the job:
-</para>
-
-<para><programlisting>
-
-h4: {42} % echo hi >/tmp/hi
-h4: {43} % smbclient //localhost/lw4
-added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
-Password:
-Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
-smb: \> print /tmp/hi
-putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
-smb: \> queue
-1049 3 hi-17534
-smb: \> cancel 1049
-Error cancelling job 1049 : code 0
-smb: \> cancel 1049
-Job 1049 cancelled
-smb: \> queue
-smb: \> exit
-</programlisting></para>
-
-<para>
-The 'code 0' indicates that the job was removed. The comment
-by the smbclient is a bit misleading on this.
-You can observe the command output and then and look at the
-/tmp/tmp.print file to see what the results are. You can quickly
-find out if the problem is with your printing system. Often people
-have problems with their /etc/printcap file or permissions on
-various print queues.
-</para>
-</sect1>
-
-<sect1>
-<title>What printers do I have?</title>
-
-<para>
-You can use the 'testprns' program to check to see if the printer
-name you are using is recognized by Samba. For example, you can
-use:
-</para>
-
-<para><programlisting>
- testprns printer /etc/printcap
-</programlisting></para>
-
-<para>
-Samba can get its printcap information from a file or from a program.
-You can try the following to see the format of the extracted
-information:
-</para>
-
-<para><programlisting>
- testprns -a printer /etc/printcap
-
- testprns -a printer '|/bin/cat printcap'
-</programlisting></para>
-
-</sect1>
-
-<sect1>
-<title>Setting up printcap and print servers</title>
-
-<para>
-You may need to set up some printcaps for your Samba system to use.
-It is strongly recommended that you use the facilities provided by
-the print spooler to set up queues and printcap information.
-</para>
-
-<para>
-Samba requires either a printcap or program to deliver printcap
-information. This printcap information has the format:
-</para>
-
-<para><programlisting>
- name|alias1|alias2...:option=value:...
-</programlisting></para>
-
-<para>
-For almost all printing systems, the printer 'name' must be composed
-only of alphanumeric or underscore '_' characters. Some systems also
-allow hyphens ('-') as well. An alias is an alternative name for the
-printer, and an alias with a space in it is used as a 'comment'
-about the printer. The printcap format optionally uses a \ at the end of lines
-to extend the printcap to multiple lines.
-</para>
-
-<para>
-Here are some examples of printcap files:
-</para>
-
-<para>
-<orderedlist>
-<listitem><para>
-pr just printer name
-</para></listitem>
-<listitem><para>
-pr|alias printer name and alias
-</para></listitem>
-<listitem><para>
-pr|My Printer printer name, alias used as comment
-</para></listitem>
-<listitem><para>
-pr:sh:\ Same as pr:sh:cm= testing
- :cm= \
- testing
-</para></listitem>
-<listitem><para>
-pr:sh Same as pr:sh:cm= testing
- :cm= testing
-</para></listitem>
-</orderedlist>
-</para>
-
-<para>
-Samba reads the printcap information when first started. If you make
-changes in the printcap information, then you must do the following:
-</para>
-
-<orderedlist>
-
-<listitem><para>
-make sure that the print spooler is aware of these changes.
-The LPRng system uses the 'lpc reread' command to do this.
-</para></listitem>
-
-<listitem><para>
-make sure that the spool queues, etc., exist and have the
-correct permissions. The LPRng system uses the 'checkpc -f'
-command to do this.
-</para></listitem>
-
-<listitem><para>
-You now should send a SIGHUP signal to the smbd server to have
-it reread the printcap information.
-</para></listitem>
-</orderedlist>
-
-</sect1>
-
-<sect1>
-<title>Job sent, no output</title>
-
-<para>
-This is the most frustrating part of printing. You may have sent the
-job, verified that the job was forwarded, set up a wrapper around
-the command to send the file, but there was no output from the printer.
-</para>
-
-<para>
-First, check to make sure that the job REALLY is getting to the
-right print queue. If you are using a BSD or LPRng print spooler,
-you can temporarily stop the printing of jobs. Jobs can still be
-submitted, but they will not be printed. Use:
-</para>
-
-<para><programlisting>
- lpc -Pprinter stop
-</programlisting></para>
-
-<para>
-Now submit a print job and then use 'lpq -Pprinter' to see if the
-job is in the print queue. If it is not in the print queue then
-you will have to find out why it is not being accepted for printing.
-</para>
-
-<para>
-Next, you may want to check to see what the format of the job really
-was. With the assistance of the system administrator you can view
-the submitted jobs files. You may be surprised to find that these
-are not in what you would expect to call a printable format.
-You can use the UNIX 'file' utitily to determine what the job
-format actually is:
-</para>
-
-<para><programlisting>
- cd /var/spool/lpd/printer # spool directory of print jobs
- ls # find job files
- file dfA001myhost
-</programlisting></para>
-
-<para>
-You should make sure that your printer supports this format OR that
-your system administrator has installed a 'print filter' that will
-convert the file to a format appropriate for your printer.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Job sent, strange output</title>
-
-<para>
-Once you have the job printing, you can then start worrying about
-making it print nicely.
-</para>
-
-<para>
-The most common problem is extra pages of output: banner pages
-OR blank pages at the end.
-</para>
-
-<para>
-If you are getting banner pages, check and make sure that the
-printcap option or printer option is configured for no banners.
-If you have a printcap, this is the :sh (suppress header or banner
-page) option. You should have the following in your printer.
-</para>
-
-<para><programlisting>
- printer: ... :sh
-</programlisting></para>
-
-<para>
-If you have this option and are still getting banner pages, there
-is a strong chance that your printer is generating them for you
-automatically. You should make sure that banner printing is disabled
-for the printer. This usually requires using the printer setup software
-or procedures supplied by the printer manufacturer.
-</para>
-
-<para>
-If you get an extra page of output, this could be due to problems
-with your job format, or if you are generating PostScript jobs,
-incorrect setting on your printer driver on the MicroSoft client.
-For example, under Win95 there is a option:
-</para>
-
-<para><programlisting>
- Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|
-</programlisting></para>
-
-<para>
-that allows you to choose if a Ctrl-D is appended to all jobs.
-This is a very bad thing to do, as most spooling systems will
-automatically add a ^D to the end of the job if it is detected as
-PostScript. The multiple ^D may cause an additional page of output.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Raw PostScript printed</title>
-
-<para>
-This is a problem that is usually caused by either the print spooling
-system putting information at the start of the print job that makes
-the printer think the job is a text file, or your printer simply
-does not support PostScript. You may need to enable 'Automatic
-Format Detection' on your printer.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Advanced Printing</title>
-
-<para>
-Note that you can do some pretty magic things by using your
-imagination with the "print command" option and some shell scripts.
-Doing print accounting is easy by passing the %U option to a print
-command shell script. You could even make the print command detect
-the type of output and its size and send it to an appropriate
-printer.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Real debugging</title>
-
-<para>
-If the above debug tips don't help, then maybe you need to bring in
-the bug guns, system tracing. See Tracing.txt in this directory.
-</para>
-</sect1>
-</chapter>
</chapterinfo>
<title>
-How to Configure Samba 2.2 as a Primary Domain Controller
+How to Configure Samba as a NT4 Primary Domain Controller
</title>
</sect1>
-<sect1>
-<title>Oplocks</title>
-
-<sect2>
-<title>Overview</title>
-
-<para>
-Oplocks are the way that SMB clients get permission from a server to
-locally cache file operations. If a server grants an oplock
-(opportunistic lock) then the client is free to assume that it is the
-only one accessing the file and it will agressively cache file
-data. With some oplock types the client may even cache file open/close
-operations. This can give enormous performance benefits.
-</para>
-
-<para>
-With the release of Samba 1.9.18 we now correctly support opportunistic
-locks. This is turned on by default, and can be turned off on a share-
-by-share basis by setting the parameter :
-</para>
-
-<para>
-<command>oplocks = False</command>
-</para>
-
-<para>
-We recommend that you leave oplocks on however, as current benchmark
-tests with NetBench seem to give approximately a 30% improvement in
-speed with them on. This is on average however, and the actual
-improvement seen can be orders of magnitude greater, depending on
-what the client redirector is doing.
-</para>
-
-<para>
-Previous to Samba 1.9.18 there was a 'fake oplocks' option. This
-option has been left in the code for backwards compatibility reasons
-but it's use is now deprecated. A short summary of what the old
-code did follows.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Level2 Oplocks</title>
-
-<para>
-With Samba 2.0.5 a new capability - level2 (read only) oplocks is
-supported (although the option is off by default - see the smb.conf
-man page for details). Turning on level2 oplocks (on a share-by-share basis)
-by setting the parameter :
-</para>
-
-<para>
-<command>level2 oplocks = true</command>
-</para>
-
-<para>
-should speed concurrent access to files that are not commonly written
-to, such as application serving shares (ie. shares that contain common
-.EXE files - such as a Microsoft Office share) as it allows clients to
-read-ahread cache copies of these files.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Old 'fake oplocks' option - deprecated</title>
-
-<para>
-Samba can also fake oplocks, by granting a oplock whenever a client
-asks for one. This is controlled using the smb.conf option "fake
-oplocks". If you set "fake oplocks = yes" then you are telling the
-client that it may agressively cache the file data for all opens.
-</para>
-
-<para>
-Enabling 'fake oplocks' on all read-only shares or shares that you know
-will only be accessed from one client at a time you will see a big
-performance improvement on many operations. If you enable this option
-on shares where multiple clients may be accessing the files read-write
-at the same time you can get data corruption.
-</para>
-
-</sect2>
-</sect1>
-
<sect1>
<title>Socket options</title>
</sect1>
-<sect1>
-<title>Locking</title>
-
-<para>
-By default Samba does not implement strict locking on each read/write
-call (although it did in previous versions). If you enable strict
-locking (using "strict locking = yes") then you may find that you
-suffer a severe performance hit on some systems.
-</para>
-
-<para>
-The performance hit will probably be greater on NFS mounted
-filesystems, but could be quite high even on local disks.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Share modes</title>
-
-<para>
-Some people find that opening files is very slow. This is often
-because of the "share modes" code needed to fully implement the dos
-share modes stuff. You can disable this code using "share modes =
-no". This will gain you a lot in opening and closing files but will
-mean that (in some cases) the system won't force a second user of a
-file to open the file read-only if the first has it open
-read-write. For many applications that do their own locking this
-doesn't matter, but for some it may. Most Windows applications
-depend heavily on "share modes" working correctly and it is
-recommended that the Samba share mode support be left at the
-default of "on".
-</para>
-
-<para>
-The share mode code in Samba has been re-written in the 1.9.17
-release following tests with the Ziff-Davis NetBench PC Benchmarking
-tool. It is now believed that Samba 1.9.17 implements share modes
-similarly to Windows NT.
-</para>
-
-<para>
-NOTE: In the most recent versions of Samba there is an option to use
-shared memory via mmap() to implement the share modes. This makes
-things much faster. See the Makefile for how to enable this.
-</para>
-
-</sect1>
-
<sect1>
<title>Log level</title>
</para>
</sect1>
-<sect1>
-<title>Wide lines</title>
-
-<para>
-The "wide links" option is now enabled by default, but if you disable
-it (for better security) then you may suffer a performance hit in
-resolving filenames. The performance loss is lessened if you have
-"getwd cache = yes", which is now the default.
-</para>
-
-</sect1>
-
<sect1>
<title>Read raw</title>
</sect1>
-<sect1>
-<title>Read prediction</title>
-
-<para>
-Samba can do read prediction on some of the SMB commands. Read
-prediction means that Samba reads some extra data on the last file it
-read while waiting for the next SMB command to arrive. It can then
-respond more quickly when the next read request arrives.
-</para>
-
-<para>
-This is disabled by default. You can enable it by using "read
-prediction = yes".
-</para>
-
-<para>
-Note that read prediction is only used on files that were opened read
-only.
-</para>
-
-<para>
-Read prediction should particularly help for those silly clients (such
-as "Write" under NT) which do lots of very small reads on a file.
-</para>
-
-<para>
-Samba will not read ahead more data than the amount specified in the
-"read size" option. It always reads ahead on 1k block boundaries.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Memory mapping</title>
-
-<para>
-Samba supports reading files via memory mapping them. One some
-machines this can give a large boost to performance, on others it
-makes not difference at all, and on some it may reduce performance.
-</para>
-
-<para>
-To enable you you have to recompile Samba with the -DUSE_MMAP option
-on the FLAGS line of the Makefile.
-</para>
-
-<para>
-Note that memory mapping is only used on files opened read only, and
-is not used by the "read raw" operation. Thus you may find memory
-mapping is more effective if you disable "read raw" using "read raw =
-no".
-</para>
-
-</sect1>
-
<sect1>
<title>Slow Clients</title>
</para>
<para>
-FIXME
+<programlisting>
The figures are: Put Get
P166 client 3Com card: 420-440kB/s 500-520kB/s
P100 client 3Com card: 390-410kB/s 490-510kB/s
DX4-75 client NE2000: 370-380kB/s 330-350kB/s
+</programlisting>
</para>
<para>
staggering.
</para>
-</sect1>
-
-<sect1>
-<title>My Results</title>
-
-<para>
-Some people want to see real numbers in a document like this, so here
-they are. I have a 486sx33 client running WfWg 3.11 with the 3.11b
-tcp/ip stack. It has a slow IDE drive and 20Mb of ram. It has a SMC
-Elite-16 ISA bus ethernet card. The only WfWg tuning I've done is to
-set DefaultRcvWindow in the [MSTCP] section of system.ini to 16384. My
-server is a 486dx3-66 running Linux. It also has 20Mb of ram and a SMC
-Elite-16 card. You can see my server config in the examples/tridge/
-subdirectory of the distribution.
-</para>
-
-<para>
-I get 490k/s on reading a 8Mb file with copy.
-I get 441k/s writing the same file to the samba server.
-</para>
-
-<para>
-Of course, there's a lot more to benchmarks than 2 raw throughput
-figures, but it gives you a ballpark figure.
-</para>
-
-<para>
-I've also tested Win95 and WinNT, and found WinNT gave me the best
-speed as a samba client. The fastest client of all (for me) is
-smbclient running on another linux box. Maybe I'll add those results
-here someday ...
-</para>
-
</sect1>
</chapter>
<title>How to Install and Test SAMBA</title>
<sect1>
- <title>Step 0: Read the man pages</title>
+ <title>Read the man pages</title>
<para>The man pages distributed with SAMBA contain
lots of useful info that will help to get you started.
If you don't know how to read man pages then try
something like:</para>
- <para><prompt>$ </prompt><userinput>nroff -man smbd.8 | more
- </userinput></para>
+ <para><prompt>$ </prompt><userinput>man smbd.8</userinput>
+ or
+ <prompt>$ </prompt><userinput>nroff -man smbd.8 | more
+ </userinput> on older unixes.</para>
<para>Other sources of information are pointed to
by the Samba web site,<ulink url="http://www.samba.org/">
</sect1>
<sect1>
- <title>Step 1: Building the Binaries</title>
+ <title>Building the Binaries</title>
<para>To do this, first run the program <command>./configure
</command> in the source directory. This should automatically
</sect1>
<sect1>
- <title>Step 2: The all important step</title>
+ <title>The all important step</title>
<para>At this stage you must fetch yourself a
coffee or other drink you find stimulating. Getting the rest
</sect1>
<sect1>
- <title>Step 3: Create the smb configuration file. </title>
+ <title>Create the smb configuration file. </title>
<para>There are sample configuration files in the examples
subdirectory in the distribution. I suggest you read them
[homes]
guest ok = no
read only = no
- </programlisting</para>
+ </programlisting></para>
<para>which would allow connections by anyone with an
account on the server, using either their login name or
</sect1>
<sect1>
- <title>Step 4: Test your config file with
+ <title>Test your config file with
<command>testparm</command></title>
<para>It's important that you test the validity of your
<para>Make sure it runs OK and that the services look
reasonable before proceeding. </para>
+ <para>Always run testparm again when you change
+ <filename>smb.conf</filename>!</para>
+
</sect1>
<sect1>
- <title>Step 5: Starting the smbd and nmbd</title>
+ <title>Starting the smbd and nmbd</title>
<para>You must choose to start smbd and nmbd either
as daemons or from <command>inetd</command>. Don't try
request.</para>
<sect2>
- <title>Step 5a: Starting from inetd.conf</title>
+ <title>Starting from inetd.conf</title>
<para>NOTE; The following will be different if
you use NIS or NIS+ to distributed services maps.</para>
</sect2>
<sect2>
- <title>Step 5b. Alternative: starting it as a daemon</title>
+ <title>Alternative: starting it as a daemon</title>
<para>To start the server as a daemon you should create
a script something like this one, perhaps calling
</sect1>
<sect1>
- <title>Step 6: Try listing the shares available on your
+ <title>Try listing the shares available on your
server</title>
<para><prompt>$ </prompt><userinput>smbclient -L
</sect1>
<sect1>
- <title>Step 7: Try connecting with the unix client</title>
+ <title>Try connecting with the unix client</title>
<para><prompt>$ </prompt><userinput>smbclient <replaceable>
//yourhostname/aservice</replaceable></userinput></para>
</sect1>
<sect1>
- <title>Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT,
+ <title>Try connecting from a DOS, WfWg, Win9x, WinNT,
Win2k, OS/2, etc... client</title>
<para>Try mounting disks. eg:</para>
<sect2>
<title>Diagnosing Problems</title>
- <para>If you have installation problems then go to
- <filename>DIAGNOSIS.txt</filename> to try to find the
+ <para>If you have installation problems then go to the
+ <ulink url="Diagnosis.html">Diagnosis</ulink> chapter to try to find the
problem.</para>
</sect2>
its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE
or DENY_ALL. There are also special compatibility modes called
DENY_FCB and DENY_DOS.</para>
+
+ <!-- FIXME: Sync this with oplocks.sgml -->
</sect2>
<sect2>
</affiliation>
</author>
-
- <pubdate>12 Jul 200</pubdate>
+ <pubdate>12 Jul 2000</pubdate>
</chapterinfo>
</address>
</affiliation>
</author>
-
-
+ <author>
+ <firstname>Patrick</firstname><surname>Powell</surname>
+ <affiliation>
+ <address><email>papowell@lprng.org</email></address>
+ </affiliation>
+ </author>
<pubdate> (3 May 2001) </pubdate>
</chapterinfo>
-<title>Printing Support in Samba 2.2.x</title>
+<title>Printing Support</title>
<sect1>
<title>Introduction</title>
There has been some initial confusion about what all this means
and whether or not it is a requirement for printer drivers to be
installed on a Samba host in order to support printing from Windows
-clients. A bug existed in Samba 2.2.0 which made Windows NT/2000 clients
-require that the Samba server possess a valid driver for the printer.
-This is fixed in Samba 2.2.1 and once again, Windows NT/2000 clients
-can use the local APW for installing drivers to be used with a Samba
-served printer. This is the same behavior exhibited by Windows 9x clients.
-As a side note, Samba does not use these drivers in any way to process
+clients. As a side note, Samba does not use these drivers in any way to process
spooled files. They are utilized entirely by the clients.
</para>
a means of defining the printer driver name to be sent to
the client.
</para>
-
-<para>
-These parameters, including <parameter>printer driver
-file</parameter> parameter, are being deprecated and should not
-be used in new installations. For more information on this change,
-you should refer to the <link linkend="MIGRATION">Migration section</link>
-of this document.
-</para>
-</warning>
+</warning>
+
<sect2>
<title>Creating [print$]</title>
<para>The initial listing of printers in the Samba host's
Printers folder will have no real printer driver assigned
-to them. By default, in Samba 2.2.0 this driver name was set to
-<emphasis>NO PRINTER DRIVER AVAILABLE FOR THIS PRINTER</emphasis>.
-Later versions changed this to a NULL string to allow the use
-tof the local Add Printer Wizard on NT/2000 clients.
+to them. This defaults to a NULL string to allow the use
+of the local Add Printer Wizard on NT/2000 clients.
Attempting to view the printer properties for a printer
which has this default driver assigned will result in
the error message:</para>
</sect1>
-
-<sect1>
-<title><anchor id="MIGRATION">Migration to from Samba 2.0.x to 2.2.x</title>
-
-<para>
-Given that printer driver management has changed (we hope improved) in
-2.2 over prior releases, migration from an existing setup to 2.2 can
-follow several paths. Here are the possible scenarios for
-migration:
-</para>
-
-<itemizedlist>
- <listitem><para>If you do not desire the new Windows NT
- print driver support, nothing needs to be done.
- All existing parameters work the same.</para></listitem>
-
- <listitem><para>If you want to take advantage of NT printer
- driver support but do not want to migrate the
- 9x drivers to the new setup, the leave the existing
- <filename>printers.def</filename> file. When smbd attempts
- to locate a
- 9x driver for the printer in the TDB and fails it
- will drop down to using the printers.def (and all
- associated parameters). The <command>make_printerdef</command>
- tool will also remain for backwards compatibility but will
- be removed in the next major release.</para></listitem>
-
- <listitem><para>If you install a Windows 9x driver for a printer
- on your Samba host (in the printing TDB), this information will
- take precedence and the three old printing parameters
- will be ignored (including print driver location).</para></listitem>
-
- <listitem><para>If you want to migrate an existing <filename>printers.def</filename>
- file into the new setup, the current only solution is to use the Windows
- NT APW to install the NT drivers and the 9x drivers. This can be scripted
- using <command>smbclient</command> and <command>rpcclient</command>. See the
- Imprints installation client at <ulink
- url="http://imprints.sourceforge.net/">http://imprints.sourceforge.net/</ulink>
- for an example.
- </para></listitem>
-</itemizedlist>
-
-
-<warning>
-<title>Achtung!</title>
-
-<para>
-The following <filename>smb.conf</filename> parameters are considered to
-be deprecated and will be removed soon. Do not use them in new
-installations
-</para>
-
-<itemizedlist>
- <listitem><para><parameter>printer driver file (G)</parameter>
- </para></listitem>
-
- <listitem><para><parameter>printer driver (S)</parameter>
- </para></listitem>
-
- <listitem><para><parameter>printer driver location (S)</parameter>
- </para></listitem>
-</itemizedlist>
-</warning>
-
-
-<para>
-The have been two new parameters add in Samba 2.2.2 to for
-better support of Samba 2.0.x backwards capability (<parameter>disable
-spoolss</parameter>) and for using local printers drivers on Windows
-NT/2000 clients (<parameter>use client driver</parameter>). Both of
-these options are described in the smb.coinf(5) man page and are
-disabled by default.
-</para>
-
-
-</sect1>
-
-
<!--
This comment from rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex()
* on the Advanced Tab of the printer properties window.
-->
+<sect1>
+<title>Diagnosis</title>
+
+<sect2>
+<title>Introduction</title>
+
+<para>
+This is a short description of how to debug printing problems with
+Samba. This describes how to debug problems with printing from a SMB
+client to a Samba server, not the other way around. For the reverse
+see the examples/printing directory.
+</para>
+
+<para>
+Ok, so you want to print to a Samba server from your PC. The first
+thing you need to understand is that Samba does not actually do any
+printing itself, it just acts as a middleman between your PC client
+and your Unix printing subsystem. Samba receives the file from the PC
+then passes the file to a external "print command". What print command
+you use is up to you.
+</para>
+
+<para>
+The whole things is controlled using options in smb.conf. The most
+relevant options (which you should look up in the smb.conf man page)
+are:
+</para>
+
+<para><programlisting>
+ [global]
+ print command - send a file to a spooler
+ lpq command - get spool queue status
+ lprm command - remove a job
+ [printers]
+ path = /var/spool/lpd/samba
+</programlisting></para>
+
+<para>
+The following are nice to know about:
+</para>
+
+<para><programlisting>
+ queuepause command - stop a printer or print queue
+ queueresume command - start a printer or print queue
+</programlisting></para>
+
+<para>
+Example:
+</para>
+
+<para><programlisting>
+ print command = /usr/bin/lpr -r -P%p %s
+ lpq command = /usr/bin/lpq -P%p %s
+ lprm command = /usr/bin/lprm -P%p %j
+ queuepause command = /usr/sbin/lpc -P%p stop
+ queuepause command = /usr/sbin/lpc -P%p start
+</programlisting></para>
+
+<para>
+Samba should set reasonable defaults for these depending on your
+system type, but it isn't clairvoyant. It is not uncommon that you
+have to tweak these for local conditions. The commands should
+always have fully specified pathnames, as the smdb may not have
+the correct PATH values.
+</para>
+
+<para>
+When you send a job to Samba to be printed, it will make a temporary
+copy of it in the directory specified in the [printers] section.
+and it should be periodically cleaned out. The lpr -r option
+requests that the temporary copy be removed after printing; If
+printing fails then you might find leftover files in this directory,
+and it should be periodically cleaned out. Samba used the lpq
+command to determine the "job number" assigned to your print job
+by the spooler.
+</para>
+
+<para>
+The %>letter< are "macros" that get dynamically replaced with appropriate
+values when they are used. The %s gets replaced with the name of the spool
+file that Samba creates and the %p gets replaced with the name of the
+printer. The %j gets replaced with the "job number" which comes from
+the lpq output.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Debugging printer problems</title>
+
+<para>
+One way to debug printing problems is to start by replacing these
+command with shell scripts that record the arguments and the contents
+of the print file. A simple example of this kind of things might
+be:
+</para>
+
+<para><programlisting>
+ print command = /tmp/saveprint %p %s
+
+ #!/bin/saveprint
+ # we make sure that we are the right user
+ /usr/bin/id -p >/tmp/tmp.print
+ # we run the command and save the error messages
+ # replace the command with the one appropriate for your system
+ /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print
+</programlisting></para>
+
+<para>
+Then you print a file and try removing it. You may find that the
+print queue needs to be stopped in order to see the queue status
+and remove the job:
+</para>
+
+<para><programlisting>
+
+h4: {42} % echo hi >/tmp/hi
+h4: {43} % smbclient //localhost/lw4
+added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
+Password:
+Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
+smb: \> print /tmp/hi
+putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
+smb: \> queue
+1049 3 hi-17534
+smb: \> cancel 1049
+Error cancelling job 1049 : code 0
+smb: \> cancel 1049
+Job 1049 cancelled
+smb: \> queue
+smb: \> exit
+</programlisting></para>
+
+<para>
+The 'code 0' indicates that the job was removed. The comment
+by the smbclient is a bit misleading on this.
+You can observe the command output and then and look at the
+/tmp/tmp.print file to see what the results are. You can quickly
+find out if the problem is with your printing system. Often people
+have problems with their /etc/printcap file or permissions on
+various print queues.
+</para>
+</sect2>
+
+<sect2>
+<title>What printers do I have?</title>
+
+<para>
+You can use the 'testprns' program to check to see if the printer
+name you are using is recognized by Samba. For example, you can
+use:
+</para>
+
+<para><programlisting>
+ testprns printer /etc/printcap
+</programlisting></para>
+
+<para>
+Samba can get its printcap information from a file or from a program.
+You can try the following to see the format of the extracted
+information:
+</para>
+
+<para><programlisting>
+ testprns -a printer /etc/printcap
+
+ testprns -a printer '|/bin/cat printcap'
+</programlisting></para>
+
+</sect2>
+
+<sect2>
+<title>Setting up printcap and print servers</title>
+
+<para>
+You may need to set up some printcaps for your Samba system to use.
+It is strongly recommended that you use the facilities provided by
+the print spooler to set up queues and printcap information.
+</para>
+
+<para>
+Samba requires either a printcap or program to deliver printcap
+information. This printcap information has the format:
+</para>
+
+<para><programlisting>
+ name|alias1|alias2...:option=value:...
+</programlisting></para>
+
+<para>
+For almost all printing systems, the printer 'name' must be composed
+only of alphanumeric or underscore '_' characters. Some systems also
+allow hyphens ('-') as well. An alias is an alternative name for the
+printer, and an alias with a space in it is used as a 'comment'
+about the printer. The printcap format optionally uses a \ at the end of lines
+to extend the printcap to multiple lines.
+</para>
+
+<para>
+Here are some examples of printcap files:
+</para>
+
+<para>
+<orderedlist>
+<listitem><para>
+pr just printer name
+</para></listitem>
+<listitem><para>
+pr|alias printer name and alias
+</para></listitem>
+<listitem><para>
+pr|My Printer printer name, alias used as comment
+</para></listitem>
+<listitem><para>
+pr:sh:\ Same as pr:sh:cm= testing
+ :cm= \
+ testing
+</para></listitem>
+<listitem><para>
+pr:sh Same as pr:sh:cm= testing
+ :cm= testing
+</para></listitem>
+</orderedlist>
+</para>
+
+<para>
+Samba reads the printcap information when first started. If you make
+changes in the printcap information, then you must do the following:
+</para>
+
+<orderedlist>
+
+<listitem><para>
+make sure that the print spooler is aware of these changes.
+The LPRng system uses the 'lpc reread' command to do this.
+</para></listitem>
+
+<listitem><para>
+make sure that the spool queues, etc., exist and have the
+correct permissions. The LPRng system uses the 'checkpc -f'
+command to do this.
+</para></listitem>
+
+<listitem><para>
+You now should send a SIGHUP signal to the smbd server to have
+it reread the printcap information.
+</para></listitem>
+</orderedlist>
+
+</sect2>
+
+<sect2>
+<title>Job sent, no output</title>
+
+<para>
+This is the most frustrating part of printing. You may have sent the
+job, verified that the job was forwarded, set up a wrapper around
+the command to send the file, but there was no output from the printer.
+</para>
+
+<para>
+First, check to make sure that the job REALLY is getting to the
+right print queue. If you are using a BSD or LPRng print spooler,
+you can temporarily stop the printing of jobs. Jobs can still be
+submitted, but they will not be printed. Use:
+</para>
+
+<para><programlisting>
+ lpc -Pprinter stop
+</programlisting></para>
+
+<para>
+Now submit a print job and then use 'lpq -Pprinter' to see if the
+job is in the print queue. If it is not in the print queue then
+you will have to find out why it is not being accepted for printing.
+</para>
+
+<para>
+Next, you may want to check to see what the format of the job really
+was. With the assistance of the system administrator you can view
+the submitted jobs files. You may be surprised to find that these
+are not in what you would expect to call a printable format.
+You can use the UNIX 'file' utitily to determine what the job
+format actually is:
+</para>
+
+<para><programlisting>
+ cd /var/spool/lpd/printer # spool directory of print jobs
+ ls # find job files
+ file dfA001myhost
+</programlisting></para>
+
+<para>
+You should make sure that your printer supports this format OR that
+your system administrator has installed a 'print filter' that will
+convert the file to a format appropriate for your printer.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Job sent, strange output</title>
+
+<para>
+Once you have the job printing, you can then start worrying about
+making it print nicely.
+</para>
+
+<para>
+The most common problem is extra pages of output: banner pages
+OR blank pages at the end.
+</para>
+
+<para>
+If you are getting banner pages, check and make sure that the
+printcap option or printer option is configured for no banners.
+If you have a printcap, this is the :sh (suppress header or banner
+page) option. You should have the following in your printer.
+</para>
+
+<para><programlisting>
+ printer: ... :sh
+</programlisting></para>
+
+<para>
+If you have this option and are still getting banner pages, there
+is a strong chance that your printer is generating them for you
+automatically. You should make sure that banner printing is disabled
+for the printer. This usually requires using the printer setup software
+or procedures supplied by the printer manufacturer.
+</para>
+
+<para>
+If you get an extra page of output, this could be due to problems
+with your job format, or if you are generating PostScript jobs,
+incorrect setting on your printer driver on the MicroSoft client.
+For example, under Win95 there is a option:
+</para>
+
+<para><programlisting>
+ Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|
+</programlisting></para>
+
+<para>
+that allows you to choose if a Ctrl-D is appended to all jobs.
+This is a very bad thing to do, as most spooling systems will
+automatically add a ^D to the end of the job if it is detected as
+PostScript. The multiple ^D may cause an additional page of output.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Raw PostScript printed</title>
+
+<para>
+This is a problem that is usually caused by either the print spooling
+system putting information at the start of the print job that makes
+the printer think the job is a text file, or your printer simply
+does not support PostScript. You may need to enable 'Automatic
+Format Detection' on your printer.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Advanced Printing</title>
+
+<para>
+Note that you can do some pretty magic things by using your
+imagination with the "print command" option and some shell scripts.
+Doing print accounting is easy by passing the %U option to a print
+command shell script. You could even make the print command detect
+the type of output and its size and send it to an appropriate
+printer.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Real debugging</title>
+
+<para>
+If the above debug tips don't help, then maybe you need to bring in
+the bug guns, system tracing. See Tracing.txt in this directory.
+</para>
+</sect2>
+</sect1>
+
</chapter>
<!ENTITY Samba-PAM SYSTEM "PAM-Authentication-And-Samba.sgml">
<!ENTITY Samba-LDAP SYSTEM "Samba-LDAP-HOWTO.sgml">
<!ENTITY Diagnosis SYSTEM "Diagnosis.sgml">
-<!ENTITY PRINTING SYSTEM "Printing.sgml">
<!ENTITY BUGS SYSTEM "Bugs.sgml">
<!ENTITY SECURITY-LEVEL SYSTEM "security_level.sgml">
<!ENTITY SPEED SYSTEM "Speed.sgml">
<!ENTITY Portability SYSTEM "Portability.sgml">
<!ENTITY Other-Clients SYSTEM "Other-Clients.sgml">
<!ENTITY ADS-HOWTO SYSTEM "ADS-HOWTO.sgml">
+<!ENTITY oplocks SYSTEM "oplocks.sgml">
+<!ENTITY pdb-mysql SYSTEM "pdb_mysql.sgml">
+<!ENTITY pdb-xml SYSTEM "pdb_xml.sgml">
+<!ENTITY VFS SYSTEM "VFS.sgml">
]>
<book id="Samba-HOWTO-Collection">
<title>Abstract</title>
<para>
-<emphasis>Last Update</emphasis> : Thu Aug 15 12:48:45 CDT 2002
+<emphasis>Last Update</emphasis> : $Date: 2002/11/22 00:32:23 $
</para>
<para>
than one person can maintain. The most recent version of this document
can be found at <ulink url="http://www.samba.org/">http://www.samba.org/</ulink>
on the "Documentation" page. Please send updates to <ulink
-url="mailto:jerry@samba.org">jerry@samba.org</ulink>.
+url="mailto:jerry@samba.org">jerry@samba.org</ulink> or
+<ulink url="mailto:jelmer@samba.org">jelmer@samba.org</ulink>.
</para>
<para>
</dedication>
<!-- Chapters -->
+<part id="introduction">
+<title>General installation</title>
+<partintro>
+<title>Introduction</title>
+<para>This part contains general info on how to install samba
+and how to configure the parts of samba you will most likely need.
+PLEASE read this.</para>
+</partintro>
&UNIX-INSTALL;
+&BROWSING;
+&oplocks;
+&BROWSING-Quick;
+&ENCRYPTION;
+</part>
+
+<part id="type">
+<title>Type of installation</title>
+<partintro>
+<title>Introduction</title>
+<para>
+Samba can operate in various SMB networks. This part contains information on configuring samba
+for various environments.
+</para>
+</partintro>
+&SECURITY-LEVEL;
+&Samba-PDC-HOWTO;
+&Samba-BDC-HOWTO;
+&ADS-HOWTO;
+&DOMAIN-MEMBER;
+</part>
+
+<part id="optional">
+<title>Optional configuration</title>
+<partintro>
+<title>Introduction</title>
+<para>Samba has several features that you might want or might not want to use. The chapters in this
+part each cover one specific feature.</para>
+</partintro>
&IntegratingWithWindows;
+&NT-Security;
&Samba-PAM;
&MS-Dfs-Setup;
-&NT-Security;
&PRINTER-DRIVER2;
-&PRINTING;
-&SECURITY-LEVEL;
-&DOMAIN-MEMBER;
&WINBIND;
-&Samba-PDC-HOWTO;
-&Samba-BDC-HOWTO;
+&pdb-mysql;
+&pdb-xml;
+&VFS;
&Samba-LDAP;
-&ADS-HOWTO;
-&BROWSING;
-&BROWSING-Quick;
-&SPEED;
&CVS-Access;
-&BUGS;
&GROUP-MAPPING-HOWTO;
+&SPEED;
+</part>
-<!-- Appendices -->
+<part id="Appendixes">
+<title>Appendixes</title>
&Portability;
&Other-Clients;
+&BUGS;
&Diagnosis;
+</part>
</book>
</author>
</chapterinfo>
-<title>Security levels</title>
-
-<sect1>
-<title>Introduction</title>
-
-<para>
-Samba supports the following options to the global smb.conf parameter
-</para>
-
-<para><programlisting>
-[global]
-<ulink url="smb.conf.5.html#SECURITY"><parameter>security</parameter></ulink> = [share|user(default)|domain|ads]
-</programlisting></para>
-
-<para>
-Please refer to the smb.conf man page for usage information and to the document
-<ulink url="DOMAIN_MEMBER.html">DOMAIN_MEMBER.html</ulink> for further background details
-on domain mode security. The Windows 2000 Kerberos domain security model
-(security = ads) is described in the <ulink url="ADS-HOWTO.html">ADS-HOWTO.html</ulink>.
-</para>
-
-<para>
-Of the above, "security = server" means that Samba reports to clients that
-it is running in "user mode" but actually passes off all authentication
-requests to another "user mode" server. This requires an additional
-parameter "password server =" that points to the real authentication server.
-That real authentication server can be another Samba server or can be a
-Windows NT server, the later natively capable of encrypted password support.
-</para>
-
-</sect1>
-
-<sect1>
-<title>More complete description of security levels</title>
+<title>User and Share security level (for servers not in a domain)</title>
<para>
A SMB server tells the client at startup what "security level" it is
to SMB style encryption, although there are some fairly simple management
schemes by which the two could be kept in sync.
</para>
-</sect1>
+
+<para>
+"security = server" means that Samba reports to clients that
+it is running in "user mode" but actually passes off all authentication
+requests to another "user mode" server. This requires an additional
+parameter "password server =" that points to the real authentication server.
+That real authentication server can be another Samba server or can be a
+Windows NT server, the later natively capable of encrypted password support.
+</para>
+
</chapter>
</para>
<para>
-The latest version of SAMBA (version 2.2.2 as of this writing), now
+The latest version of SAMBA (version 3.0 as of this writing), now
includes a functioning winbindd daemon. Please refer to the
<ulink url="http://samba.org/">main SAMBA web page</ulink> or,
better yet, your closest SAMBA mirror site for instructions on
git.samba.org / samba.git / commitdiff